Вы находитесь на странице: 1из 4

STP attack and Root Protection feature on Huawei switches

Spanning Tree protocol is a loops prevention mechanism in a bridged LAN. Every STP
topology has its own root bridge, which determines how STP topology is calculated. The role
of the root bridge is to act as a reference point in the network, so that all other switches can
determine, how far each of their ports is from the root bridge. The port, which has the
lowest path cost, is placed into a forwarding state. All other ports, that can lead to the root
bridge, are blocked. Ports in the switching topology, which lead away from the Root Bridge,
remain forwarding. You can recall STP operations reading the following article: Multiple
Spanning Tree Protocol on Huawei switch.

How does the root bridge election process work?

The root bridge for each STP instance is determined by the bridge ID. The bridge ID consists
of a configurable bridge priority and the MAC address of the bridge:

[Huawei]display stp
-------[CIST Global Info][Mode MSTP]-------
CIST Bridge :32768.4c1f-ccd4-1c03

In this example the bridge ID is 32768.4c1f-ccd4-1c03, where:

32768 is the bridge priority

4c1f-ccd4-1c03 is the MAC address of the bridge.

The bridge with the lowest bridge ID is elected as the root bridge. If the bridge priorities are
equal, or if the bridge priority is not configured, the bridge with the lowest MAC address is
elected the root bridge.

How to change the bridge priority on Huawei switch?

[Huawei]stp priority ?
INTEGER Bridge priority, in steps of 4096

A predefined macro can be also used to change bridge priority:

[Huawei]stp root ?
primary Primary root switch
secondary Secondary root switch

The same macro, when changing bridge priority in particular STP instance:

[Huawei]stp instance 1 root ?

primary Primary root switch
secondary Secondary root switch

The first option changes priority to 0, the second to 4096. Default bridge priority equals to

Any switch can be a root bridge in a network. But the most optimal forwarding topology
places the root bridge at a specific predetermined location. Lets take the following example:
Aggregation switch AGG-SW1 was elected as the root bridge and AGG-SW2 as the secondary
root bridge, in case of AGG-SW1s failure. STP topology was built as expected, fast speed
links are used to forward traffic between devices.

Even if the root bridge was configured with priority 0, every switch in this network, with
priority 0 and a lower MAC address, can be elected as a new root bridge. Lets imagine a
situation, where someone connects additional switch, or just a software-based bridge
application lunched on a PC with dual NICs and lower bridge ID, like below:
Our PC was elected as a new root bridge for this VLAN. STP topology was changed and now,
low-speed access links are used to forward traffic between aggregation switches. If more
data flow via the aggregation link in that VLAN, than this link can accommodate, the drop of
some frames occur. As a result, network performance can be affected.

To prevent this from happening, STP Root Protection can be used on interfaces, which
should not receive superior BPDUs. These interfaces usually are located on an administrative
boundary. In our case, Root Protection feature should be enabled on interfaces as in the
picture below:
To enable Root Protection on Huawei switch, use command:

[Huawei]int GigabitEthernet 0/0/1

[Huawei-GigabitEthernet0/0/1]stp root-protection

Remember, that root protection takes effect only on designated ports.