博客

一、实验拓扑：



二、命令部署：

1、SW1、SW2、SW3部署Trunk和VTP：

ESW1(config)#int range f1/0 – 1

ESW1(config-if-range)#no shutdown

ESW1(config-if-range)#switchport trunk encapsulation dot1q

ESW1(config-if-range)#switchport mode trunk

ESW1(config)#vtp domain pl

ESW1(config)#vtp mode server

ESW2(config)#int range f1/0 – 1

ESW2(config-if-range)#no shutdown

ESW2(config-if-range)#switchport trunk encapsulation dot1q

ESW2(config-if-range)#switchport mode trunk

ESW2(config)#vtp domain pl

ESW2(config)#vtp mode client

ESW3(config)#int range f1/0 – 1

ESW3(config-if-range)#no shutdown

ESW3(config-if-range)#switchport trunk encapsulation dot1q

ESW3(config-if-range)#switchport mode trunk

ESW3(config)#vtp domain pl

ESW3(config)#vtp mode client

ESW3(config)#int f1/2

ESW3(config-if)#no shutdown

ESW3(config-if)#switchport mode access

2、部署BPDUfilter

全局部署BPDUfilter：

IOU3(config)#spanning-tree portfast bpdufilter default

IOU3#show spanning-tree summary totals

Switch is in pvst mode

Root bridge for: none

Extended system ID is enabled

Portfast Default is disabled

PortFast BPDU Guard Default is disabled

Portfast BPDU Filter Default is enabled

Hacker#debug spanning-tree bpdu receive

Spanning Tree BPDU Received debugging is on

Hacker#

*Apr 26 03:34:17.966: STP: VLAN0001 rx BPDU: config protocol = ieee, packet from Ethernet1/0 , linktype IEEE_SPANNING , enctype 2, encsize 17

IOU3#debug spanning-tree bpdu transmit

Spanning Tree BPDU Transmitted debugging is on

IOU3#

*Apr 26 03:38:05.537: STP: VLAN0001 Et0/0 tx BPDU: config protocol=ieee

Data : 0000 00 00 00 8001AABBCC000100 00000064 8001AABBCC000300 8001 0100 1400 0200 0F00

接口下部署BPDUfilter：

IOU3(config)#int e1/2

IOU3(config-if)#spanning-tree bpdufilter enable

IOU3#show spanning-tree summary totals

Switch is in pvst mode

Root bridge for: none

Extended system ID is enabled

Portfast Default is disabled

PortFast BPDU Guard Default is disabled

Portfast BPDU Filter Default is enabled

IOU3#debug spanning-tree bpdu transmit

Spanning Tree BPDU Transmitted debugging is on

IOU3#

*Apr 26 04:28:40.190: STP: VLAN0001 Et0/0 tx BPDU: config protocol=ieee

Data : 0000 00 00 00 8001AABBCC000100 00000064 8001AABBCC000300 8001 0100 1400 0200 0F00

IOU3#debug spanning-tree bpdu receive

Spanning Tree BPDU Received debugging is on

IOU3#

*Apr 26 04:30:14.396: STP: VLAN0001 rx BPDU: config protocol = ieee, packet from Ethernet1/1 , linktype IEEE_SPANNING , enctype 2, encsize 17

Hacker#debug spanning-tree bpdu receive

Spanning Tree BPDU Received debugging is on

然后看不到有任何包出现。

IOU3(config-if)#no spanning-tree bpdufilter enable

Hacker#

*Apr 26 04:36:14.565: STP: VLAN0001 rx BPDU: config protocol = ieee, packet from Ethernet1/0 , linktype IEEE_SPANNING , enctype 2, encsize 17

no掉以后Hacker又会有Receive包出现

3、部署BPDUGuard和回复机制

全局部署：

IOU3(config)#spanning-tree portfast bpduguard default

Switch is in pvst mode

Root bridge for: none

Extended system ID is enabled

Portfast Default is disabled

PortFast BPDU Guard Default is enabled

Portfast BPDU Filter Default is disabled

Loopguard Default is disabled

EtherChannel misconfig guard is enabled

IOU3#show int e1/2

Ethernet1/2 is down, line protocol is down (err-disabled)

成功了！！

接口部署：

IOU3(config-if)#spanning-tree bpduguard enable

IOU3#show spanning-tree summary totals

Switch is in pvst mode

Root bridge for: none

Extended system ID is enabled

Portfast Default is disabled

PortFast BPDU Guard Default is disabled

Portfast BPDU Filter Default is disabled

Loopguard Default is disabled

EtherChannel misconfig guard is enabled

IOU3(config)#int e1/2

IOU3(config-if)#shutdown

IOU3(config-if)#no shutdown

Hacker(config)#int e1/0

Hacker(config-if)#shutdown

Hacker(config-if)#no shutdown

IOU3#show int e1/2

Ethernet1/2 is down, line protocol is down (err-disabled)

接口成功！！！

IOU3(config)#errdisable recovery cause bpduguard

IOU3(config)#errdisable recovery interval 30