Cisco Ethernet switch Manual do Utilizador descarregar pdf (Página 56)

565656

l2-security-bh.ppt

STP Attack Mitigation

¥ DonÕt disable STP, introducing a loop would become another attack

¥ BPDU Guard

Disables ports using portfast upon detection of a BPDU message on the port

Globally enabled on all ports running portfast

Available in CatOS 5.4.1 for Cat 2K, 4K, 5K, and 6K; 12.0XE for native IOS 6K;

12.1(8a)EW for 4K Sup III; 12.1(4)EA1 for 3550; 12.1(6)EA2 for 2950

¥ Root Guard

Disables ports who would become the root bridge due to their BPDU

Configured on a per port basis

Available in CatOS 6.1.1 for Cat 29XX, 4K, 5K, and 6K; 12.0(7) XE for native IOS 6K,

12.1(8a)EW for 4K Sup III; 29/3500XL in 12.0(5)XU; 3550 in 12.1(4)EA1; 2950 in

12.1(6)EA2

CatOS> (enable)set spantree portfast bpdu-guard enable

IOS(config)#spanning-tree portfast bpduguard

CatOS> (enable) set spantree guard root 1/1

IOS(config)#spanning-tree guard root (or rootguard)

1 2 ... 51 52 53 54 55 56 57 58 59 60 61 ... 83 84

Sem comentários

Cisco Ethernet switch Manual do Utilizador Página 56