7.4 STP Security

Configuring protection function for devices can prevent devices from any malicious attack against STP features. The STP Security function can be implemented on Port Protect and TC Protect pages.

Port Protect function is to prevent the devices from any malicious attack against STP features.

7.4.1 Port Protect

On this page you can configure loop protect feature, root protect feature, TC protect feature, BPDU protect feature and BPDU filter feature for ports. You are suggested to enable corresponding protection feature for the qualified ports.

Loop Protect

In a stable network, a switch maintains the states of ports by receiving and processing BPDU packets from the upstream switch. However, when link congestions or link failures occurred to the network, a down stream switch does not receive BPDU packets for certain period, which results in spanning trees being regenerated and roles of ports being reselected, and causes the blocked ports to transit to forwarding state. Therefore, loops may be incurred in the network.

The loop protect function can suppresses loops. With this function enabled, a port, regardless of the role it plays in instances, is always set to blocking state, when the port does not receive BPDU packets from the upstream switch and spanning trees are regenerated, and thereby loops can be prevented.

Root Protect

A CIST and its secondary root bridges are usually located in the high-bandwidth core region. Wrong configuration or malicious attacks may result in configuration BPDU packets with higher priorities being received by the legal root bridge, which causes the current legal root bridge to lose its position and network topology jitter to occur. In this case, flows that should travel along high-speed links may lead to low-speed links, and network congestion may occur.

To avoid this, MSTP provides root protect function. Ports with this function enabled can only be set as designated ports in all spanning tree instances. When a port of this type receives BDPU packets with higher priority, it transits its state to blocking state and stops forwarding packets (as if it is disconnected from the link). The port resumes the normal state if it does not receive any configuration BPDU packets with higher priorities for a period of two times of forward delay.

TC Protect

A switch removes MAC address entries upon receiving TC-BPDU packets. If a user maliciously sends a large amount of TC-BPDU packets to a switch in a short period, the switch will be busy with removing MAC address entries, which may decrease the performance and stability of the network.

To prevent the switch from frequently removing MAC address entries, you can enable the TC protect function on the switch. With TC protect function enabled, if the account number of the received TC-BPDUs exceeds the maximum number you set in the TC threshold field, the switch will not performs the removing operation in the TC protect cycle. Such a mechanism prevents the switch from frequently removing MAC address entries.

BPDU Protect

Ports of the switch directly connected to PCs or servers are configured as edge ports to rapidly transit their states. When these ports receive BPDUs, the system automatically configures these ports as non-edge ports and regenerates spanning trees, which may cause network topology jitter.

103

Page 112 Page 114
Page 113
Image 113
TP-Link TL-SG3424P manual STP Security, Port Protect
Page 112 Page 114

TL-SG3424P specifications

The TP-Link TL-SG3424P is a high-performance managed switch designed to meet the needs of small to medium-sized businesses. Offering 24 Gigabit Ethernet ports, this device is an ideal solution for improving network efficiency and ensuring seamless data transfer across multiple devices. The switch not only facilitates connectivity but also provides robust management features to enhance the performance and security of your network.

One of the standout features of the TL-SG3424P is its Power over Ethernet (PoE) capability, which allows it to deliver power and data over the same Ethernet cable. This feature is particularly beneficial for deploying devices such as IP cameras, VoIP phones, and wireless access points without the need for additional power sources. With a total power budget of 250W, the TL-SG3424P can support a diverse range of PoE devices, providing convenience and flexibility in deployment.

In terms of management, the TL-SG3424P offers a user-friendly web interface, allowing network administrators to configure and monitor the switch with ease. It supports advanced Layer 2 features, including VLANs, Quality of Service (QoS), and Link Aggregation. These features enhance network performance by optimizing traffic flow and prioritizing essential applications. The switch also includes comprehensive security features, such as Port Security and Access Control Lists (ACL), which help protect against unauthorized access and ensure data integrity.

The build quality of the TL-SG3424P is robust, designed to handle demanding network environments. It includes a fanless design, which ensures silent operation, making it suitable for office environments where noise can be a distraction. The metal chassis is durable and built for longevity, ensuring that the device will withstand rigorous usage over time.

Furthermore, the TL-SG3424P supports SNMP (Simple Network Management Protocol), allowing for centralized network monitoring and management. This makes it easier for IT teams to keep track of network health and performance, enabling timely interventions when necessary.

In conclusion, the TP-Link TL-SG3424P is a versatile and powerful managed switch that combines PoE capabilities with advanced network management features, making it a perfect choice for businesses looking to upgrade their network infrastructure. With its reliable performance and robust features, it provides an excellent solution for enhancing productivity and connectivity in any office setting.
Top Page Image Contents