Description

On ELS switches, there is no feature for blocking BPDUs from being flooded out to all other ports in the same VLAN if that ingressing port does not have xSTP configured.

Symptoms

This issue happens only on ELS switches since the command 'set ethernet-switching-options bpdu-block interface <interface-name> drop' does not exist. There is a feature for blocking ports that receive BPDUs, which is 'set protocols layer2-control bpdu-block interface <interface-name> ' , but there is no feature for dropping BPDUs on a port without xSTP configured.

Solution


Add a layer 2 firewall filter to match the BPDUs destination Mac address and discard the BPDUs. 

Note: Although this is effective when the firewall filter is applied as "output" on the interface, you do not want BPDUs to be flooded out of. It will not work when applied as "input" on the interface where you are receiving the unwanted BPDUs.

In this example, we will match both the PVST+ and the RSTP MAC addresses:

{master:0}
root@switch> show vlans Orange

Routing instance VLAN name Tag Interfaces
default-switch Orange 22
ge-0/0/2.0*
xe-0/2/0.0* {master:0}
root@switch> show spanning-tree interface
Spanning-tree is not enabled at global level.

{master:0}
root@switch> show configuration firewall
family ethernet-switching {
      filter block-bpdu {
           term block-bpdu {
                from {
                     destination-mac-address {
                          01:80:c2:00:00:00/48;
                          01:00:0c:cc:cc:cd/48;
                     }
                }
                then {
                     discard;
                     count BPDU_FILTER;
                }
           }
           term accept-all {
                then accept; ----> Don't forget the final term that accepts everything else!
           }
      }
} 
 
 Here, the filter is applied as output on xe-0/2/0 to prevent BPDU's received on ge-0/0/2 from being flooded out xe-0/2/0 
 
  {master:0} 
 root@switch> show configuration interfaces xe-0/2/0 
 unit 0 { 
       family ethernet-switching { 
            vlan { 
                 members Orange; 
            } 
            filter { 
                  output block-bpdu; 
            } 
       } 
 }