Also you could set the interface to not negotiate the access/trunking mode with switchport nonegotiate and remove the configured access vlan.Pearson Education, Inc., 221 River Street, Hoboken, New Jersey 07030, (Pearson) presents this site to provide information about Pearson IT Certification products and services that can be purchased through this site. This will prevent any other spanning-tree capable device from being connected to that interface.įurther, if you do not have an untagged (native) interface on the firewall, allowing the native vlan on the trunk is not required and your allowed vlan list could be shortened to exclude 99. If you do not choose to configure BPDU filtering, then BPDU-Guard should be configured either by default ( spanning-tree portfast bpduguard default) or specifically on the interface.
This does not provide any loop protection, but the ASA (non-5505 as indicated) is incapable of creating a L2 loop and your stated goal is to remove BPDU's from the interface.Ĭonfiguring root-guard on the interface will not be useful since the ASA can never send any BPDU, and especially not a superior BPDU. If you can be sure of your cabling then I would recommend implementing spanning-tree bpdufilter on the interface towards the firewall since you have already configured the interface as an edge port.
I have stacked 2960X switches trunked to a single ASA 5515X in routed mode, and I've captured the drops with capture voip type asp-drop l2_acl after seeing the l2_acl counter incrementing in show asp drop.ĭoes the ASA support spanning-tree in routed mode? Should spanning-tree be disabled on the port-channel on the switch going to the firewall? Should I add bpdu rootguard to be safe? I either want the ASA to handle/ignore the BPDUs silently from the 2960X's or stop the switches from sending them, but add some loop protection.ĪSA asp drop capture - first three packets shown matching BPDU MAC:ġ: 23:54:32.662502 5ca4.8a10.5e31 0x8100 Length: 68Ĩ02.1Q vlan#11 P7 802.3 encap packet Drop-reason: (l2_acl) FP L2 rule dropĢ: 23:54:32.662715 5ca4.8a10.5e31 0x8100 Length: 68Ĩ02.1Q vlan#120 P7 802.3 encap packet Drop-reason: (l2_acl) FP L2 rule dropģ: 23:54:33.665386 5ca4.8a10.5e31 0x8100 Length: 68Ĩ02.1Q vlan#10 P7 802.3 encap packet Drop-reason: (l2_acl) FP L2 rule dropĤ: 23:54:33.666087 5ca4.8a10.5e31 0x8100 Length: 68Ĩ02.1Q vlan#910 P7 802.3 encap packet Drop-reason: (l2_acl) FP L2 rule drop
0 kommentar(er)
