BPDU Guard and Port Security

What it is

BPDU guard stops unwanted switches from joining the tree, and port security controls which devices may use a port.

Both protect the access edge, where untrusted people plug in cables. They answer two different questions. BPDU guard asks whether a switch is attached, and port security asks which host is attached.

Use them together on every port that faces users.

How it works

BPDU guard reacts to a message, and port security restricts addresses.

BPDU guard

An edge port should only ever face an end device, so it should never receive a BPDU.

/interface bridge port set [find interface=ether5] edge=yes bpdu-guard=yes

If a BPDU arrives on such a port, a switch must be attached. The bridge protects itself by shutting the port. An administrator then looks for the cause and brings the port back by hand.

This prevents a rogue or misconfigured switch from changing the root, and from creating a loop behind the port.

BPDU guard compared with related options

Choose bpdu-guard on ports where no switch should ever appear. Use restricted-role where a switch may be legitimate, but must never become the root.

Port security goals

Port security limits which MAC addresses may use a port.

The aims are to stop a user from plugging in a hub with many hosts, to stop address spoofing, and to keep unknown devices off the network. It does not replace authentication, because a MAC address can be copied.

Controlling MAC learning

The simplest control is to limit how addresses are learned.

• Static entries: list the allowed MAC address and its port in the host table of the switch chip.
• Learning limit: cap the number of addresses a port may learn, where the chip supports it.
• Learning off: stop the port from learning addresses, so only static entries work.

/interface ethernet switch host add mac-address=00:11:22:33:44:55 ports=ether2
/interface bridge port set [find interface=ether2] learn=no

The first line creates a static host entry in the switch host table. The second stops the bridge port from learning dynamic addresses, on RouterOS versions that have the setting. Without learning, the bridge does not know where hosts are, so it floods frames for them unless you limit flooding.

Limiting unknown traffic

Turn off flooding of unknown unicast on a locked port.

/interface bridge port set [find interface=ether2] unknown-unicast-flood=no

Now frames for unknown destinations are not sent out of the port.

Port security with switch rules

Switch rules can drop frames that enter a port with a given source MAC address.

The rule runs in the chip at wire speed, and it uses an empty new-dst-ports, as the previous page shows. Each rule covers one case, so this suits blocking a few known bad addresses. A full list of allowed hosts is better done with static host entries and learning off.

Where it fits

Port security suits fixed devices, such as cameras, printers and phones.

For laptops and mobile devices, 802.1X is a better fit, because it authenticates the user or device and not only the address. The next page covers it.

Checking

/interface bridge host print
/interface ethernet switch host print

Look for the addresses learned on each port, and confirm that unknown addresses do not appear on locked ports.