EVPN-VXLAN: BPDU protection

You can enable BPDU protection in an EVPN-VXLAN configuration. With a spanning tree protocol configured on an edge port, you can enable BPDU protection. If a BPDU is received on the edge port, the edge port is disabled and it stops forwarding all traffic. You can also configure BPDU protection on VXLAN interfaces without a spanning tree protocol configured, or enable BPDU protection and have other traffic forwarded. Only the BPDUs are dropped, and all other traffic is forwarded. Additionally, you can unblock an interface either automatically or manually.

• To enable BPDU protection with RSTP on an edge port on access and leaf devices: set protocols rstp interface interface-name edge set protocols rstp bpdu-block-on-edge
• To enable BPDU protection with a spanning tree protocol on access and leaf devices: set protocols layer2-control bpdu-block interface interface-name
• To enable BPDU protection but still forward other traffic on access and leaf devices: set protocols layer2-control bpdu-block interface interface-name drop
• To automatically unblock an interface using an expiry timer on access and leaf devices: set protocols layer2-control bpdu-block disable-timeout time in seconds
• To manually unblock an interface on access and leaf devices: run clear error bpdu interface all