external L2 ethernet connections

Mon Feb 23 17:47:28 UTC 2009

All of the protocols below should be turned off; my understanding is
that with dot1q trunking vlan1 cannot be removed from the trunk,
although Cisco's isl trunking allows the removal of all vlans. If Cisco
equipment is used, the "bpdu filter" command is useful as it instructs
the switch to neither send bpdus nor accept them. These are good
practices not just for connectivity to other AS's, but also in cases
where Ethernet switches comprise a geographically dispersed WAN
backbone. The key is to turn off all layer 2 state machines in the
connected Ethernet switches, enabling only layer 3 state machines. 

We have found with some vendors' equipment that the layer 2/layer 3
state machines are not tightly integrated so, for instance, a cam
timeout in layer 2 will remove the underlying port/mac table entry for a
destination layer 3 network, resulting in unknown unicast flooding with
noticeable effects on user response time.

-----Original Message-----
From: Joe Maimon [mailto:jmaimon at ttec.com] 
Sent: Friday, February 20, 2009 6:42 AM
To: nanog at nanog.org
Subject: external L2 ethernet connections

Does anyone have a best practice list of things to disable/filter/turn 
off on ethernet ports l2 connected to other AS's

cdp
stp
switchport negotiate
vtp
if trunking, limit vlans, no vlan1

So on so forth.

Switches do so many darn things all by themselves, as any packet capture

shows.

Thanks,

Joe