You can create a custom segment security segment profile with MAC destination addresses from the allowed BPDU list and configure rate limiting.

Prerequisites

Familiarize yourself with the segment security segment profile concept. See Understanding Switch Security Switching Profile.

Procedure

  1. From your browser, log in with admin privileges to an NSX Manager at https://<nsx-manager-ip-address>.
  2. Select Networking > Segments > Segment Profiles.
  3. Click Add Segment Profile and select Segment Security.
  4. Complete the segment security profile details.
    Option Description
    Name Name of the profile.
    BPDU Filter

    Toggle the BPDU Filter button to enable BPDU filtering. Disabled by default.

    When the BPDU filter is enabled, all of the traffic to BPDU destination MAC address is blocked. The BPDU filter when enabled also disables STP on the logical switch ports because these ports are not expected to take part in STP.

    BPDU Filter Allow List Click the destination MAC address from the BPDU destination MAC addresses list to allow traffic to the permitted destination. You must enable BPDU Filter to be able to select from this list.
    DHCP Filter

    Toggle the Server Block button and Client Block button to enable DHCP filtering. Both are disabled by default.

    DHCP Server Block blocks traffic from a DHCP server to a DHCP client. Note that it does not block traffic from a DHCP server to a DHCP relay agent.

    DHCP Client Block prevents a VM from acquiring a DHCP IP address by blocking DHCP requests.

    DHCPv6 Filter

    Toggle the Server Block - IPv6 button and Client Block - IPv6 button to enable DHCP filtering. Both are disabled by default.

    DHCPv6 Server Block blocks traffic from a DHCPv6 server to a DHCPv6 client. Note that it does not block traffic from a DHCP server to a DHCP relay agent. Packets whose UDP source port number is 547 are filtered.

    DHCPv6 Client Block prevents a VM from acquiring a DHCP IP address by blocking DHCP requests. Packets whose UDP source port number is 546 are filtered.

    Block Non-IP Traffic

    Toggle the Block Non-IP Traffic button to allow only IPv4, IPv6, ARP, and BPDU traffic.

    The rest of the non-IP traffic is blocked. The permitted IPv4, IPv6, ARP, GARP and BPDU traffic is based on other policies set in address binding and SpoofGuard configuration.

    By default, this option is disabled to allow non-IP traffic to be handled as regular traffic.

    RA Guard Toggle the RA Guard button to filter out ingress IPv6 router advertisements. ICMPv6 type 134 packets are filtered out. This option is enabled by default.
    Rate Limits

    Set a rate limit for broadcast and multicast traffic. This option is enabled by default.

    Rate limits can be used to protect the logical switch or VMs from events such as broadcast storms.

    To avoid any connectivity problems, the minimum rate limit value must be >= 10 pps.

  5. Click Save.