To secure a Layer 2 network running Multiple VLAN Registration Protocol (MVRP) against unauthorized VLAN propagation from rogue devices, you must control the registration state of the ports.
* Forbidden Registration Mode (Option D): This mode is specifically designed to prevent an interface from participating in the MVRP exchange.
* When a port is set to forbidden, it will neither register nor declare VLANs (except those statically configured on the interface).
* If a rogue device sends MVRP PDUs to this interface, the distribution switch will ignore those PDUs, preventing the rogue device from dynamically creating or learning VLANs through that port.
* Registration Hierarchy: In Junos OS 24.4, this is configured at the [edit protocols mvrp interface
<interface-name> registration forbidden] level.
* Other Modes: normal (default) allows full participation, while restricted ignores joins for VLANs not already statically defined on the switch but still declares its own.