All right, let's jump into the lab and see these topology protection mechanisms
in place.
Our lab topology is going to reflect somewhat of a modern network design.
We have a distribution layer up here with switches three and four.
We're going to find that switch three is the root for all of the VLANs.
We're not doing anything per VLAN in the lab topology.
We also have switch five down here as an access switch.
Furthermore, we have switches one and two that shouldn't really be connected to
the
network or we're not expecting them to be.
As a result, we're going to see that we want to protect our topology using BPDU WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
As a result, we're going to see that we want to protect our topology using BPDU
guard against
unexpected switches.
We also want to protect the network against switch five claiming to be the root
.
If all of a sudden this is configured with priority zero, we want to make sure
that the
root is protected given that the root is configured with that 4,000 value it
would lose out as
the root to switch five if it claims to be priority zero.
We want to make sure that we're using root guard in order to protect that and WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We want to make sure that we're using root guard in order to protect that and
then we'll
also see BPDU filter by the end of this.
Let's go ahead and flip over to the lab.
We're going to start by going to switch three.
We're going to want to protect switch three from switch one showing up.
If we look at the topology real quick again, we see that switch three has this
dotted line
connection.
That's because it's actually shut down on switch three's side.
Switch one has this online.
It's sending BPDUs right now.
It's trying to connect.
As soon as we remove the block from switch three, so now this is online, then WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
As soon as we remove the block from switch three, so now this is online, then
we're going
to be receiving these BPDUs.
Let's go ahead and do that.
By the way, that's port gig zero slash two.
I'm going to get onto this interface, interface gig zero slash two.
I want to configure this for spanning tree BPDU guard and the command for that
is BPDU
guard all one word enable.
Spanning tree BPDU guard enable.
Now, I'm going to do a no shut, bring that port online and we're expecting an WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Now, I'm going to do a no shut, bring that port online and we're expecting an
error message
to let us know that BPDU guard is indeed blocking the port and we see that
right here.
BPDU guard is enabled.
We're disabling the port.
In fact, we see it be placed into air disable with this log message.
I can then do a show interface on gig zero slash two and we see that it is in a
downstate
thanks to it being air disabled.
So that is BPDU guard as soon as we got a BPDU from switch one, we place the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So that is BPDU guard as soon as we got a BPDU from switch one, we place the
port into
air disable.
Now we can also deploy BPDU guard by default.
Let's go ahead and go over to switch four and we'll do the same thing looking
at our topology
here.
We see that the same configuration applies on this side, but this time let's
place this
into access mode of operation and we're going to deploy port fast and BPDU
guard to all of
our access mode ports and make sure that it works. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
our access mode ports and make sure that it works.
So let's go ahead and switch over to switch four here.
I'm going to do a config T and globally I'm going to enable our spanning tree
port fast.
So I have to do that first.
I'm going to say spanning tree port fast edge default.
Again this edge keyword isn't on all iOS XE platforms, but it is on the virtual
one and
then also spanning tree.
And now here's here's the command.
It's port fast BPDU guard default. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
It's port fast BPDU guard default.
So what we just did was we told the switch, hey, just globally any of our
access mode
ports, we are going to want to put port fast on those edge ports by default.
And hey, by the way, anything that's port fast, we also want to have BPDU guard
by default.
So we can tie all of these together.
So if I do a show run on interface gig zero slash two, we're going to find that
it's switch
mode access, but it doesn't actually have any, it doesn't have any BPDU guard WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
mode access, but it doesn't actually have any, it doesn't have any BPDU guard
configured.
Yet when I get on to gig zero two, and we know we're receiving BPDUs from
switch two
downstream, what do I do?
I do a no shut.
I should expect that this port will be shut down thanks to BPDU guard and
indeed there
it goes.
So it plays gig zero two into the air disable state.
Again, I don't have BPDU guard enabled here on explicitly on the interface and
yet it's
enabled globally thanks to the fact that we have deployed port fast by default. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
enabled globally thanks to the fact that we have deployed port fast by default.
And now we've deployed BPDU guard to all port fast ports.
So that is BPDU guard.
Again, it belongs on the edge of our networks and we can do it explicitly on a
per interface
basis or we can do it globally, which will apply to our switch mode accesses
and especially
is tied to the port fast configuration.
So next is route guard.
We look back at our topology.
Now once again, now we have a concern with a superior BPDU showing up on the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Now once again, now we have a concern with a superior BPDU showing up on the
sport.
I can't use BPDU guard because I'm expecting to occasionally receive inferior B
PDUs this
way, but I should never receive a superior BPDU if I do.
I want to cut this off as such.
I'm going to put route guard on both of these interfaces gig two slash one on
switch three
and gig three slash one on switch four.
But let's just go ahead and make sure that we know what we're expecting here.
So if I'm on switch five, I do my show spanning tree. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So if I'm on switch five, I do my show spanning tree.
I can see that my current priority is configured as that 32 K value.
So I do a config T and if I say spanning tree priority, actually let's we got
to specify
the VLAN here.
So one through 40 94 will just do for all VLANs and I say priority of zero.
So what happens to our current route switch three?
Well, if I do show spanning tree and just hit enter, we're going to find that WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Well, if I do show spanning tree and just hit enter, we're going to find that
see here.
Yeah, our route, we just configured as a priority of zero.
We just found that there's a better switch out there, essentially switch five
and it's
out my gig to slash one.
My priority still configured for four K, but its priority is zero plus the VLAN
ID.
So VLAN one is a priority of one.
So let's no good switch three believed that switch five was doing that.
So let's go ahead and configure that for 32 768 once again and get everything
back to
normal. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
normal.
So if I do a show spanning tree root switch, so you should be the root for all
the VLANs
that we're still waiting for max age timer, essentially the time out that
superior BPDU
and so we'll have to wait just a little bit to get back to our original top
ology.
But that's fine.
In the meantime, we can configure root guard.
Again, must be configured intentionally on specific interfaces.
I'm going to get onto my gig to slash one here for switch three and say
spanning tree
guard root.
And that's it. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And that's it.
That's the whole command.
And so I'm going to go ahead and do this on switch four as well and say
interface gig
three slash one and spanning tree guard root.
So go back to switch three here.
Root guard's enabled.
If I do a show interface gig two slash one detail, not show interface, let's
add spanning
tree in their show spanning tree interface detail, we do see that root guard is
enabled
on the port. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
on the port.
So this interface detail command as part of the show spanning tree family show
spanning
tree interface detail.
Very, very useful to us.
It tells us a lot of what's going on, whether it's port faster root guard or V
PDU guard.
All of that is in place.
So if I do a show spanning tree root, we should see that I'm the root again and
I am.
And so before I got on to switch five and configured it with that priority zero
command,
I'm just going to do the exact same thing. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
I'm just going to do the exact same thing.
Let's configure switch five to have a priority of zero before that allowed it
to take over
as the root.
But now notice what's already happened on switch three.
We are blocking on that interface.
If I do a show spanning tree and look at interface two slash one, we see that
it's in this broken
status.
And over here we see the inconsistent.
Now this tag right here root inconsistent, that's trying to tell us which
version of
inconsistent it is.
In our case, it is tied to root guard.
In other situations, we might see inconsistent with a different tag here. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
In other situations, we might see inconsistent with a different tag here.
But either way, it's in that broken status.
And it's important for us to recognize when we see that that something might be
going
on.
But the good news is check it out.
I am still considered to be the root.
This is me.
I am the root for VLAN one.
If I do my show spanning tree root command, I am still the root for all the V
LANs.
So my topology was protected.
Switch five did get isolated because if we look at switch four, we're going to
see the
same error message here. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
same error message here.
If you want to call it a, I guess a log message, it's letting us know that it
is blocking that
port.
We look at our topology.
We have successfully protected the network by blocking or placing into that
broken state
these links that go down to switch five.
And so that's exactly what we were hoping to see.
Now lastly, let's chat real quick about and see a quick demo of BPDU filter.
So BPDU filter is supposed to ignore all BPDUs.
We're going to demonstrate that by taking a look back here at this interface WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We're going to demonstrate that by taking a look back here at this interface
where we
applied BPDU guard.
BPDU guard is only going to trigger if a BPDU is seen.
But what happens if I also apply BPDU filter here?
Well, when I apply the filter, it's going to not process these BPDUs that
arrive and
therefore BPDU guard won't actually trigger.
So let's go ahead and see that in action.
So I'm going to go over to switch three.
If I do a show interface gig zero two, this should still be an error disable WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
If I do a show interface gig zero two, this should still be an error disable
and it is.
So I'm going to get on to interface gig zero two and do a shutdown.
And this means that when I do a no shut, it'll be out of error disable and it
'll start
receiving those BPDUs.
In order to filter those, I'm going to use the spanning tree BPDU filter
command and
then say enable.
So spanning tree BPDU filter enable.
We also saw earlier on the other switch how we could enable this globally.
But as we said in the video before, we want to be very, very careful about WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
But as we said in the video before, we want to be very, very careful about
doing that.
So BPDU filter is now on here.
If I do a no shut, we should see that this port comes online.
So there it is in the upstate.
If I do a show spanning tree interface gig zero two detail, we'll see that BPDU
guard
and BPDU filter are both enabled on the same interface.
And BPDU filter is going to take precedence over BPDU guard. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And BPDU filter is going to take precedence over BPDU guard.
It's going to ignore the BPDUs.
But also notice here, this is what's pretty fascinating.
The number of BPDU sent and received are listed as zero.
If I do this command again, many seconds later, we're still at sent and
received zero.
And this will be true for all of the VLANs.
We see that they're all listed as sent and received zero thanks to BPDU filter.
So that is how BPDU filter works.
It completely filters out BPDUs that are sent and received on the interface,
which we very
careful about deploying that. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
careful about deploying that.
But just be aware that it is a tool that exists in case we need it.
So with that, let's go and jump in the lab and do some of these configurations
ourselves.