So, how did you do on the lab challenge?
Hopefully you were able to log into the lab and spend some time really making
sure we
understand the difference between root guard and BPDU guard and their operation
, but understand
that they both work together to lock in a spanning tree topology.
And this is one of those technologies that we learn about that has very
practical application.
This should absolutely be deployed in every production network that we manage,
both BPDU
guard and root guard.
And again, BPD filter, probably not something we're going to use, hopefully, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And again, BPD filter, probably not something we're going to use, hopefully,
but if we
do, again, it should be a last resort.
But let's go ahead and look at this lab challenge and just review the answers
together.
So the first task suggests that we want to enable, let's see, our trunk access
connectivity
only on switch three.
Going to ensure that switches are connected, it'll be error disabled.
So let's go ahead and look at our lab topology.
We're talking about this connection over here.
If we get a BPDU, we want to go into air disable that word air disabled should
immediately make
us think about this being BPDU guard, because that goes into air disable when WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
us think about this being BPDU guard, because that goes into air disable when
we receive
a BPDU.
Now remember, this port is already shut down.
So we're going to configure BPDU guard here.
Do a no shot, make sure that it does indeed work.
It's exactly what we did as a lab demo earlier.
So switch three, config T, interface gig zero two, and then it's that command
spanning
tree BPDU guard enable.
And then I'm just going to do a no shut to make sure that indeed it does go WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And then I'm just going to do a no shut to make sure that indeed it does go
into air
disable when we receive the BPDUs from switch one.
And that's exactly what happened.
Next we're tasked with configuring switch four.
So this is the other side of the topology over here switch four gig zero two,
we're
being told that we want to make sure BPDU guard is added.
But we are only going to use global commands.
And so this is going to require us configuring things at a global level.
So let's go over to switch four, config T and the command to configure things WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So let's go over to switch four, config T and the command to configure things
globally
here is going to involve spanning tree port fast.
And then we're going to configure this as edge default.
And again, as I said before, sometimes this edge keyword doesn't show up,
especially
on real hardware as opposed to the virtual virtual switches.
But either way, we've just configured port fast to go everywhere.
Now we can configure this as well to include BPDU guard by default.
So we got to get the edge in here. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So we got to get the edge in here.
Do question mark.
There's where we see our BPDU guard and filter options.
And then we're going to add the default keyword.
So now that those commands are in place, this will affect all access layer
ports.
So if I do a show run on our interface in question, we see that it's running in
trunk
operation.
So I actually have to get on here and say switch port mode access.
So at this point, this port, even though we look at the configuration doesn't
show BPDU
guard, it should be running BPDU guard. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
guard, it should be running BPDU guard.
So I do a no shut.
And then just wait a few seconds because switch two downstream should be
sending BPDU's
and we see that it did get disabled by our global commands.
So that's exactly what we wanted to do.
Now next, we're looking at the topology and we see that we need switch five to
never become
or claim to be the root.
We want to make sure that switch three stays the root.
And so we're going to accomplish this by configuring, you know, change the
color here. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
color here.
We want to make sure that we configure root guard on the downstream interfaces
on switch
three and switch four, which involves gig two slash one on switch three and gig
three
slash one on switch four.
So let's go ahead and get over to switch three interface gig two slash one here
.
And this command is spanning tree guard root.
And for now, we're just going to leave that I come over to switch four.
Same thing into gig three slash one spanning tree guard root. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Same thing into gig three slash one spanning tree guard root.
All right.
So now we can get on to switch five and do a spanning tree VLAN one to 40 94.
And then we'll say priority zero.
So that should allow switch five to claim to take over as the root switch three
and switch
four should not like that.
Indeed, it looks like they have both blocked it.
And this is where if we do a show spanning tree, we will see that port in that
broken
status, which is the STP inconsistent, uh, motive operation. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
status, which is the STP inconsistent, uh, motive operation.
So that all fixes itself when we put this back to 32 768.
And after the max age timer has expired there, we should see that the port, um,
is allowed
to process traffic again.
So the last task here is simply, uh, testing us on BPU filter.
So BPU guard is clearly working over on switch threes gig zero to interface. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So BPU guard is clearly working over on switch threes gig zero to interface.
So let's go over.
We're on switch three.
How about that?
And there we go.
It's unblocking.
So we did see that in action too.
So perform a shot.
No shot on gig zero to remove the air disabled state confirm.
We're able to connect if indeed we have enabled BPU filter.
So what we're going to do here is just get on to get zero to in fact, if we do
a show
interface on it, we should see it is still an air disabled.
It's right there.
And so now I'm going to do, sorry, BPU filter command. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And so now I'm going to do, sorry, BPU filter command.
So it's just spanning tree BPU filter, enable.
And now I'll do a shot, no shot.
And that should allow us to see again what we demonstrated in lab, which is
that even
though we have BPU guard enabled on this port and it just placed it into air
disable because
now we have BPU filter, it's going to make it so we're not sending any BPU's
and we
never process any BPU's which that we receive, which means that BPU guard never WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
never process any BPU's which that we receive, which means that BPU guard never
places the
port into air disable.
And at this point, I'd say it's safe to say that that's just not going to
happen.
So a little bit of a fast run through there of the solution, but again, we've
got access
to this lab.
So feel free to configure BPU guard and root guard and BPU filter enough time
so that we
understand how it all works and how it all comes together.
I hope this has been informative for you and I'd like to thank you for viewing.