All right, into the lab to see loop guard. So our topology here has switch 3 as
the root.
It's configured with a 4k value and switch 4 is also configured with 8k 8192.
But the point is
that if all of the links have the same spanning tree cost, then we're going to
favor the path
directly to the root. So switch 5 is going to have to decide which link to
block. We would expect
it to block this link over here. That would be gig 3 slash 1, which connects to
gig 3 slash 1 WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
gig 3 slash 1
on switch 4. Let's go ahead and confirm that. So we're on switch 3. Let's go
ahead and get over
to switch 5. Do a show spanning tree blocked ports command. And indeed, we are
blocking gig
3 slash 1. So what we're concerned with here is that switch 4 just stops
sending BP to use.
And we can emulate that by getting onto interface gig 3 slash 1. And then doing
a spanning tree
BP to filter enable command. So we just studied BP to filter. This means we're WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
BP to filter enable command. So we just studied BP to filter. This means we're
going to stop
sending and receiving BP to use. We're essentially emulating switch forwards
spanning tree protocol process, running into problems and stop sending BP to
use. Now over on
switch 5, when we look at things here, we're going to find that it's still
going to be in the blocked
state for a little while. But remember, it's that max age timer that we're
going to have to pay
attention to when I do a show spanning tree for VLAN 1. We'll see that we are
actually, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
actually,
the max age is now expired that 20 seconds. So the BP to use considered expired
. Now we're going
to go through the process of listening and learning and try to bring that port
online. And at that
point, we'll find there are no blocked ports in this entire environment. So if
I do show
spanning tree blocked ports here, it shows zero. Show spanning tree blocked
ports on switch 4,
also zero, and switch 3 is the root. So we would not expect there to be any WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
also zero, and switch 3 is the root. So we would not expect there to be any
blocked ports on the
route. And let's just go to switch 5 one more time, do a show spanning tree,
and we'll see that it is
indeed in forwarding. So we've just formed a loop in our environment. There are
no blocked ports
whatsoever. This would be a very bad day. And you know, when we think about the
story that I told,
that was a really bad day. And so we don't want to find ourselves in that
situation. So what can
we do about this? So let's go back over to switch 4. And we'll get on to that
interface gig 3/1 and
do a no spanning tree BP to filter. And by the way, the switch is running slow. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
do a no spanning tree BP to filter. And by the way, the switch is running slow.
And so be very
careful of this in your own environment in case it causes problems. So here we
go. No spanning tree
BP to filter enable. And so that should make it so that all of our spanning
tree topology comes
back online. So let's go ahead and go back over to switch 5 and do a show WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
back online. So let's go ahead and go back over to switch 5 and do a show
spanning tree. And we
should see that we are in a blocking state. Okay, so everything is back to
normal now. So that's
very good. Again, be very cautious of this in your own lab environment. I would
configure
loop guard first and see it in action. Just to know at this point, we've proven
that there is a
loop that develops. And yes, even virtual equipment can be affected by just a
small amount of broadcast
traffic that loops infinitely. So don't lock yourself out of your lab. Instead,
let's configure WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
let's configure
loop guard. So what we're going to do is we're going to really focus on switch
5 here. We'd want
to in a production environment deploy loop guard everywhere. But in our lab
environment, we're just
going to deploy it here on switch 5. Now I can get on to interface gig three
slash one and say
spanning tree guard. And then we'll see that we can configure loop guard here
with spanning tree
guard loop. Or I could configure it globally, which is usually what we want to
do. And so I'm
going to say spanning tree loop guard. And so when I run spanning tree loop
guard, I can add default WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
guard, I can add default
here. And then we hit enter. So that is the global command for enabling it
everywhere. And then I
can do a show spanning tree interface on gig, let's say three slash one detail.
And this excellent
command is going to tell us that loop guard is enabled specifically by default,
meaning from the
global configurations perspective. So now this port is protected from the
concept of BPD use
disappearing. Now again, in a production network, I'd want to deploy this on
all of the switches. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
all of the switches.
But for this specific scenario, it only matters here, because this is where the
blocked port is.
So I'm going to do the same command on switch form, I'm going to do a config T,
get onto the
interface gig three slash one. And then I'm going to say spanning tree BPDU
filter enable.
So now what's going to happen on switch five is it's going to recognize that B
PDUs haven't been
received for the duration of the max age timer. So we're going to have to wait
for that 20 seconds WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
for that 20 seconds
here, which is already more than halfway done at this point. And we should
start to see error
messages that say, Hey, wait a second, this port and there it comes, this port
stopped receiving
DPDUs. And we're going to block that port because of loop guard. And so that's
exactly what we see
here with this specific error message is it's in loop guard blocking mode. If I
do a show spanning
tree, we're going to find that it's back into that broken status, thanks to
spanning tree
inconsistent. So in this case, it's a loop inconsistent. Remember, before when WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
inconsistent. So in this case, it's a loop inconsistent. Remember, before when
we are running
root guard, this was root inconsistent. So this error message here does help
clue us in as to why
it's in the broken status, or broken state. But in the end, our network is
protected,
everything is perfectly fine. Because if I do a show spanning tree blocked
ports,
we see that the port is still blocked, even though our BPDUs stopped arriving.
[BLANK_AUDIO]