All right, let's go ahead and jump into this review and the way we're going to
do it is how we've done it in the past
We're going to start with some quizzes each quiz question is going to have the
the skill
referenced at the bottom where you can go back and review that skill if you
want to refresh around it again
These quiz questions are intended to help us to recognize where we might have
an area of weakness for example
This is a question about BP do guard if I can't immediately answer this
question
I might want to go back and review BP do guard
So make sure that as we ask these questions that you pause the video and you
confirm that you can answer the question WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
confirm that you can answer the question
Before I give the answer and if you get the question right then great
If not just mark it down and make sure you go back and review that again
It's all about identifying our areas of weakness. So first question here
What happens when a port enabled for BP do guard receives a BP do?
So be be be you guard is one of our topology protection mechanisms
Remember the convert or the concept of a topology
Protection mechanism is getting away from spanning trees super dynamic WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Protection mechanism is getting away from spanning trees super dynamic
Methodology for example if we have our root bridge up here, maybe for one
specific VLAN
Then we are in a place where if I connect a switch down here that wants to be
the root
Maybe our root has a priority of 4k
But this switch has a priority of zero for whatever reason that it can
dynamically go and take over as the
Root from the current root bridge
This is not an ideal situation in our modern networks WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
This is not an ideal situation in our modern networks
We have established topologies and we want to make sure that only maybe this
switch and this switch could be the root
I would never want this switch or anything downstream to be able to claim it
since natively spanning tree can't do that for me
We're going to have to deploy one of Cisco's topology protection mechanisms
We have a couple of different protection mechanisms to talk about we have BPD
you guard and root guard and as you might imagine
We're going to have a question on that coming up. So BPD you guard is not going
to necessarily look for superior BPD WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
to necessarily look for superior BPD
You just gonna look for any BPD you
Where do we not want any BPD you really any?
Connection down here at on out an access port. We're not expecting switches to
connect in on access ports
So if a switch shows up and sends a BPD you we would want to shut this link
down
So therefore we would apply BPD you guard to this and we can apply it manually
to ports or we can apply it to all
Access ports via global commands, but either way we are going to use this as a
protection mechanism against any BPD you and WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
protection mechanism against any BPD you and
the response to any BPD you being received is to place our port into that air-
disabled state
Air disable effectively shuts the port down either requiring manual
intervention for me to go on and do a shut
No shot on the port or I could configure air-disabled
Recovery in order to attempt to recover automatically within a given time
interval
Maybe every 30 or 60 seconds, but either way air-disabled is an important part WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Maybe every 30 or 60 seconds, but either way air-disabled is an important part
of the protection mechanism
It does effectively shut the port down and so be here is going to be our answer
if any
BPD was received inferior or superior on an interface with BPD you guard it
will be placed into air-disabled
All right question number two and it just so happens to be about root guard
What happens when a BPD was received on a port enabled for root guard?
Well, this does have to do with that situation where we just described we've WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Well, this does have to do with that situation where we just described we've
got our topology
We have our route and now a switch is claiming to be the route
so maybe our route has a 4k here and I either misconfigured this switch to have
a zero or maybe I grab a switch off the shelf
unwittingly connecting it to the network and not realizing that it is
configured for priority of zero
So at this point this is going to generate a superior BPD you and
This is what we're trying to avoid on root guard enabled ports
So I would place root guard here and here and I could look at putting it on all WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So I would place root guard here and here and I could look at putting it on all
downstream interfaces
But generally speaking we're trying to protect our roots and so I would place
root guard here
To protect these roots and it will cut off that switch from
Being able to be part of the network when it is also propagating a superior BPD
upstream
Whether it's one that connected in or whether it itself was misconfigured
So at this point what we're going to find is that we're going to use this WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So at this point what we're going to find is that we're going to use this
special spanning tree state
we call it STP inconsistent and
It will tell us exactly why it's in an inconsistent status in this case
It's because of root guard
But we're also going to see this show up in Cisco show commands as being a
broken port or BKN
And so we're not going to place the port into a broken status regardless
It's only going to be if it's a superior BPD you if an inferior BPD you shows
up
Which is what we'd expect when we first turn a switch on it's going to send an WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Which is what we'd expect when we first turn a switch on it's going to send an
inferior BPD upstream
That would be if this is configured for the default of 32k
Let's say sends an inferior BPD upstream as soon as the superior BPD who comes
down
I stopped sending my inferior BPD use but I wouldn't want to stop that process
from happening
Therefore, I'm only going to react if the BPD is superior
All right question number three and by the way there are six questions
How is a UDLD unidirectional link detection applied if enabled globally? WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Well, the answer here is if we enable it globally, it's only going to apply to
fiber ports
And that's because UDLD is primarily beneficial on fiber ports
Remember we're trying to prevent unidirectional
Links from forming and so if I have a switch here and I've got a fiber
connection between these switches
We know that that fiber connection actually consists of two strands. I send
out one strand I receive on the other from the perspective of the switch on the
left and
The problem can occur here if this port is in a spanning tree blocking state WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
The problem can occur here if this port is in a spanning tree blocking state
So if this is blocking and then all of a sudden this strand on top breaks
Well, I no longer get the BPD use that we're coming in and therefore because I
'm no longer getting BPD use
I would transition out of blocking and start transmitting upstream
This can also cause a lot of problems with other protocols not just spanning
tree
And that's why UDLD exists because it's really just designed to help us detect
this issue again primarily on fiber ports WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
this issue again primarily on fiber ports
And it will allow the switches to detect that there's an issue
Regardless of what protocols were worried about spanning tree or a routing
protocol or anything along those lines
So when we come back to this conversation, we are focusing on fiber ports
But UDLD can apply to copper ports. We just have to explicitly configure it on
that interface
But you're playing it globally will only apply it to fiber ports. The good news
is it'll apply it to fiber ports today
And if we add WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And if we add
Fiber ports in the future it will get automatically added to those ports as
they come online if we do enable it globally
All right question number four how is UDLD aggressive mode different from UDLD
normal mode choose to?
So UDLD aggressive mode as the name implies is going to be a little bit more
aggressive in terms of detecting issues and
Responding to issues the first big difference is it's going to attempt to
reform lost connections WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
reform lost connections
Let's keep in mind how UDLD works. I've got my two strands here
And if I enable UDLD on this side first, it's expecting to send
UDLD messages and have those loop back around. This is how we detect if there's
an issue on either one of the strands
I can't just send and hope that the other side is receiving it
I need acknowledgment and so the echo as we talked about is how we accomplish
that then I can figure it on this side
And I get an echo in the other direction. So both of these are echoing back and WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And I get an echo in the other direction. So both of these are echoing back and
forth
Questions what happens if I don't get a response?
Well, UDLD normal mode just continues as is it just logs that it's happening
aggressive mode is going to take two major
Different approaches first of all, it's going to attempt to reform the lost
connections
It's going to send eight consecutive messages one per second
Trying to get a response back just in case the switch got busy and wasn't able
to loop that message back around and so this is probably WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
to loop that message back around and so this is probably
Just attempting to find that
Restore that connection rather before the spanning tree for delay time or
expires
Now the other situation or the other thing it's going to do is it's going to
place ports into air disable
Which UDLD normal mode doesn't do so for the most part?
UDLD normal mode is not going to be very useful to us
Especially from a spanning tree protocol perspective if we're going to use UDLD WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Especially from a spanning tree protocol perspective if we're going to use UDLD
We're almost always going to deploy aggressive mode so that we can try to
restore the connection and if that fails
We can place the port into air disable and therefore protect ourselves from
loops
All right next question. It's a question about loop guard in what scenario will
spanning trees loop guard help to prevent a loop
So what exactly is loop guard doing? Well, it's going to be sort of like UDLD
in that it's looking for
Situation where messages can't make it across unidirectionally WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Situation where messages can't make it across unidirectionally
However, unlike UDLD this is going to be running from an STP perspective and
Specifically it's going to look at the BP to use that are coming in
So BP to use coming in as a requirement for loop guard
That's why it's an STP concept whereas UDLD applies to just every link in
general where we apply it and therefore all protocols will be impacted
So there might be a conversation about whether to configure one of these or
both of these WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
both of these
There's no harm in enabling both of them just understand that they from a
spanning tree perspective largely accomplish the same thing
however, UDLD as we've mentioned is mostly going to be focused on
fiberports and
Having loop guard enabled is really a good thing from the perspective of maybe
a spanning tree process failing versus a
Link becoming unidirectional. So with that said, let's go ahead and answer the
question of what scenario is loop guard going to help to prevent a loop
well what we have here is a situation where switch has two upstream interfaces WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
well what we have here is a situation where switch has two upstream interfaces
and it's blocking one and
Always remember that in order to keep a port blocking from a spanning tree
perspective. I must be receiving BPD use
Now these BPD use are going to be better than mine on some level because I know
that this is an upstream
Interface it's closer to the root to go that way in that sense
It's an alternate port for me if this port goes down I can swing over
especially with rapid spanning tree and WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
especially with rapid spanning tree and
So we know that that means it's an upstream port and then I have downstream
ports down here as well
The question is what happens if these BPD use stop coming?
Spanning tree suggests that if the BPD use stop coming but the port is still
online
That it's not an upstream port anymore
It's now a downstream port if it's a downstream port that means I don't need to
be blocking and I can send my own BPD use
And that's a big problem if that port remains online and we actually still have WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And that's a big problem if that port remains online and we actually still have
a loop here
We talked about in the skill a situation where maybe the spanning tree protocol
process fails on the switch
Maybe it's a unidirectional situation. We don't know what the problem is
But we do know that in a modern network BPD use not showing up is not a normal
situation
Back in the day if we had a hub in here, sure that could absolutely happen and
then we could not use loop guard
But in a modern network loop guard is
Absolutely going to help us here because there's no normal situation where this WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Absolutely going to help us here because there's no normal situation where this
happens and so at that point
We are going to place the port into that inconsistent state meaning that it's
broken or blocking and
We essentially just lock in this blocked port the theory is that if that link
Had gone down sure that's one thing
But if it's up still then we would never want to transition from blocking to
affording if we know it's an upstream port WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
affording if we know it's an upstream port
So the answer here is D BPD use stop showing up where they had been arriving
That is where loop guard is going to help us
All right last question and it's meant to be a fun one. I encourage you to
pause the video and follow the instructions
Sketch this out on a separate sheet of paper and then again mark this topology
with indicators for where each of the protection mechanisms belong
All right, let's go through each one individually BPDU guard
We know BPDU guard blocks against all BPDUs WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We know BPDU guard blocks against all BPDUs
So I'm going to place BPDU guard onto my access ports where I don't expect to
ever receive a BPDU
I can't place on any other ports because I'm expecting to receive BPDUs there
Now root guard on the other hand is all about looking for
Superior BPDUs coming in so I'm going to place root guard here on
my downstream ports
For switch one and switch two we also remember we can't enable root guard on a
per VLAN per topology basis WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
per VLAN per topology basis
And so I can't place it on these ports because I am getting superior BPDUs on
one VLAN or another on each side
Now next is UDLD and UDLD is largely a fiber conversation
Once again, we would expect to deploy it globally
But if I were to deploy it here in this topology explicitly, I would have to
enable it on both sides of a link
And so I would place it on all of these connections
between the among the switches really and WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
between the among the switches really and
Loop guard is going to be the same way loop guard is something that's meant to
be looking for
BPDU stopping to come in so I place these here loop guard
It is one sided. I don't need it configured on the other side. There's
certainly no harm in configuring it on the other side
It's just given the root situation. I wouldn't expect to need it there
So I could enable it globally on switch three and switch four or I could enable
it on those uplinks
So that is where we would expect to deploy all of these different topology WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So that is where we would expect to deploy all of these different topology
mechanisms
This is a great example or great exercise because it forces us to make sure we
understand what these topology
Mechanisms are doing or these topology protection mechanisms are doing and
where they belong in a network
So with that, let's go ahead and move on to the next topic
Welcome.