Well, an important part of understanding a technology is knowing how to
configure it.
And so that's exactly what this lab exercise is designed to do.
If you haven't yet done so, please feel free to hit the pause button, go back
and do the
lab above.
And if you already did it and you just want to check your answers, then check
out the
solution script below.
If you've got everything right, you feel confident about it, then by all means,
confirm
that you have the right solution and then move on.
If any of these tripped you up or you want to know the explanation behind it, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
If any of these tripped you up or you want to know the explanation behind it,
then feel
free to watch this video as we'll go through all of the solutions together.
So first up, we simply need to enable rapid pervieland spanning tree in the
environment.
So I'm going to be doing this on switches three, four and five.
I'm going to do a config T and that is simply typing in spanning tree mode and
then rapid
pvst.
And so I'm going to go ahead and do that on switches four and five as well.
Spanning tree mode rapid, we can abbreviate it if we want to be a little faster WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Spanning tree mode rapid, we can abbreviate it if we want to be a little faster
and spanning
tree mode rapid.
And the way I can confirm that it's working is if I do a show spanning tree.
And then I see that it says protocol RSTP as opposed to protocol IEEE, which
would indicate
that we are running the legacy 802.1d.
Now we're also going to find that we have an instance per VLAN because we're
running
rapid pvst and not MST.
And it's perfectly fine. That's what this lab is expecting us to do.
Now next we want to configure switch three as the route for the odd VLANs and
switch for WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
switch for
the route for the events.
This is going to take a little bit of configuration on each side.
It's not too bad, but I'm going to do one of two things here.
So switch three odd VLANs, one, three, five, seven and nine.
Since we're dealing with VLANs one through ten, it's just those five VLANs.
And then I can either configure this with root primary or I could do something
along the
lines of priority 40, 96, something along those lines.
So I can do that for the backup or I can configure it as a backup for the even WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So I can do that for the backup or I can configure it as a backup for the even
VLANs
as well by configuring it with something that's between 4K and the default 32K.
And so that's exactly what I'll do for switch three.
And then on switch four, I'm going to do the opposite.
I'm going to say spanning tree VLANs one, three, five, seven, nine, priority 81
, 92.
So a worse priority, but again, this is going to be the backup for the odds.
It's going to be the primary for the events two, four, six, eight and ten,
priority 40, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
priority 40,
96.
So now I should do a show spanning tree root just to confirm that everything is
working.
I should see every other one of these has a root port, meaning that it's not
the root
because I have a path to the root, but then if I don't have a root port, that
means that
I am the root because I don't need a path to the root.
So we see it alternating here.
If I go back to switch three, show spanning tree root, I should see the same
thing and
indeed I do.
So everything is looking pretty good so far.
So next up, we need to configure port fast. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So next up, we need to configure port fast.
So the goal here is to make it so that a couple of access ports on switch five
are going
to not send TCN.
So if I do a show IP and brief, we're going to see a lot of ports in an
administratively
town status, but we do see gig two slash two here and two slash three should
actually be
online as well.
But either way, it's in a show run interface gig two slash two. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
But either way, it's in a show run interface gig two slash two.
There we go.
Switch mode access.
So we want to make sure that this is running in port fast operation.
If I do a show spanning tree interface and then add detail to the end, this is
as we've
seen several times, a really great way to see how a port is configured from an
STP perspective.
I don't see anything down here other than that.
It's in point to point, which is good for rapid spanning tree.
It means we can negotiate with a device out there, but nothing here about it
being an
edge port.
Now I'm explicitly told that we want to make sure that not only these ports, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Now I'm explicitly told that we want to make sure that not only these ports,
but also
all future ports become immune to sending TCNs, at least from an edge
perspective.
And so I can accomplish this by configuring it globally.
So I can do the spanning tree port fast.
And again, some platforms require this edge command.
Some do not.
So be aware of that, especially the virtual switches do.
And then I can simply say default here.
And this is going to apply edge configuration by default to all access WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And this is going to apply edge configuration by default to all access
interfaces.
So again, I do that show spanning tree interface.
I pick gig two slash two detail.
And we see that now it says that it's not only in port fast edge mode, it also
says that
it's by default because I configured it globally.
So that's exactly what we were looking for that will apply not only to the
existing access
ports, but also to all future ports as well.
So now we need to configure, well, all the protection mechanisms. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So now we need to configure, well, all the protection mechanisms.
This is where it gets a little bit fun.
So we're told that we need to protect our roots from any other device claiming
to be
the root.
And we can also test this, but we're going to get on to switch three and switch
four
and identify the downstream facing ports.
And in our case, that's going to be gig two slash one on switch three here.
So config T interface gig two slash one.
And then I'm going to enter spanning tree guard root.
And that will enable root guard on the downstream port. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And that will enable root guard on the downstream port.
On switch four, that's going to be interface gig three slash one.
And again, spanning tree guard root.
So now these switches will protect themselves against superior BPD use.
Notice like we talked about in the quiz, we do not want to enable this between
switches
three and four.
And so let's go ahead and test this.
I'm going to get on to switch five and say, let's just pick a VLAN here
spanning tree V
land five and then priority of zero. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
land five and then priority of zero.
So it's claiming to be the root for VLAN five.
I come take a look at this.
And we're all wrong.
I was waiting for a new log message.
It's already there.
Root guard is already blocking that port for VLAN five.
So what's interesting about this is it does operate independent of, well, it
operates
on a per VLAN basis, I should say.
So if I do a show spanning tree, for example, I'm VLAN one, everything looks
fine on VLAN
two, everything is going to look fine.
But if I go past three and four and I look at VLAN five, this is where we're WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
But if I go past three and four and I look at VLAN five, this is where we're
going to
see that broken status because it's in the STP inconsistent and specifically
the root
inconsistent state.
So we're protecting ourselves.
We are still the root.
This bridge remains the root for VLAN five.
That's exactly what we want to see.
And we've proven that our root guard configuration works.
Let's just go ahead and reset this back to the default of 3,278.
And everything will come back up.
That's one nice thing about this inconsistent state is once the status is WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
That's one nice thing about this inconsistent state is once the status is
restored, there
we go.
We are unblocking that port.
Everything is going to be happy.
VLAN five.
And we see we're already back up and online.
As since we're rapid spanning true, we didn't have to wait for listening and
learning, which
is really nice.
So that's root guard.
Next up is BPDU guard.
We're told that back to switch five, our access layer switch, we want to make
sure that all
of our access ports block any incoming BPDUs because that's where BPDUs should
never
arrive.
But once again, I have to enable this for all future access ports as well. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
But once again, I have to enable this for all future access ports as well.
So there's another command that we can run globally that will allow for this,
but it
does require us, keep in mind, to map this to BPDU or to portfast ports.
So it's interesting.
Portfast globally maps to access ports.
BPDU guard maps to portfast.
So we already configured portfast to map to all the access ports.
Now we have to configure BPDU guard to map to the portfast ports. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Now we have to configure BPDU guard to map to the portfast ports.
So I'm going to use this global command, spanning tree portfast, again, edge is
sometimes required
here.
And then we're going to, that's the wrong command.
We're going to question mark, we see BPDU guard is there.
So now I can say BPDU guard.
And then we should just be able to say default.
Yes.
So once again, if I want to confirm this, I can do a show interface, no, so
spanning
tree interface, and then take a look at that gig two slash two detailed. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
tree interface, and then take a look at that gig two slash two detailed.
And we should see that BPDU guard is also enabled by default now.
So I want to make sure both of these are listed here.
If only one is listed or neither is listed, then that means there's a problem
with one
of our configurations.
Either this port's not in an access port or something else broken our process.
But this command is really wonderful for confirming that all of the
configurations that we put
into place are actually being used.
So next up, we want to configure switch five to block any port that stops WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So next up, we want to configure switch five to block any port that stops
receiving BPDUs.
So at that point, we're talking about spanning tree loop guard because the
focus is on not
receiving BPDUs, we are going to configure this within the spanning tree world
rather
than rely on UDLD specifically.
Now, once again, we can configure things globally or on a per port basis.
And so instead of doing this on a per interface basis, I'm just going to
configure this globally.
And so the global command for this is simply spanning tree loop guard default, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And so the global command for this is simply spanning tree loop guard default,
which is
interesting because I get if I get on an interface, it uses guard loop.
So keep that in mind.
I get onto interface gig two slash two and say spanning tree loop guard doesn't
show
up here, instead I have to do guard question mark.
And then I see loop.
So the syntax is a little bit different.
If we're on an interface, just keep that in mind.
We have to configure it on an interface specifically that the command might not
be quite what we're
expecting.
But now again, I can do a show spanning tree interface gig. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
But now again, I can do a show spanning tree interface gig.
Well, just take a look at gig two slash two again detail.
And we'll see that loop guard is now enabled by default.
So again, I love this command, we use it all the time.
And importantly, this is going to matter when I look at my upstream interface.
And I did not do the detailed commands.
Let's add that.
And then when we're looking at this from a per VLAN perspective, because now
again, this
is a trunk.
So it's running all 10 VLANs.
When I look at one of these, notice I don't see port type edge. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
When I look at one of these, notice I don't see port type edge.
I don't see BPDU guard.
That's good.
But I do see loop guard is enabled.
And so that's what we'd expect from our configuration up until now.
Lastly, lastly, lastly, we have one more protection mechanism, which is going
to amount to UDLD.
It says configure all switches to shut down fiber ports current and future that
become
unidirectional.
Well, UDLD works such that if I enable it globally, it will only enable fiber
ports,
but it will do it for all fiber ports globally, meaning that in the future, it WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
but it will do it for all fiber ports globally, meaning that in the future, it
'll shut down
fiber ports, or I should say it like this.
It'll activate UDLD on the fiber ports.
Also, keep in mind, the UDLD must be enabled on both sides.
Notice I only enabled loop guard on switch five, because it's from switch five
's perspective.
If I receive a BPDU and receive a BPDU and then it stops, that's from my
perspective,
not from yours.
UDLD requires us to work together.
So we have to enable this on all of our switches.
We're going to do it globally to enable it on all the fiber ports, and then we WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We're going to do it globally to enable it on all the fiber ports, and then we
also need
to make sure that the port will be shut down.
That means aggressive mode.
So if I do UDLD question mark, we're going to see I can do a UDLD enable that
enables
normal mode, normal mode, or I can do aggressive.
And that's exactly what we want, UDLD aggressive.
But in order to make it work, we're going to have to go around to all of the
other switches
and make sure that they're configured for that as well.
So switch five, switch four, switch three, UDLD aggressive. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So switch five, switch four, switch three, UDLD aggressive.
So then we can run show UDLD neighbors command.
And once we see that the communication starts to get established, then we will
find that
the neighbors start to get listed here.
Now it's not coming up.
Let's see here.
Show UDLD neighbors.
See if it's coming up over here.
Oh, cool.
It's not coming up on it.
Oh, because we only enabled it on fiber boards.
And this is a lab environment where it thinks everything is copper. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And this is a lab environment where it thinks everything is copper.
So hey, that's exactly what we want from this output.
Naturally, if we want to see these outputs, we can get on to the individual
interfaces
and configure it.
But that's just a good reminder that, hey, this is only going to work on fiber
ports
if we enable it globally.
So a great lab exercise to go through, make sure we number one know how to
enable rapid
spanning tree.
Also very importantly, know how to enable all of these protection mechanisms.
Because again, these are configurations that belong in production networks.
For running rapid spanning tree, if we're running MST, it doesn't matter. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
For running rapid spanning tree, if we're running MST, it doesn't matter.
We should be deploying these technologies so that we can protect our network,
not only
from a topology perspective, but also from potential loops that could show up
in ways
that spanning tree doesn't protect us.
I hope this has been informative for you.
And I'd like to thank you for viewing.