Hello and welcome to this video on root guard.
Is it possible that somebody could
bring in in a device from the outside world
into our networks, plug it in, nothing
could be running Spanning Tree, and could change our topology?
The answer is yes!
It could happen accidentally.
It could also happen by a malicious person
who is trying to eavesdrop on our network traffic.
In this video, I'd like to share with you a feature called
root guard, which can help protect and stabilize
our Spanning Tree topology the way we intended it to work. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
our Spanning Tree topology the way we intended it to work.
So let's use this topology that we used in the previous video
on our storm control.
And let's leverage it once again for root guard.
And let's make-- if switch 1 is not the root,
we'll make him the root.
And so the root's going to have designated ports
on all of its ports for that given VLAN.
Let's focus on VLAN 1.
And on switch 2, this would be the root port.
This would be designated right here.
That'd be its root port.
And this guy would be in a blocking state.
So before we get too far in our journey
with setting up and verifying root guard,
let's verify this Spanning Tree topology, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
let's verify this Spanning Tree topology,
that it is what we've just drawn out.
So I've got my command window open to all three.
If we do a show Spanning Tree for VLAN 1,
and scroll down a little bit, this guy is the root.
This is switch 1.
Fantastic.
Switch 2 has a root port that is Fa0/3,
which goes up to switch 1.
Its port 5, which is going over to switch 3,
is in a blocking state.
And then switch 3, we should have forwarding ports.
So we have a root port that's going up to switch 1,
and then the designated port between itself and switch 2. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and then the designated port between itself and switch 2.
Perfect.
I just wanted to confirm where we were starting with.
And here's how root guard operates.
If we need a little root guard on this designated port, which
is forwarding away from the root,
if this switch on that port sees better, which in Spanning Tree
means lower cost or better bridge ID for a given VLAN,
if it sees better BPDUs coming in,
if it's got root guard on it, instead of changing its mind
and saying, oh, OK, that'll be my root part,
it simply puts it into a root inconsistent state
and doesn't change its root part. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and doesn't change its root part.
And that way, if we have a port, like 0/6,
which is going to a user, like Bob,
and Bob is running some malicious software,
or he plugs in a device from home,
or does something else tricky, and this would also, again,
normally be a designated port being able to forward
to Bob's computer, if, for whatever reason,
better BPDUs start showing up on this port, 0/6,
with root guard enabled, the switch
will place that in a root inconsistent state.
And that way, the switch won't change its opinion
about the real root port that goes to the real root bridge.
So we're protecting against a malicious or accidental change WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So we're protecting against a malicious or accidental change
of STP topology, based on a user, or a hacker who's
trying to manipulate us.
So let's do this for fun.
Let's go ahead and enable this feature, root guard.
We'll do it on switch 3, 0/5.
And then, this is so mean, but then let's go to switch 2
and tell it that it's now going to be the root for VLAN 1.
So we'll tell it to beat switch 1.
And as a result, it's going to start sending BPDUs
with a better bridge ID.
And on a good day, switch 2 would say,
oh, there's the new root, and it would go this direction.
But because of root guard, it'll maintain the old root port. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
But because of root guard, it'll maintain the old root port.
It'll keep it in place.
And it won't be fooled into thinking the root is
available off gig 0/5.
So let's implement that and test it.
So let me scroll this down out of the way a little bit.
So here on switch 3, we're going to enable the feature on Fa0/5.
So config [INAUDIBLE] interface fa 0/5,
and spanning-tree guard root.
It's done.
And now that that's done, let's go over to switch 2
and tell switch 2 that it is now the root for VLAN 1. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and tell switch 2 that it is now the root for VLAN 1.
So we'll go into configuration mode,
spanning-tree, vlan 1, root, and we'll say primary.
And boom.
And it's done!
So if we do a show spanning-tree now for VLAN 1
right here on switch 2, it says, I'm the root!
I have now the best bridge ID.
So I'm in designated ports, which
means I'm also seeing those BPDUs on Fa0/5,
and those are being heard over on switch 3.
And I just realized that I don't have terminal monitor on.
So you do a terminal monitor.
And let's do a show log. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And let's do a show log.
We should have got a message.
There it is.
So there's our log message.
So here's a message regarding root guard
enabled on that port.
And now we have root guard blocking
on that port for VLAN 1.
And if we went back and we did a show spanning-tree for VLAN 1,
it's also going to show us that root inconsistent state
on that part.
And notice that the root part of Fa0/4,
which leads up to switch 1, has not been modified.
It is still the root port.
And if it shows spanning-tree inconsistent ports,
that's another easy way to help find that very easily. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that's another easy way to help find that very easily.
So using root guard is a great step
into securing our topology, so it's not
changing in weird ways.
Now, there's yet even another option
that we can use to help protect our Spanning Tree,
and that is BPDU guard.
And we'll take a closer look at what that is
and how it works in the next video.
So I'll see you there in just a moment.
Meanwhile, I hope this has been informative for you.
And I'd like to thank you for viewing.