In life, there are things called red flags.
When we see a red flag, we should pay attention,
and say, whoa, what's going on?
Well, if we have access ports or ports on our switches
that go to other networks who are non-switches,
if we get BPDUs that are received on those ports
where they're not expected, that's a huge red flag.
So in addition to using tools like Root Guard,
we can also use a feature called BPDU Guard,
and that's what I'd like to talk with you about in this video.
So here's the idea behind BPDU Guard. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So here's the idea behind BPDU Guard.
If we enable BPDU Guard, and let's imagine
we enabled it right here on this port
that leads to computer two, which Bob is sitting at.
And for some reason, Bob's computer
or whatever Bob is plugged in, to a switch
or directly to that port, if it starts sending in BPDUs,
here's what BPDU Guard says.
It's going to error disable the port.
So it's pretty strict.
One BPDU, and boom, that port is down,
like, hey, I'm not even messing around.
So it's pretty strict as far as BPDUs guards.
We'd only want to have it on ports where we would never WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We'd only want to have it on ports where we would never
expect to see a BPDU come in, including
from an access port that's connected to our end users.
Now another option that isn't quite as severe is BPDU filter.
And think of BPDU filter as a gentle, that's OK,
no big deal kind of attitude.
With BPDUs filter, if Bob does send in a BPDU,
we're just going to ignore it.
So it's not like we're going to shut down the port.
We're just going to ignore it, pretend it didn't happen.
Also, if we have BPDU filter enabled on that port,
that means we're also not going to be sending out WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that means we're also not going to be sending out
BPDUs every two seconds, out to an access device
that really has no need to see that anyway.
So as a summary BPDU filter simply reduces
the number of BPDU that are sent and also ignores
BPDUs as they come in, while BPDUs Guard has
a really strong attitude.
If it sees a BPDU coming in on a port that's
protected with BPDU Guard, it's going to error
disable the interface.
So here's what I propose we do.
I've reset these three devices.
So this guy is the root.
I have designated port, designated port WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
I have designated port, designated port
there and there.
Root ports here and here, designated port here,
and then we're blocking on switch 20/5.
So it's kind of a mean trick, but let's do this.
Let's take 0/3, and we'll shut it down.
So when we shut that down, spanning tree on switch two
is going to reconverge, and he'll start forwarding out 0/5,
they'll be fantastic.
And then while 0/3 is shut down, we'll
enable BPDU Guard on the interface.
Which says, after you come up, if you see a BPDU, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Which says, after you come up, if you see a BPDU,
go ahead and put the interface in an error disable state.
So then we'll do a no shut, let it come up,
and when it sees the BPDU is coming in from the root switch,
even though they're coming in this example
from the legitimate root switch, because BPDU guard is enabled,
it'll go ahead or should go ahead and shut down port 0/3.
So ideally, we'd want to have this in a production
environment enabled either specifically on the interfaces
or by default on the access ports for any interfaces
where we don't expect-- like clients
and so forth, where we don't expect BPDUs to be coming in. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and so forth, where we don't expect BPDUs to be coming in.
Here on switch two, let's do a show spanning tree for VLAN 1,
and currently our root port is FA0/3,
we'll go to interface FA0/3, and we'll shut that bad boy down,
and do show spanning tree for VLAN 1,
and it is already converged.
Thanks to rapid spanning tree, fantastic.
So FA0/3 is forwarding.
Now an interface config for FA0/3,
let's go ahead and enable BPDU Guard.
And the syntax is spanning tree BPDU Guard enable. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And the syntax is spanning tree BPDU Guard enable.
And boom, it's enabled.
So we do a show spanning tree for interface FA0/3,
and it's not running because the port's down.
All right, we'll bring it up.
So we'll do a interface FA0/3, no shut down.
All right, now we do a show spanning tree for VLAN 1.
What's wrong?
Did I not bring that port up?
Let's do a show interface status.
Oh, there we go.
It was error disabled.
So it just got bam, got a BPDU and was WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So it just got bam, got a BPDU and was
error disabled, so it does show interface status.
Error disabled.
There it shows up.
So FA0/3 is error disabled, due to be BPDU Guard.
So if we went in and did a shut and a no shut,
we'd have the same problem because we'd get BPDUs again,
and then it would shut down the port again.
So let's do a show run for interface fast ethernet 0/3,
and let's go take it off.
WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And then we'll do a shut and no shut and show spanning tree.
There we go.
So now we have Fast Ethernet 0/3, which
is our root port once again, and then
FA0/5, which is going over to switch three
is in blocking state, or if we want
to be official for rapid spanning tree,
we could say it's discarded.
So thanks for joining me in this video
as we've taken a look at how we can use BPDU Guard to put
a port in error disabled state the moment
it sees a BPDU coming into it.
I appreciate you joining me.
I'll see you in the next video.
Meanwhile, I hope this has been informative for you, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Meanwhile, I hope this has been informative for you,
and I'd like to thank you for viewing.