WEBVTT

1
00:00.000 --> 00:04.560
Well, as we just said in the intro, spanning tree topology seems to have been

2
00:04.560 --> 00:05.200
developed

3
00:05.200 --> 00:08.200
with dynamic topologies in mind.

4
00:08.200 --> 00:12.570
So when we think about maybe back in the day when spanning tree first came out,

5
00:12.570 --> 00:13.000
we might

6
00:13.000 --> 00:16.930
have had a series of switches and the thought was just, hey, I might just keep

7
00:16.930 --> 00:18.000
adding switches

8
00:18.000 --> 00:21.500
and who knows where I'm going to add switches and where there's going to be

9
00:21.500 --> 00:22.120
loops.

10
00:22.120 --> 00:26.050
And if I install a new switch here that has a good priority or a better

11
00:26.050 --> 00:26.920
priority than

12
00:26.920 --> 00:31.240
the current route up here, well, then we'd want this route to take over.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

12
00:26.920 --> 00:31.240
the current route up here, well, then we'd want this route to take over.

13
00:31.240 --> 00:34.520
And so it would take over and all of these ports would go down.

14
00:34.520 --> 00:39.680
And this type of topology is not really what we have in modern networks.

15
00:39.680 --> 00:44.040
Maybe we could call this more of a legacy type of architecture.

16
00:44.040 --> 00:47.840
But in the modern network, we have pretty established architectures.

17
00:47.840 --> 00:51.800
In fact, we've talked about a lot of these in this course.

18
00:51.800 --> 00:56.440
So we are likely going to have a pair of switches that are going to form a

19
00:56.440 --> 00:58.240
distribution layer.

20
00:58.240 --> 01:02.720
And then we're going to connect our access switches up to the distribution.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

20
00:58.240 --> 01:02.720
And then we're going to connect our access switches up to the distribution.

21
01:02.720 --> 01:06.600
And we might have access switches hanging off of access switches here in sort

22
01:06.600 --> 01:07.160
of a looped

23
01:07.160 --> 01:08.320
fashion.

24
01:08.320 --> 01:12.240
But what's probably not going to happen is I'm probably not going to connect an

25
01:12.240 --> 01:12.680
access

26
01:12.680 --> 01:16.760
layer switch that I want to be the root.

27
01:16.760 --> 01:22.800
This is not a good idea. And if I do connect to access layer switch that's

28
01:22.800 --> 01:23.200
going to take

29
01:23.200 --> 01:26.160
over his route, it's probably an accident.

30
01:26.160 --> 01:28.800
This is going to cause us a whole lot of grief.

31
01:28.800 --> 01:30.200
It's going to cause outages.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

31
01:28.800 --> 01:30.200
It's going to cause outages.

32
01:30.200 --> 01:33.720
Yes, rapid spanning tree will help to mitigate this a little bit.

33
01:33.720 --> 01:37.240
But the question is why even allow this?

34
01:37.240 --> 01:42.600
Why would we go to the trouble of making it so that I can accidentally do this?

35
01:42.600 --> 01:47.900
I mean, why not just lock this whole scenario out by establishing that one of

36
01:47.900 --> 01:49.280
these distributions

37
01:49.280 --> 01:52.560
switches on a purview land basis will be the root.

38
01:52.560 --> 01:57.600
And again, it gets locked into place.

39
01:57.600 --> 02:01.640
This is the goal of this conversation is to make it so that I as the network
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

39
01:57.600 --> 02:01.640
This is the goal of this conversation is to make it so that I as the network

40
02:01.640 --> 02:02.360
admin can

41
02:02.360 --> 02:06.280
decide exactly how I want my spanning tree to apology to be.

42
02:06.280 --> 02:12.010
Furthermore, we have to worry about potential threat actors out there, the bad

43
02:12.010 --> 02:12.440
guys.

44
02:12.440 --> 02:18.090
Because I can take software on my laptop and I can configure it to do pretty

45
02:18.090 --> 02:19.320
much whatever

46
02:19.320 --> 02:20.320
I want.

47
02:20.320 --> 02:23.680
So what's the harm or what's stopping me rather?

48
02:23.680 --> 02:24.680
There's a lot of harm.

49
02:24.680 --> 02:29.160
What's stopping me from carrying my laptop in connecting into an access layer

50
02:29.160 --> 02:29.640
port, maybe

51
02:29.640 --> 02:35.660
one that's just in the hallway or in an unoccupied conference room and sending
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

51
02:29.640 --> 02:35.660
one that's just in the hallway or in an unoccupied conference room and sending

52
02:35.660 --> 02:36.400
BPDUs that are

53
02:36.400 --> 02:37.480
superior.

54
02:37.480 --> 02:43.060
I can guarantee that I can make a superior BPDU, I can set a priority of zero

55
02:43.060 --> 02:43.840
and I can set

56
02:43.840 --> 02:45.560
my MAC address to whatever I want.

57
02:45.560 --> 02:50.280
So I could make it zero dot zero dot one or something along those lines.

58
02:50.280 --> 02:53.480
There's no way this wouldn't take over as the root.

59
02:53.480 --> 02:57.970
So even if I as the network admin and very careful with my switch deployments,

60
02:57.970 --> 02:58.520
there's

61
02:58.520 --> 03:03.540
still an opportunity for these threat actors to show up and perform some
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

61
02:58.520 --> 03:03.540
still an opportunity for these threat actors to show up and perform some

62
03:03.540 --> 03:05.040
nefarious deeds.

63
03:05.040 --> 03:09.700
And so they just send some BPDUs out in all of the switches in my network

64
03:09.700 --> 03:10.680
immediately

65
03:10.680 --> 03:15.040
react and they reelect the root.

66
03:15.040 --> 03:19.590
The laptop is now the root of the network and I have to send topology change

67
03:19.590 --> 03:20.680
notifications

68
03:20.680 --> 03:23.120
and there's massive flooding on the network.

69
03:23.120 --> 03:26.720
As we can tell, this is going to be a major vulnerability.

70
03:26.720 --> 03:31.220
And so whether it's an accident here or whether it's nefarious, either way, we
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

70
03:26.720 --> 03:31.220
And so whether it's an accident here or whether it's nefarious, either way, we

71
03:31.220 --> 03:32.080
need to prevent

72
03:32.080 --> 03:39.040
our topology from reacting to, I guess we call them switches or other devices

73
03:39.040 --> 03:41.280
that are accidentally

74
03:41.280 --> 03:44.800
or not trying to take over as the network root.

75
03:44.800 --> 03:49.400
So there are two points of vulnerability in the network that we need to address

76
03:49.400 --> 03:49.640
.

77
03:49.640 --> 03:51.760
First of all is down here.

78
03:51.760 --> 03:57.810
This is our access layer connections and we are saying that there should be no

79
03:57.810 --> 03:58.320
BPDUs

80
03:58.320 --> 04:00.180
coming in at the edge.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

80
03:58.320 --> 04:00.180
coming in at the edge.

81
04:00.180 --> 04:03.720
So that's point number one and this is what we're going to talk about here in

82
04:03.720 --> 04:04.620
this video.

83
04:04.620 --> 04:10.940
But the second point of vulnerability would be here, a port where BPDUs are

84
04:10.940 --> 04:12.120
expected,

85
04:12.120 --> 04:14.040
but they should always be inferior.

86
04:14.040 --> 04:17.720
And so that will be our root guard conversation in the next video.

87
04:17.720 --> 04:22.590
So let's go and talk about case number one here and that is going to be

88
04:22.590 --> 04:23.760
resolved with

89
04:23.760 --> 04:27.320
the mechanism that Cisco gives us called BPDU guard.

90
04:27.320 --> 04:30.080
Now what I just said there is very important.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

90
04:27.320 --> 04:30.080
Now what I just said there is very important.

91
04:30.080 --> 04:32.980
This is a Cisco mechanism.

92
04:32.980 --> 04:37.020
This is not part of the STP standard.

93
04:37.020 --> 04:40.850
And so when we're looking at what spanning tree is and how it's designed, it

94
04:40.850 --> 04:41.220
doesn't

95
04:41.220 --> 04:43.020
help us out with any of this.

96
04:43.020 --> 04:45.340
Fortunately, Cisco does give us these mechanisms.

97
04:45.340 --> 04:49.570
And so when we're building a network on Cisco switches, I can deploy something

98
04:49.570 --> 04:50.300
like BPDU

99
04:50.300 --> 04:51.300
guard.

100
04:51.300 --> 04:59.460
BPDU guard is intended to go where BPDUs are expected.

101
04:59.460 --> 05:04.440
It's okay or it's easy for us to identify where in the network this would be,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

101
04:59.460 --> 05:04.440
It's okay or it's easy for us to identify where in the network this would be,

102
05:04.440 --> 05:05.100
especially

103
05:05.100 --> 05:07.300
when we have a modern architecture.

104
05:07.300 --> 05:10.900
Because I can look at it and say at the edge is typically where I'm talking

105
05:10.900 --> 05:11.680
about, which

106
05:11.680 --> 05:17.820
is those access layer ports, we should never get a BPDU.

107
05:17.820 --> 05:21.240
So again, we look at our threat actor down here.

108
05:21.240 --> 05:25.500
They're using a laptop to send BPDUs at the edge.

109
05:25.500 --> 05:27.300
Why even allow BPDUs?

110
05:27.300 --> 05:32.530
That scenario is there going to be where I as a network admin want BPDUs to
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

110
05:27.300 --> 05:32.530
That scenario is there going to be where I as a network admin want BPDUs to

111
05:32.530 --> 05:33.380
show up on

112
05:33.380 --> 05:34.860
an edge port.

113
05:34.860 --> 05:38.810
Now again, spanning tree back in the day here, we didn't know which ports a

114
05:38.810 --> 05:39.420
switch would

115
05:39.420 --> 05:40.420
show up on.

116
05:40.420 --> 05:43.990
It could be this port here with a switch, it could be this port here with

117
05:43.990 --> 05:45.140
another switch,

118
05:45.140 --> 05:46.940
and that's why it's so dynamic.

119
05:46.940 --> 05:51.890
But in the modern architecture, we never want BPDUs to show up and be processed

120
05:51.890 --> 05:52.260
into

121
05:52.260 --> 05:56.940
influence the topology if they're showing up at the very edge.

122
05:56.940 --> 06:03.560
So what we can do is we can get onto our switch and when we have an access port
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

122
05:56.940 --> 06:03.560
So what we can do is we can get onto our switch and when we have an access port

123
06:03.560 --> 06:04.020
, meaning that

124
06:04.020 --> 06:11.940
this is intended for laptop and printer connectivity, I can place BPDU guard as

125
06:11.940 --> 06:13.060
a configuration

126
06:13.060 --> 06:14.940
onto this port.

127
06:14.940 --> 06:18.540
BPDU guard does exactly what it sounds like it's going to do.

128
06:18.540 --> 06:21.580
It's going to guard against BPDUs.

129
06:21.580 --> 06:27.040
So normal operation, everything is fine, but if a BPDU were to arrive, it's

130
06:27.040 --> 06:27.780
going to place

131
06:27.780 --> 06:31.580
the port into what's known as air disable.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

131
06:27.780 --> 06:31.580
the port into what's known as air disable.

132
06:31.580 --> 06:35.420
Now air disable is a little bit of a topic in and of itself.

133
06:35.420 --> 06:43.260
It's effectively in a shutdown state, meaning that it's not going to process

134
06:43.260 --> 06:44.780
any traffic.

135
06:44.780 --> 06:47.700
It's going to block all traffic, not just BPDUs.

136
06:47.700 --> 06:55.700
So if the threat actor here sends a BPDU to an interface with BPDU guard, this

137
06:55.700 --> 06:56.700
port effectively

138
06:56.700 --> 07:01.150
gets shut down and that means that the threat actor has no access to the
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

138
06:56.700 --> 07:01.150
gets shut down and that means that the threat actor has no access to the

139
07:01.150 --> 07:01.980
network.

140
07:01.980 --> 07:06.570
Or for that matter, if I accidentally plug a switch in and it sends a BPDU, the

141
07:06.570 --> 07:07.020
exact

142
07:07.020 --> 07:10.580
same thing is going to happen and that port will be shut down.

143
07:10.580 --> 07:14.660
Now like I said, air disable can be a topic in and of itself.

144
07:14.660 --> 07:19.530
The long story short of air disable is that it will require manual intervention

145
07:19.530 --> 07:19.820
.

146
07:19.820 --> 07:24.090
I'm going to have to go to that switch port and say, "Okay, I see why it was

147
07:24.090 --> 07:24.940
shut down.

148
07:24.940 --> 07:26.860
I'm going to remove air disable."

149
07:26.860 --> 07:31.300
And I simply do that by shutting the port and then bringing it up using no shut
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

149
07:26.860 --> 07:31.300
And I simply do that by shutting the port and then bringing it up using no shut

150
07:31.300 --> 07:31.340
.

151
07:31.340 --> 07:33.140
So I do a shut, no shut.

152
07:33.140 --> 07:35.660
Air disable is cleared, port comes back online.

153
07:35.660 --> 07:38.340
If the issue's still there, it'll go right back into air disable.

154
07:38.340 --> 07:43.100
If a BPDU shows back up, just going to go back into that state.

155
07:43.100 --> 07:46.300
So long as no BPDU's are showing up, then I can clear it out.

156
07:46.300 --> 07:51.270
I can also perform air disable recovery as a global configuration and that'll

157
07:51.270 --> 07:51.740
allow it

158
07:51.740 --> 07:56.940
to attempt to automatically restore connectivity on air disabled ports.

159
07:56.940 --> 08:00.780
But either way, we understand it's going to get shut down and it's either going
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

159
07:56.940 --> 08:00.780
But either way, we understand it's going to get shut down and it's either going

160
08:00.780 --> 08:01.180
to require

161
08:01.180 --> 08:06.940
manual intervention or maybe I can configure it to just automatically try to

162
08:06.940 --> 08:08.060
recover every

163
08:08.060 --> 08:12.940
30 seconds or 60 seconds or something along those lines.

164
08:12.940 --> 08:18.860
Now when we consider the configuration for BPDU guard, it can be enabled on a

165
08:18.860 --> 08:19.940
per interface

166
08:19.940 --> 08:21.100
basis.

167
08:21.100 --> 08:25.800
So I can get on to every interface and I can enable BPDU guard, but this is an

168
08:25.800 --> 08:27.180
access layer

169
08:27.180 --> 08:28.180
technology.

170
08:28.180 --> 08:32.560
It's going to require being placed on all edge ports and that could be hundreds
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

170
08:28.180 --> 08:32.560
It's going to require being placed on all edge ports and that could be hundreds

171
08:32.560 --> 08:32.980
if not

172
08:32.980 --> 08:35.220
thousands of ports in my network.

173
08:35.220 --> 08:38.060
So fortunately Cisco gives us another option.

174
08:38.060 --> 08:45.570
So we can actually tie BPDU guard to the port fast configuration that we talked

175
08:45.570 --> 08:48.420
about earlier,

176
08:48.420 --> 08:55.610
which can then be tied to access ports and all of this from a global

177
08:55.610 --> 08:57.660
perspective.

178
08:57.660 --> 09:03.300
So remember, I can globally tell a Cisco switch that I want to deploy port fast
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

178
08:57.660 --> 09:03.300
So remember, I can globally tell a Cisco switch that I want to deploy port fast

179
09:03.300 --> 09:03.580
to

180
09:03.580 --> 09:05.220
all access ports.

181
09:05.220 --> 09:08.340
Well, I can also tie BPDU guard to this.

182
09:08.340 --> 09:13.160
This means that any port that's in access mode will automatically not only

183
09:13.160 --> 09:14.100
receive port

184
09:14.100 --> 09:16.860
fast, but also BPDU guard.

185
09:16.860 --> 09:19.180
This is typically desired in production networks.

186
09:19.180 --> 09:26.060
I want this configuration to go on every edge port.

187
09:26.060 --> 09:27.260
That is where it belongs.

188
09:27.260 --> 09:31.860
That is where it should go in the vast majority of production networks.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

188
09:27.260 --> 09:31.860
That is where it should go in the vast majority of production networks.

189
09:31.860 --> 09:33.500
If not all production networks.

190
09:33.500 --> 09:39.590
We want BPDU guard to protect us from BPDUs showing up on interfaces where BPD

191
09:39.590 --> 09:40.340
Us do not

192
09:40.340 --> 09:40.780
belong.