WEBVTT 1 00:00.000 --> 00:04.540 All right, let's jump into the lab and see these topology protection mechanisms 2 00:04.540 --> 00:05.600 in place. 3 00:05.600 --> 00:10.840 Our lab topology is going to reflect somewhat of a modern network design. 4 00:10.840 --> 00:14.000 We have a distribution layer up here with switches three and four. 5 00:14.000 --> 00:17.600 We're going to find that switch three is the root for all of the VLANs. 6 00:17.600 --> 00:20.640 We're not doing anything per VLAN in the lab topology. 7 00:20.640 --> 00:23.440 We also have switch five down here as an access switch. 8 00:23.440 --> 00:26.890 Furthermore, we have switches one and two that shouldn't really be connected to 9 00:26.890 --> 00:27.120 the 10 00:27.120 --> 00:29.320 network or we're not expecting them to be. 11 00:29.320 --> 00:36.160 As a result, we're going to see that we want to protect our topology using BPDU WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 11 00:29.320 --> 00:36.160 As a result, we're going to see that we want to protect our topology using BPDU 12 00:36.160 --> 00:37.480 guard against 13 00:37.480 --> 00:39.360 unexpected switches. 14 00:39.360 --> 00:43.390 We also want to protect the network against switch five claiming to be the root 15 00:43.390 --> 00:43.640 . 16 00:43.640 --> 00:47.430 If all of a sudden this is configured with priority zero, we want to make sure 17 00:47.430 --> 00:47.680 that the 18 00:47.680 --> 00:52.260 root is protected given that the root is configured with that 4,000 value it 19 00:52.260 --> 00:53.960 would lose out as 20 00:53.960 --> 00:57.480 the root to switch five if it claims to be priority zero. 21 00:57.480 --> 01:00.020 We want to make sure that we're using root guard in order to protect that and WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 21 00:57.480 --> 01:00.020 We want to make sure that we're using root guard in order to protect that and 22 01:00.020 --> 01:00.280 then we'll 23 01:00.280 --> 01:03.640 also see BPDU filter by the end of this. 24 01:03.640 --> 01:06.160 Let's go ahead and flip over to the lab. 25 01:06.160 --> 01:09.360 We're going to start by going to switch three. 26 01:09.360 --> 01:12.880 We're going to want to protect switch three from switch one showing up. 27 01:12.880 --> 01:17.180 If we look at the topology real quick again, we see that switch three has this 28 01:17.180 --> 01:17.920 dotted line 29 01:17.920 --> 01:18.920 connection. 30 01:18.920 --> 01:22.600 That's because it's actually shut down on switch three's side. 31 01:22.600 --> 01:24.000 Switch one has this online. 32 01:24.000 --> 01:25.760 It's sending BPDUs right now. 33 01:25.760 --> 01:27.440 It's trying to connect. 34 01:27.440 --> 01:32.730 As soon as we remove the block from switch three, so now this is online, then WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 34 01:27.440 --> 01:32.730 As soon as we remove the block from switch three, so now this is online, then 35 01:32.730 --> 01:33.400 we're going 36 01:33.400 --> 01:37.280 to be receiving these BPDUs. 37 01:37.280 --> 01:38.800 Let's go ahead and do that. 38 01:38.800 --> 01:42.600 By the way, that's port gig zero slash two. 39 01:42.600 --> 01:47.360 I'm going to get onto this interface, interface gig zero slash two. 40 01:47.360 --> 01:53.790 I want to configure this for spanning tree BPDU guard and the command for that 41 01:53.790 --> 01:54.180 is BPDU 42 01:54.180 --> 01:56.200 guard all one word enable. 43 01:56.200 --> 01:59.160 Spanning tree BPDU guard enable. 44 01:59.160 --> 02:04.330 Now, I'm going to do a no shut, bring that port online and we're expecting an WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 44 01:59.160 --> 02:04.330 Now, I'm going to do a no shut, bring that port online and we're expecting an 45 02:04.330 --> 02:05.320 error message 46 02:05.320 --> 02:09.860 to let us know that BPDU guard is indeed blocking the port and we see that 47 02:09.860 --> 02:10.920 right here. 48 02:10.920 --> 02:12.840 BPDU guard is enabled. 49 02:12.840 --> 02:14.680 We're disabling the port. 50 02:14.680 --> 02:18.160 In fact, we see it be placed into air disable with this log message. 51 02:18.160 --> 02:26.140 I can then do a show interface on gig zero slash two and we see that it is in a 52 02:26.140 --> 02:26.980 downstate 53 02:26.980 --> 02:29.480 thanks to it being air disabled. 54 02:29.480 --> 02:33.950 So that is BPDU guard as soon as we got a BPDU from switch one, we place the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 54 02:29.480 --> 02:33.950 So that is BPDU guard as soon as we got a BPDU from switch one, we place the 55 02:33.950 --> 02:35.000 port into 56 02:35.000 --> 02:37.160 air disable. 57 02:37.160 --> 02:39.920 Now we can also deploy BPDU guard by default. 58 02:39.920 --> 02:43.300 Let's go ahead and go over to switch four and we'll do the same thing looking 59 02:43.300 --> 02:44.160 at our topology 60 02:44.160 --> 02:45.160 here. 61 02:45.160 --> 02:49.290 We see that the same configuration applies on this side, but this time let's 62 02:49.290 --> 02:49.840 place this 63 02:49.840 --> 02:56.390 into access mode of operation and we're going to deploy port fast and BPDU 64 02:56.390 --> 02:57.560 guard to all of 65 02:57.560 --> 03:01.600 our access mode ports and make sure that it works. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 65 02:57.560 --> 03:01.600 our access mode ports and make sure that it works. 66 03:01.600 --> 03:04.880 So let's go ahead and switch over to switch four here. 67 03:04.880 --> 03:11.080 I'm going to do a config T and globally I'm going to enable our spanning tree 68 03:11.080 --> 03:11.880 port fast. 69 03:11.880 --> 03:13.280 So I have to do that first. 70 03:13.280 --> 03:16.920 I'm going to say spanning tree port fast edge default. 71 03:16.920 --> 03:21.510 Again this edge keyword isn't on all iOS XE platforms, but it is on the virtual 72 03:21.510 --> 03:22.040 one and 73 03:22.040 --> 03:24.440 then also spanning tree. 74 03:24.440 --> 03:26.400 And now here's here's the command. 75 03:26.400 --> 03:30.360 It's port fast BPDU guard default. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 75 03:26.400 --> 03:30.360 It's port fast BPDU guard default. 76 03:30.360 --> 03:34.980 So what we just did was we told the switch, hey, just globally any of our 77 03:34.980 --> 03:35.880 access mode 78 03:35.880 --> 03:41.560 ports, we are going to want to put port fast on those edge ports by default. 79 03:41.560 --> 03:46.260 And hey, by the way, anything that's port fast, we also want to have BPDU guard 80 03:46.260 --> 03:47.040 by default. 81 03:47.040 --> 03:49.240 So we can tie all of these together. 82 03:49.240 --> 03:54.700 So if I do a show run on interface gig zero slash two, we're going to find that 83 03:54.700 --> 03:55.400 it's switch 84 03:55.400 --> 04:02.300 mode access, but it doesn't actually have any, it doesn't have any BPDU guard WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 84 03:55.400 --> 04:02.300 mode access, but it doesn't actually have any, it doesn't have any BPDU guard 85 04:02.300 --> 04:03.720 configured. 86 04:03.720 --> 04:09.760 Yet when I get on to gig zero two, and we know we're receiving BPDUs from 87 04:09.760 --> 04:10.720 switch two 88 04:10.720 --> 04:12.720 downstream, what do I do? 89 04:12.720 --> 04:13.640 I do a no shut. 90 04:13.640 --> 04:17.320 I should expect that this port will be shut down thanks to BPDU guard and 91 04:17.320 --> 04:18.120 indeed there 92 04:18.120 --> 04:19.120 it goes. 93 04:19.120 --> 04:22.000 So it plays gig zero two into the air disable state. 94 04:22.000 --> 04:27.580 Again, I don't have BPDU guard enabled here on explicitly on the interface and 95 04:27.580 --> 04:28.080 yet it's 96 04:28.080 --> 04:32.760 enabled globally thanks to the fact that we have deployed port fast by default. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 96 04:28.080 --> 04:32.760 enabled globally thanks to the fact that we have deployed port fast by default. 97 04:32.760 --> 04:37.000 And now we've deployed BPDU guard to all port fast ports. 98 04:37.000 --> 04:38.280 So that is BPDU guard. 99 04:38.280 --> 04:42.460 Again, it belongs on the edge of our networks and we can do it explicitly on a 100 04:42.460 --> 04:43.360 per interface 101 04:43.360 --> 04:48.720 basis or we can do it globally, which will apply to our switch mode accesses 102 04:48.720 --> 04:49.920 and especially 103 04:49.920 --> 04:52.480 is tied to the port fast configuration. 104 04:52.480 --> 04:53.680 So next is route guard. 105 04:53.680 --> 04:56.280 We look back at our topology. 106 04:56.280 --> 05:02.560 Now once again, now we have a concern with a superior BPDU showing up on the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 106 04:56.280 --> 05:02.560 Now once again, now we have a concern with a superior BPDU showing up on the 107 05:02.560 --> 05:03.480 sport. 108 05:03.480 --> 05:08.050 I can't use BPDU guard because I'm expecting to occasionally receive inferior B 109 05:08.050 --> 05:08.720 PDUs this 110 05:08.720 --> 05:12.520 way, but I should never receive a superior BPDU if I do. 111 05:12.520 --> 05:14.720 I want to cut this off as such. 112 05:14.720 --> 05:18.700 I'm going to put route guard on both of these interfaces gig two slash one on 113 05:18.700 --> 05:19.720 switch three 114 05:19.720 --> 05:23.440 and gig three slash one on switch four. 115 05:23.440 --> 05:28.080 But let's just go ahead and make sure that we know what we're expecting here. 116 05:28.080 --> 05:31.840 So if I'm on switch five, I do my show spanning tree. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 116 05:28.080 --> 05:31.840 So if I'm on switch five, I do my show spanning tree. 117 05:31.840 --> 05:36.320 I can see that my current priority is configured as that 32 K value. 118 05:36.320 --> 05:42.250 So I do a config T and if I say spanning tree priority, actually let's we got 119 05:42.250 --> 05:43.240 to specify 120 05:43.240 --> 05:44.240 the VLAN here. 121 05:44.240 --> 05:50.280 So one through 40 94 will just do for all VLANs and I say priority of zero. 122 05:50.280 --> 05:53.400 So what happens to our current route switch three? 123 05:53.400 --> 06:00.000 Well, if I do show spanning tree and just hit enter, we're going to find that WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 123 05:53.400 --> 06:00.000 Well, if I do show spanning tree and just hit enter, we're going to find that 124 06:00.000 --> 06:00.960 see here. 125 06:00.960 --> 06:05.360 Yeah, our route, we just configured as a priority of zero. 126 06:05.360 --> 06:10.140 We just found that there's a better switch out there, essentially switch five 127 06:10.140 --> 06:10.720 and it's 128 06:10.720 --> 06:13.360 out my gig to slash one. 129 06:13.360 --> 06:17.040 My priority still configured for four K, but its priority is zero plus the VLAN 130 06:17.040 --> 06:17.400 ID. 131 06:17.400 --> 06:20.400 So VLAN one is a priority of one. 132 06:20.400 --> 06:23.760 So let's no good switch three believed that switch five was doing that. 133 06:23.760 --> 06:28.710 So let's go ahead and configure that for 32 768 once again and get everything 134 06:28.710 --> 06:29.280 back to 135 06:29.280 --> 06:30.440 normal. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 135 06:29.280 --> 06:30.440 normal. 136 06:30.440 --> 06:35.320 So if I do a show spanning tree root switch, so you should be the root for all 137 06:35.320 --> 06:36.040 the VLANs 138 06:36.040 --> 06:40.230 that we're still waiting for max age timer, essentially the time out that 139 06:40.230 --> 06:42.200 superior BPDU 140 06:42.200 --> 06:45.410 and so we'll have to wait just a little bit to get back to our original top 141 06:45.410 --> 06:45.920 ology. 142 06:45.920 --> 06:46.920 But that's fine. 143 06:46.920 --> 06:48.720 In the meantime, we can configure root guard. 144 06:48.720 --> 06:52.360 Again, must be configured intentionally on specific interfaces. 145 06:52.360 --> 06:56.660 I'm going to get onto my gig to slash one here for switch three and say 146 06:56.660 --> 06:57.760 spanning tree 147 06:57.760 --> 06:59.800 guard root. 148 06:59.800 --> 07:00.800 And that's it. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 148 06:59.800 --> 07:00.800 And that's it. 149 07:00.800 --> 07:02.120 That's the whole command. 150 07:02.120 --> 07:06.520 And so I'm going to go ahead and do this on switch four as well and say 151 07:06.520 --> 07:07.840 interface gig 152 07:07.840 --> 07:12.280 three slash one and spanning tree guard root. 153 07:12.280 --> 07:16.080 So go back to switch three here. 154 07:16.080 --> 07:17.280 Root guard's enabled. 155 07:17.280 --> 07:22.480 If I do a show interface gig two slash one detail, not show interface, let's 156 07:22.480 --> 07:23.480 add spanning 157 07:23.480 --> 07:29.060 tree in their show spanning tree interface detail, we do see that root guard is 158 07:29.060 --> 07:29.720 enabled 159 07:29.720 --> 07:30.720 on the port. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 159 07:29.720 --> 07:30.720 on the port. 160 07:30.720 --> 07:35.380 So this interface detail command as part of the show spanning tree family show 161 07:35.380 --> 07:35.920 spanning 162 07:35.920 --> 07:38.440 tree interface detail. 163 07:38.440 --> 07:40.080 Very, very useful to us. 164 07:40.080 --> 07:43.720 It tells us a lot of what's going on, whether it's port faster root guard or V 165 07:43.720 --> 07:45.440 PDU guard. 166 07:45.440 --> 07:47.520 All of that is in place. 167 07:47.520 --> 07:53.200 So if I do a show spanning tree root, we should see that I'm the root again and 168 07:53.200 --> 07:53.880 I am. 169 07:53.880 --> 07:58.040 And so before I got on to switch five and configured it with that priority zero 170 07:58.040 --> 07:58.640 command, 171 07:58.640 --> 08:00.680 I'm just going to do the exact same thing. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 171 07:58.640 --> 08:00.680 I'm just going to do the exact same thing. 172 08:00.680 --> 08:04.360 Let's configure switch five to have a priority of zero before that allowed it 173 08:04.360 --> 08:05.040 to take over 174 08:05.040 --> 08:06.280 as the root. 175 08:06.280 --> 08:09.000 But now notice what's already happened on switch three. 176 08:09.000 --> 08:10.960 We are blocking on that interface. 177 08:10.960 --> 08:15.740 If I do a show spanning tree and look at interface two slash one, we see that 178 08:15.740 --> 08:17.040 it's in this broken 179 08:17.040 --> 08:18.440 status. 180 08:18.440 --> 08:20.680 And over here we see the inconsistent. 181 08:20.680 --> 08:24.250 Now this tag right here root inconsistent, that's trying to tell us which 182 08:24.250 --> 08:24.920 version of 183 08:24.920 --> 08:26.600 inconsistent it is. 184 08:26.600 --> 08:28.800 In our case, it is tied to root guard. 185 08:28.800 --> 08:32.560 In other situations, we might see inconsistent with a different tag here. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 185 08:28.800 --> 08:32.560 In other situations, we might see inconsistent with a different tag here. 186 08:32.560 --> 08:35.800 But either way, it's in that broken status. 187 08:35.800 --> 08:39.050 And it's important for us to recognize when we see that that something might be 188 08:39.050 --> 08:39.320 going 189 08:39.320 --> 08:40.320 on. 190 08:40.320 --> 08:42.360 But the good news is check it out. 191 08:42.360 --> 08:44.640 I am still considered to be the root. 192 08:44.640 --> 08:45.640 This is me. 193 08:45.640 --> 08:47.040 I am the root for VLAN one. 194 08:47.040 --> 08:52.370 If I do my show spanning tree root command, I am still the root for all the V 195 08:52.370 --> 08:53.120 LANs. 196 08:53.120 --> 08:55.640 So my topology was protected. 197 08:55.640 --> 08:58.620 Switch five did get isolated because if we look at switch four, we're going to 198 08:58.620 --> 08:58.960 see the 199 08:58.960 --> 09:01.240 same error message here. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 199 08:58.960 --> 09:01.240 same error message here. 200 09:01.240 --> 09:04.750 If you want to call it a, I guess a log message, it's letting us know that it 201 09:04.750 --> 09:05.760 is blocking that 202 09:05.760 --> 09:06.760 port. 203 09:06.760 --> 09:07.960 We look at our topology. 204 09:07.960 --> 09:13.840 We have successfully protected the network by blocking or placing into that 205 09:13.840 --> 09:14.920 broken state 206 09:14.920 --> 09:17.320 these links that go down to switch five. 207 09:17.320 --> 09:20.080 And so that's exactly what we were hoping to see. 208 09:20.080 --> 09:25.440 Now lastly, let's chat real quick about and see a quick demo of BPDU filter. 209 09:25.440 --> 09:29.000 So BPDU filter is supposed to ignore all BPDUs. 210 09:29.000 --> 09:33.770 We're going to demonstrate that by taking a look back here at this interface WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 210 09:29.000 --> 09:33.770 We're going to demonstrate that by taking a look back here at this interface 211 09:33.770 --> 09:34.040 where we 212 09:34.040 --> 09:36.400 applied BPDU guard. 213 09:36.400 --> 09:40.600 BPDU guard is only going to trigger if a BPDU is seen. 214 09:40.600 --> 09:44.200 But what happens if I also apply BPDU filter here? 215 09:44.200 --> 09:48.540 Well, when I apply the filter, it's going to not process these BPDUs that 216 09:48.540 --> 09:49.240 arrive and 217 09:49.240 --> 09:52.440 therefore BPDU guard won't actually trigger. 218 09:52.440 --> 09:54.720 So let's go ahead and see that in action. 219 09:54.720 --> 09:58.400 So I'm going to go over to switch three. 220 09:58.400 --> 10:02.290 If I do a show interface gig zero two, this should still be an error disable WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 220 09:58.400 --> 10:02.290 If I do a show interface gig zero two, this should still be an error disable 221 10:02.290 --> 10:03.120 and it is. 222 10:03.120 --> 10:08.000 So I'm going to get on to interface gig zero two and do a shutdown. 223 10:08.000 --> 10:12.040 And this means that when I do a no shut, it'll be out of error disable and it 224 10:12.040 --> 10:12.680 'll start 225 10:12.680 --> 10:14.920 receiving those BPDUs. 226 10:14.920 --> 10:20.340 In order to filter those, I'm going to use the spanning tree BPDU filter 227 10:20.340 --> 10:21.360 command and 228 10:21.360 --> 10:22.360 then say enable. 229 10:22.360 --> 10:24.560 So spanning tree BPDU filter enable. 230 10:24.560 --> 10:28.680 We also saw earlier on the other switch how we could enable this globally. 231 10:28.680 --> 10:32.680 But as we said in the video before, we want to be very, very careful about WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 231 10:28.680 --> 10:32.680 But as we said in the video before, we want to be very, very careful about 232 10:32.680 --> 10:33.560 doing that. 233 10:33.560 --> 10:35.440 So BPDU filter is now on here. 234 10:35.440 --> 10:42.800 If I do a no shut, we should see that this port comes online. 235 10:42.800 --> 10:43.960 So there it is in the upstate. 236 10:43.960 --> 10:53.070 If I do a show spanning tree interface gig zero two detail, we'll see that BPDU 237 10:53.070 --> 10:53.440 guard 238 10:53.440 --> 10:56.720 and BPDU filter are both enabled on the same interface. 239 10:56.720 --> 11:00.000 And BPDU filter is going to take precedence over BPDU guard. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 239 10:56.720 --> 11:00.000 And BPDU filter is going to take precedence over BPDU guard. 240 11:00.000 --> 11:02.160 It's going to ignore the BPDUs. 241 11:02.160 --> 11:05.280 But also notice here, this is what's pretty fascinating. 242 11:05.280 --> 11:09.080 The number of BPDU sent and received are listed as zero. 243 11:09.080 --> 11:13.540 If I do this command again, many seconds later, we're still at sent and 244 11:13.540 --> 11:14.680 received zero. 245 11:14.680 --> 11:16.960 And this will be true for all of the VLANs. 246 11:16.960 --> 11:22.000 We see that they're all listed as sent and received zero thanks to BPDU filter. 247 11:22.000 --> 11:24.680 So that is how BPDU filter works. 248 11:24.680 --> 11:28.520 It completely filters out BPDUs that are sent and received on the interface, 249 11:28.520 --> 11:29.040 which we very 250 11:29.040 --> 11:31.720 careful about deploying that. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 250 11:29.040 --> 11:31.720 careful about deploying that. 251 11:31.720 --> 11:35.600 But just be aware that it is a tool that exists in case we need it. 252 11:35.600 --> 11:38.470 So with that, let's go and jump in the lab and do some of these configurations 253 11:38.470 --> 11:38.960 ourselves.