WEBVTT

1
00:00.000 --> 00:02.880
So, how did you do on the lab challenge?

2
00:02.880 --> 00:06.110
Hopefully you were able to log into the lab and spend some time really making

3
00:06.110 --> 00:06.440
sure we

4
00:06.440 --> 00:11.360
understand the difference between root guard and BPDU guard and their operation

5
00:11.360 --> 00:11.880
, but understand

6
00:11.880 --> 00:15.080
that they both work together to lock in a spanning tree topology.

7
00:15.080 --> 00:18.860
And this is one of those technologies that we learn about that has very

8
00:18.860 --> 00:20.320
practical application.

9
00:20.320 --> 00:25.240
This should absolutely be deployed in every production network that we manage,

10
00:25.240 --> 00:25.840
both BPDU

11
00:25.840 --> 00:27.240
guard and root guard.

12
00:27.240 --> 00:31.470
And again, BPD filter, probably not something we're going to use, hopefully,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

12
00:27.240 --> 00:31.470
And again, BPD filter, probably not something we're going to use, hopefully,

13
00:31.470 --> 00:32.000
but if we

14
00:32.000 --> 00:34.320
do, again, it should be a last resort.

15
00:34.320 --> 00:37.560
But let's go ahead and look at this lab challenge and just review the answers

16
00:37.560 --> 00:38.240
together.

17
00:38.240 --> 00:43.290
So the first task suggests that we want to enable, let's see, our trunk access

18
00:43.290 --> 00:44.320
connectivity

19
00:44.320 --> 00:45.880
only on switch three.

20
00:45.880 --> 00:49.880
Going to ensure that switches are connected, it'll be error disabled.

21
00:49.880 --> 00:51.840
So let's go ahead and look at our lab topology.

22
00:51.840 --> 00:54.040
We're talking about this connection over here.

23
00:54.040 --> 00:58.460
If we get a BPDU, we want to go into air disable that word air disabled should

24
00:58.460 --> 00:59.520
immediately make

25
00:59.520 --> 01:05.200
us think about this being BPDU guard, because that goes into air disable when
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

25
00:59.520 --> 01:05.200
us think about this being BPDU guard, because that goes into air disable when

26
01:05.200 --> 01:06.080
we receive

27
01:06.080 --> 01:07.400
a BPDU.

28
01:07.400 --> 01:09.560
Now remember, this port is already shut down.

29
01:09.560 --> 01:12.080
So we're going to configure BPDU guard here.

30
01:12.080 --> 01:14.480
Do a no shot, make sure that it does indeed work.

31
01:14.480 --> 01:17.640
It's exactly what we did as a lab demo earlier.

32
01:17.640 --> 01:22.630
So switch three, config T, interface gig zero two, and then it's that command

33
01:22.630 --> 01:23.280
spanning

34
01:23.280 --> 01:26.880
tree BPDU guard enable.

35
01:26.880 --> 01:30.940
And then I'm just going to do a no shut to make sure that indeed it does go
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

35
01:26.880 --> 01:30.940
And then I'm just going to do a no shut to make sure that indeed it does go

36
01:30.940 --> 01:31.480
into air

37
01:31.480 --> 01:35.760
disable when we receive the BPDUs from switch one.

38
01:35.760 --> 01:37.960
And that's exactly what happened.

39
01:37.960 --> 01:40.320
Next we're tasked with configuring switch four.

40
01:40.320 --> 01:45.360
So this is the other side of the topology over here switch four gig zero two,

41
01:45.360 --> 01:45.840
we're

42
01:45.840 --> 01:50.400
being told that we want to make sure BPDU guard is added.

43
01:50.400 --> 01:54.640
But we are only going to use global commands.

44
01:54.640 --> 01:58.800
And so this is going to require us configuring things at a global level.

45
01:58.800 --> 02:03.300
So let's go over to switch four, config T and the command to configure things
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

45
01:58.800 --> 02:03.300
So let's go over to switch four, config T and the command to configure things

46
02:03.300 --> 02:03.960
globally

47
02:03.960 --> 02:08.200
here is going to involve spanning tree port fast.

48
02:08.200 --> 02:12.000
And then we're going to configure this as edge default.

49
02:12.000 --> 02:15.550
And again, as I said before, sometimes this edge keyword doesn't show up,

50
02:15.550 --> 02:16.200
especially

51
02:16.200 --> 02:20.840
on real hardware as opposed to the virtual virtual switches.

52
02:20.840 --> 02:23.880
But either way, we've just configured port fast to go everywhere.

53
02:23.880 --> 02:29.600
Now we can configure this as well to include BPDU guard by default.

54
02:29.600 --> 02:32.280
So we got to get the edge in here.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

54
02:29.600 --> 02:32.280
So we got to get the edge in here.

55
02:32.280 --> 02:33.280
Do question mark.

56
02:33.280 --> 02:37.040
There's where we see our BPDU guard and filter options.

57
02:37.040 --> 02:39.400
And then we're going to add the default keyword.

58
02:39.400 --> 02:43.400
So now that those commands are in place, this will affect all access layer

59
02:43.400 --> 02:44.000
ports.

60
02:44.000 --> 02:48.450
So if I do a show run on our interface in question, we see that it's running in

61
02:48.450 --> 02:48.920
trunk

62
02:48.920 --> 02:49.920
operation.

63
02:49.920 --> 02:54.280
So I actually have to get on here and say switch port mode access.

64
02:54.280 --> 02:58.900
So at this point, this port, even though we look at the configuration doesn't

65
02:58.900 --> 02:59.720
show BPDU

66
02:59.720 --> 03:02.560
guard, it should be running BPDU guard.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

66
02:59.720 --> 03:02.560
guard, it should be running BPDU guard.

67
03:02.560 --> 03:04.920
So I do a no shut.

68
03:04.920 --> 03:08.630
And then just wait a few seconds because switch two downstream should be

69
03:08.630 --> 03:09.520
sending BPDU's

70
03:09.520 --> 03:12.880
and we see that it did get disabled by our global commands.

71
03:12.880 --> 03:15.040
So that's exactly what we wanted to do.

72
03:15.040 --> 03:19.040
Now next, we're looking at the topology and we see that we need switch five to

73
03:19.040 --> 03:20.280
never become

74
03:20.280 --> 03:22.000
or claim to be the root.

75
03:22.000 --> 03:25.720
We want to make sure that switch three stays the root.

76
03:25.720 --> 03:29.490
And so we're going to accomplish this by configuring, you know, change the

77
03:29.490 --> 03:30.280
color here.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

77
03:29.490 --> 03:30.280
color here.

78
03:30.280 --> 03:36.780
We want to make sure that we configure root guard on the downstream interfaces

79
03:36.780 --> 03:37.640
on switch

80
03:37.640 --> 03:41.980
three and switch four, which involves gig two slash one on switch three and gig

81
03:41.980 --> 03:42.200
three

82
03:42.200 --> 03:44.520
slash one on switch four.

83
03:44.520 --> 03:50.040
So let's go ahead and get over to switch three interface gig two slash one here

84
03:50.040 --> 03:50.300
.

85
03:50.300 --> 03:54.240
And this command is spanning tree guard root.

86
03:54.240 --> 03:57.280
And for now, we're just going to leave that I come over to switch four.

87
03:57.280 --> 04:02.160
Same thing into gig three slash one spanning tree guard root.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

87
03:57.280 --> 04:02.160
Same thing into gig three slash one spanning tree guard root.

88
04:02.160 --> 04:03.240
All right.

89
04:03.240 --> 04:10.320
So now we can get on to switch five and do a spanning tree VLAN one to 40 94.

90
04:10.320 --> 04:12.640
And then we'll say priority zero.

91
04:12.640 --> 04:16.570
So that should allow switch five to claim to take over as the root switch three

92
04:16.570 --> 04:16.960
and switch

93
04:16.960 --> 04:18.800
four should not like that.

94
04:18.800 --> 04:22.640
Indeed, it looks like they have both blocked it.

95
04:22.640 --> 04:27.390
And this is where if we do a show spanning tree, we will see that port in that

96
04:27.390 --> 04:27.920
broken

97
04:27.920 --> 04:33.760
status, which is the STP inconsistent, uh, motive operation.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

97
04:27.920 --> 04:33.760
status, which is the STP inconsistent, uh, motive operation.

98
04:33.760 --> 04:41.560
So that all fixes itself when we put this back to 32 768.

99
04:41.560 --> 04:46.530
And after the max age timer has expired there, we should see that the port, um,

100
04:46.530 --> 04:47.280
is allowed

101
04:47.280 --> 04:49.360
to process traffic again.

102
04:49.360 --> 04:54.480
So the last task here is simply, uh, testing us on BPU filter.

103
04:54.480 --> 05:00.200
So BPU guard is clearly working over on switch threes gig zero to interface.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

103
04:54.480 --> 05:00.200
So BPU guard is clearly working over on switch threes gig zero to interface.

104
05:00.200 --> 05:01.200
So let's go over.

105
05:01.200 --> 05:02.200
We're on switch three.

106
05:02.200 --> 05:03.200
How about that?

107
05:03.200 --> 05:04.200
And there we go.

108
05:04.200 --> 05:05.200
It's unblocking.

109
05:05.200 --> 05:06.160
So we did see that in action too.

110
05:06.160 --> 05:07.160
So perform a shot.

111
05:07.160 --> 05:11.200
No shot on gig zero to remove the air disabled state confirm.

112
05:11.200 --> 05:16.240
We're able to connect if indeed we have enabled BPU filter.

113
05:16.240 --> 05:20.820
So what we're going to do here is just get on to get zero to in fact, if we do

114
05:20.820 --> 05:21.400
a show

115
05:21.400 --> 05:24.720
interface on it, we should see it is still an air disabled.

116
05:24.720 --> 05:28.320
It's right there.

117
05:28.320 --> 05:32.880
And so now I'm going to do, sorry, BPU filter command.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

117
05:28.320 --> 05:32.880
And so now I'm going to do, sorry, BPU filter command.

118
05:32.880 --> 05:37.200
So it's just spanning tree BPU filter, enable.

119
05:37.200 --> 05:41.600
And now I'll do a shot, no shot.

120
05:41.600 --> 05:47.010
And that should allow us to see again what we demonstrated in lab, which is

121
05:47.010 --> 05:47.800
that even

122
05:47.800 --> 05:51.760
though we have BPU guard enabled on this port and it just placed it into air

123
05:51.760 --> 05:52.560
disable because

124
05:52.560 --> 05:56.510
now we have BPU filter, it's going to make it so we're not sending any BPU's

125
05:56.510 --> 05:56.760
and we

126
05:56.760 --> 06:01.740
never process any BPU's which that we receive, which means that BPU guard never
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

126
05:56.760 --> 06:01.740
never process any BPU's which that we receive, which means that BPU guard never

127
06:01.740 --> 06:02.200
places the

128
06:02.200 --> 06:03.200
port into air disable.

129
06:03.200 --> 06:06.540
And at this point, I'd say it's safe to say that that's just not going to

130
06:06.540 --> 06:07.160
happen.

131
06:07.160 --> 06:10.780
So a little bit of a fast run through there of the solution, but again, we've

132
06:10.780 --> 06:11.400
got access

133
06:11.400 --> 06:12.400
to this lab.

134
06:12.400 --> 06:17.520
So feel free to configure BPU guard and root guard and BPU filter enough time

135
06:17.520 --> 06:18.120
so that we

136
06:18.120 --> 06:20.920
understand how it all works and how it all comes together.

137
06:20.920 --> 06:23.440
I hope this has been informative for you and I'd like to thank you for viewing.