WEBVTT

1
00:00.000 --> 00:04.920
All right, into the lab to see loop guard. So our topology here has switch 3 as

2
00:04.920 --> 00:05.280
the root.

3
00:05.280 --> 00:12.720
It's configured with a 4k value and switch 4 is also configured with 8k 8192.

4
00:12.720 --> 00:13.280
But the point is

5
00:13.280 --> 00:18.110
that if all of the links have the same spanning tree cost, then we're going to

6
00:18.110 --> 00:19.120
favor the path

7
00:19.120 --> 00:22.740
directly to the root. So switch 5 is going to have to decide which link to

8
00:22.740 --> 00:24.080
block. We would expect

9
00:24.080 --> 00:28.980
it to block this link over here. That would be gig 3 slash 1, which connects to

10
00:28.980 --> 00:30.080
gig 3 slash 1
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

10
00:28.980 --> 00:30.080
gig 3 slash 1

11
00:30.080 --> 00:36.560
on switch 4. Let's go ahead and confirm that. So we're on switch 3. Let's go

12
00:36.560 --> 00:37.120
ahead and get over

13
00:37.120 --> 00:43.050
to switch 5. Do a show spanning tree blocked ports command. And indeed, we are

14
00:43.050 --> 00:44.000
blocking gig

15
00:44.000 --> 00:49.280
3 slash 1. So what we're concerned with here is that switch 4 just stops

16
00:49.280 --> 00:50.480
sending BP to use.

17
00:50.480 --> 00:56.960
And we can emulate that by getting onto interface gig 3 slash 1. And then doing

18
00:56.960 --> 00:58.160
a spanning tree

19
00:58.160 --> 01:03.760
BP to filter enable command. So we just studied BP to filter. This means we're
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

19
00:58.160 --> 01:03.760
BP to filter enable command. So we just studied BP to filter. This means we're

20
01:03.760 --> 01:04.480
going to stop

21
01:04.480 --> 01:08.480
sending and receiving BP to use. We're essentially emulating switch forwards

22
01:08.480 --> 01:13.410
spanning tree protocol process, running into problems and stop sending BP to

23
01:13.410 --> 01:15.200
use. Now over on

24
01:15.200 --> 01:18.280
switch 5, when we look at things here, we're going to find that it's still

25
01:18.280 --> 01:19.600
going to be in the blocked

26
01:19.600 --> 01:24.850
state for a little while. But remember, it's that max age timer that we're

27
01:24.850 --> 01:25.520
going to have to pay

28
01:25.520 --> 01:29.900
attention to when I do a show spanning tree for VLAN 1. We'll see that we are

29
01:29.900 --> 01:30.320
actually,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

29
01:29.900 --> 01:30.320
actually,

30
01:30.320 --> 01:34.940
the max age is now expired that 20 seconds. So the BP to use considered expired

31
01:34.940 --> 01:35.680
. Now we're going

32
01:35.680 --> 01:39.920
to go through the process of listening and learning and try to bring that port

33
01:39.920 --> 01:40.880
online. And at that

34
01:40.880 --> 01:45.420
point, we'll find there are no blocked ports in this entire environment. So if

35
01:45.420 --> 01:46.000
I do show

36
01:46.000 --> 01:53.110
spanning tree blocked ports here, it shows zero. Show spanning tree blocked

37
01:53.110 --> 01:55.040
ports on switch 4,

38
01:55.040 --> 02:00.720
also zero, and switch 3 is the root. So we would not expect there to be any
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

38
01:55.040 --> 02:00.720
also zero, and switch 3 is the root. So we would not expect there to be any

39
02:00.720 --> 02:01.600
blocked ports on the

40
02:01.600 --> 02:05.920
route. And let's just go to switch 5 one more time, do a show spanning tree,

41
02:05.920 --> 02:07.360
and we'll see that it is

42
02:07.360 --> 02:11.490
indeed in forwarding. So we've just formed a loop in our environment. There are

43
02:11.490 --> 02:12.720
no blocked ports

44
02:12.720 --> 02:17.520
whatsoever. This would be a very bad day. And you know, when we think about the

45
02:17.520 --> 02:18.320
story that I told,

46
02:18.320 --> 02:21.600
that was a really bad day. And so we don't want to find ourselves in that

47
02:21.600 --> 02:22.800
situation. So what can

48
02:22.800 --> 02:27.770
we do about this? So let's go back over to switch 4. And we'll get on to that

49
02:27.770 --> 02:29.840
interface gig 3/1 and

50
02:29.840 --> 02:38.430
do a no spanning tree BP to filter. And by the way, the switch is running slow.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

50
02:29.840 --> 02:38.430
do a no spanning tree BP to filter. And by the way, the switch is running slow.

51
02:38.430 --> 02:39.520
And so be very

52
02:39.520 --> 02:44.200
careful of this in your own environment in case it causes problems. So here we

53
02:44.200 --> 02:47.440
go. No spanning tree

54
02:47.440 --> 02:53.220
BP to filter enable. And so that should make it so that all of our spanning

55
02:53.220 --> 02:54.720
tree topology comes

56
02:54.720 --> 03:01.100
back online. So let's go ahead and go back over to switch 5 and do a show
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

56
02:54.720 --> 03:01.100
back online. So let's go ahead and go back over to switch 5 and do a show

57
03:01.100 --> 03:03.840
spanning tree. And we

58
03:03.840 --> 03:07.040
should see that we are in a blocking state. Okay, so everything is back to

59
03:07.040 --> 03:08.000
normal now. So that's

60
03:08.000 --> 03:11.740
very good. Again, be very cautious of this in your own lab environment. I would

61
03:11.740 --> 03:12.240
configure

62
03:12.240 --> 03:16.310
loop guard first and see it in action. Just to know at this point, we've proven

63
03:16.310 --> 03:18.160
that there is a

64
03:18.160 --> 03:23.610
loop that develops. And yes, even virtual equipment can be affected by just a

65
03:23.610 --> 03:24.800
small amount of broadcast

66
03:24.800 --> 03:29.840
traffic that loops infinitely. So don't lock yourself out of your lab. Instead,

67
03:29.840 --> 03:30.560
let's configure
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

67
03:29.840 --> 03:30.560
let's configure

68
03:30.560 --> 03:34.540
loop guard. So what we're going to do is we're going to really focus on switch

69
03:34.540 --> 03:35.600
5 here. We'd want

70
03:35.600 --> 03:39.500
to in a production environment deploy loop guard everywhere. But in our lab

71
03:39.500 --> 03:40.640
environment, we're just

72
03:40.640 --> 03:45.050
going to deploy it here on switch 5. Now I can get on to interface gig three

73
03:45.050 --> 03:46.160
slash one and say

74
03:46.160 --> 03:49.500
spanning tree guard. And then we'll see that we can configure loop guard here

75
03:49.500 --> 03:50.400
with spanning tree

76
03:50.400 --> 03:54.430
guard loop. Or I could configure it globally, which is usually what we want to

77
03:54.430 --> 03:55.200
do. And so I'm

78
03:55.200 --> 03:59.790
going to say spanning tree loop guard. And so when I run spanning tree loop

79
03:59.790 --> 04:01.200
guard, I can add default
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

79
03:59.790 --> 04:01.200
guard, I can add default

80
04:01.200 --> 04:05.040
here. And then we hit enter. So that is the global command for enabling it

81
04:05.040 --> 04:06.400
everywhere. And then I

82
04:06.400 --> 04:12.660
can do a show spanning tree interface on gig, let's say three slash one detail.

83
04:12.660 --> 04:13.600
And this excellent

84
04:13.600 --> 04:17.360
command is going to tell us that loop guard is enabled specifically by default,

85
04:17.360 --> 04:18.160
meaning from the

86
04:18.160 --> 04:24.090
global configurations perspective. So now this port is protected from the

87
04:24.090 --> 04:25.360
concept of BPD use

88
04:25.360 --> 04:29.160
disappearing. Now again, in a production network, I'd want to deploy this on

89
04:29.160 --> 04:30.160
all of the switches.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

89
04:29.160 --> 04:30.160
all of the switches.

90
04:30.160 --> 04:34.640
But for this specific scenario, it only matters here, because this is where the

91
04:34.640 --> 04:35.440
blocked port is.

92
04:35.440 --> 04:40.530
So I'm going to do the same command on switch form, I'm going to do a config T,

93
04:40.530 --> 04:40.880
get onto the

94
04:40.880 --> 04:46.900
interface gig three slash one. And then I'm going to say spanning tree BPDU

95
04:46.900 --> 04:48.080
filter enable.

96
04:48.080 --> 04:54.100
So now what's going to happen on switch five is it's going to recognize that B

97
04:54.100 --> 04:55.120
PDUs haven't been

98
04:55.120 --> 04:59.110
received for the duration of the max age timer. So we're going to have to wait

99
04:59.110 --> 05:00.320
for that 20 seconds
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

99
04:59.110 --> 05:00.320
for that 20 seconds

100
05:00.320 --> 05:04.190
here, which is already more than halfway done at this point. And we should

101
05:04.190 --> 05:05.280
start to see error

102
05:05.280 --> 05:10.080
messages that say, Hey, wait a second, this port and there it comes, this port

103
05:10.080 --> 05:10.960
stopped receiving

104
05:10.960 --> 05:15.510
DPDUs. And we're going to block that port because of loop guard. And so that's

105
05:15.510 --> 05:16.560
exactly what we see

106
05:16.560 --> 05:21.770
here with this specific error message is it's in loop guard blocking mode. If I

107
05:21.770 --> 05:22.800
do a show spanning

108
05:22.800 --> 05:27.280
tree, we're going to find that it's back into that broken status, thanks to

109
05:27.280 --> 05:27.920
spanning tree

110
05:27.920 --> 05:31.950
inconsistent. So in this case, it's a loop inconsistent. Remember, before when
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

110
05:27.920 --> 05:31.950
inconsistent. So in this case, it's a loop inconsistent. Remember, before when

111
05:31.950 --> 05:33.360
we are running

112
05:33.360 --> 05:38.170
root guard, this was root inconsistent. So this error message here does help

113
05:38.170 --> 05:38.960
clue us in as to why

114
05:38.960 --> 05:44.390
it's in the broken status, or broken state. But in the end, our network is

115
05:44.390 --> 05:45.360
protected,

116
05:45.360 --> 05:49.700
everything is perfectly fine. Because if I do a show spanning tree blocked

117
05:49.700 --> 05:50.480
ports,

118
05:50.480 --> 05:55.280
we see that the port is still blocked, even though our BPDUs stopped arriving.

119
05:55.280 --> 06:05.280
[BLANK_AUDIO]