WEBVTT

1
00:00.000 --> 00:01.090 align:middle line:84%


2
00:01.090 --> 00:03.910 align:middle line:90%
Hello and welcome to
this video on root guard.

3
00:03.910 --> 00:06.010 align:middle line:90%
Is it possible
that somebody could

4
00:06.010 --> 00:08.230 align:middle line:90%
bring in in a device
from the outside world

5
00:08.230 --> 00:10.840 align:middle line:90%
into our networks,
plug it in, nothing

6
00:10.840 --> 00:14.050 align:middle line:90%
could be running Spanning Tree,
and could change our topology?

7
00:14.050 --> 00:15.280 align:middle line:84%
The answer is yes!

8
00:15.280 --> 00:17.020 align:middle line:84%
It could happen accidentally.

9
00:17.020 --> 00:19.320 align:middle line:90%
It could also happen
by a malicious person

10
00:19.320 --> 00:22.123 align:middle line:90%
who is trying to eavesdrop
on our network traffic.

11
00:22.123 --> 00:24.540 align:middle line:90%
In this video, I'd like to
share with you a feature called

12
00:24.540 --> 00:27.670 align:middle line:90%
root guard, which can
help protect and stabilize

13
00:27.670 --> 00:31.160 align:middle line:90%
our Spanning Tree topology the
way we intended it to work.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

13
00:27.670 --> 00:31.160 align:middle line:90%
our Spanning Tree topology the
way we intended it to work.

14
00:31.160 --> 00:33.775 align:middle line:90%
So let's use this topology that
we used in the previous video

15
00:33.775 --> 00:34.650 align:middle line:84%
on our storm control.

16
00:34.650 --> 00:36.880 align:middle line:90%
And let's leverage it
once again for root guard.

17
00:36.880 --> 00:39.340 align:middle line:90%
And let's make-- if
switch 1 is not the root,

18
00:39.340 --> 00:40.800 align:middle line:84%
we'll make him the root.

19
00:40.800 --> 00:43.210 align:middle line:90%
And so the root's going
to have designated ports

20
00:43.210 --> 00:44.890 align:middle line:90%
on all of its ports
for that given VLAN.

21
00:44.890 --> 00:46.630 align:middle line:84%
Let's focus on VLAN 1.

22
00:46.630 --> 00:49.990 align:middle line:90%
And on switch 2, this
would be the root port.

23
00:49.990 --> 00:51.910 align:middle line:90%
This would be
designated right here.

24
00:51.910 --> 00:53.290 align:middle line:84%
That'd be its root port.

25
00:53.290 --> 00:55.060 align:middle line:90%
And this guy would be
in a blocking state.

26
00:55.060 --> 00:56.685 align:middle line:90%
So before we get too
far in our journey

27
00:56.685 --> 00:58.600 align:middle line:90%
with setting up and
verifying root guard,

28
00:58.600 --> 01:00.970 align:middle line:90%
let's verify this
Spanning Tree topology,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

28
00:58.600 --> 01:00.970 align:middle line:90%
let's verify this
Spanning Tree topology,

29
01:00.970 --> 01:03.140 align:middle line:90%
that it is what
we've just drawn out.

30
01:03.140 --> 01:05.239 align:middle line:90%
So I've got my command
window open to all three.

31
01:05.239 --> 01:08.050 align:middle line:90%
If we do a show Spanning
Tree for VLAN 1,

32
01:08.050 --> 01:10.180 align:middle line:90%
and scroll down a little
bit, this guy is the root.

33
01:10.180 --> 01:11.050 align:middle line:84%
This is switch 1.

34
01:11.050 --> 01:12.280 align:middle line:84%
Fantastic.

35
01:12.280 --> 01:17.376 align:middle line:90%
Switch 2 has a root
port that is Fa0/3,

36
01:17.376 --> 01:19.870 align:middle line:84%
which goes up to switch 1.

37
01:19.870 --> 01:21.940 align:middle line:90%
Its port 5, which is
going over to switch 3,

38
01:21.940 --> 01:23.260 align:middle line:84%
is in a blocking state.

39
01:23.260 --> 01:25.980 align:middle line:90%
And then switch 3, we should
have forwarding ports.

40
01:25.980 --> 01:28.900 align:middle line:90%
So we have a root port
that's going up to switch 1,

41
01:28.900 --> 01:32.630 align:middle line:90%
and then the designated port
between itself and switch 2.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

41
01:28.900 --> 01:32.630 align:middle line:90%
and then the designated port
between itself and switch 2.

42
01:32.630 --> 01:33.130 align:middle line:84%
Perfect.

43
01:33.130 --> 01:35.020 align:middle line:90%
I just wanted to confirm
where we were starting with.

44
01:35.020 --> 01:36.478 align:middle line:90%
And here's how root
guard operates.

45
01:36.478 --> 01:39.430 align:middle line:90%
If we need a little root guard
on this designated port, which

46
01:39.430 --> 01:41.050 align:middle line:90%
is forwarding away
from the root,

47
01:41.050 --> 01:44.470 align:middle line:90%
if this switch on that port sees
better, which in Spanning Tree

48
01:44.470 --> 01:47.740 align:middle line:90%
means lower cost or better
bridge ID for a given VLAN,

49
01:47.740 --> 01:50.380 align:middle line:90%
if it sees better
BPDUs coming in,

50
01:50.380 --> 01:53.050 align:middle line:90%
if it's got root guard on it,
instead of changing its mind

51
01:53.050 --> 01:55.000 align:middle line:90%
and saying, oh, OK,
that'll be my root part,

52
01:55.000 --> 01:59.170 align:middle line:90%
it simply puts it into a
root inconsistent state

53
01:59.170 --> 02:00.910 align:middle line:90%
and doesn't change
its root part.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

53
01:59.170 --> 02:00.910 align:middle line:90%
and doesn't change
its root part.

54
02:00.910 --> 02:03.340 align:middle line:90%
And that way, if we
have a port, like 0/6,

55
02:03.340 --> 02:05.410 align:middle line:90%
which is going to
a user, like Bob,

56
02:05.410 --> 02:07.413 align:middle line:90%
and Bob is running some
malicious software,

57
02:07.413 --> 02:08.830 align:middle line:90%
or he plugs in a
device from home,

58
02:08.830 --> 02:11.247 align:middle line:90%
or does something else tricky,
and this would also, again,

59
02:11.247 --> 02:13.570 align:middle line:90%
normally be a designated
port being able to forward

60
02:13.570 --> 02:15.880 align:middle line:90%
to Bob's computer, if,
for whatever reason,

61
02:15.880 --> 02:18.655 align:middle line:90%
better BPDUs start showing
up on this port, 0/6,

62
02:18.655 --> 02:20.440 align:middle line:90%
with root guard
enabled, the switch

63
02:20.440 --> 02:22.538 align:middle line:90%
will place that in a
root inconsistent state.

64
02:22.538 --> 02:24.580 align:middle line:90%
And that way, the switch
won't change its opinion

65
02:24.580 --> 02:27.650 align:middle line:90%
about the real root port that
goes to the real root bridge.

66
02:27.650 --> 02:31.450 align:middle line:90%
So we're protecting against a
malicious or accidental change
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

66
02:27.650 --> 02:31.450 align:middle line:90%
So we're protecting against a
malicious or accidental change

67
02:31.450 --> 02:35.890 align:middle line:90%
of STP topology, based on
a user, or a hacker who's

68
02:35.890 --> 02:37.370 align:middle line:84%
trying to manipulate us.

69
02:37.370 --> 02:38.570 align:middle line:84%
So let's do this for fun.

70
02:38.570 --> 02:40.695 align:middle line:90%
Let's go ahead and enable
this feature, root guard.

71
02:40.695 --> 02:43.090 align:middle line:84%
We'll do it on switch 3, 0/5.

72
02:43.090 --> 02:46.060 align:middle line:90%
And then, this is so mean,
but then let's go to switch 2

73
02:46.060 --> 02:50.050 align:middle line:90%
and tell it that it's now going
to be the root for VLAN 1.

74
02:50.050 --> 02:51.760 align:middle line:90%
So we'll tell it
to beat switch 1.

75
02:51.760 --> 02:54.330 align:middle line:90%
And as a result, it's going
to start sending BPDUs

76
02:54.330 --> 02:55.577 align:middle line:84%
with a better bridge ID.

77
02:55.577 --> 02:57.160 align:middle line:90%
And on a good day,
switch 2 would say,

78
02:57.160 --> 02:59.230 align:middle line:90%
oh, there's the new root, and
it would go this direction.

79
02:59.230 --> 03:02.030 align:middle line:90%
But because of root guard, it'll
maintain the old root port.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

79
02:59.230 --> 03:02.030 align:middle line:90%
But because of root guard, it'll
maintain the old root port.

80
03:02.030 --> 03:03.400 align:middle line:84%
It'll keep it in place.

81
03:03.400 --> 03:05.740 align:middle line:90%
And it won't be fooled
into thinking the root is

82
03:05.740 --> 03:07.730 align:middle line:84%
available off gig 0/5.

83
03:07.730 --> 03:09.530 align:middle line:90%
So let's implement
that and test it.

84
03:09.530 --> 03:12.190 align:middle line:90%
So let me scroll this down
out of the way a little bit.

85
03:12.190 --> 03:16.720 align:middle line:90%
So here on switch 3, we're going
to enable the feature on Fa0/5.

86
03:16.720 --> 03:20.920 align:middle line:90%
So config [INAUDIBLE]
interface fa 0/5,

87
03:20.920 --> 03:24.780 align:middle line:84%
and spanning-tree guard root.

88
03:24.780 --> 03:25.665 align:middle line:84%
It's done.

89
03:25.665 --> 03:27.790 align:middle line:90%
And now that that's done,
let's go over to switch 2

90
03:27.790 --> 03:31.180 align:middle line:90%
and tell switch 2 that it
is now the root for VLAN 1.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

90
03:27.790 --> 03:31.180 align:middle line:90%
and tell switch 2 that it
is now the root for VLAN 1.

91
03:31.180 --> 03:32.680 align:middle line:90%
So we'll go into
configuration mode,

92
03:32.680 --> 03:37.480 align:middle line:90%
spanning-tree, vlan 1,
root, and we'll say primary.

93
03:37.480 --> 03:38.440 align:middle line:84%
And boom.

94
03:38.440 --> 03:39.120 align:middle line:84%
And it's done!

95
03:39.120 --> 03:42.340 align:middle line:90%
So if we do a show
spanning-tree now for VLAN 1

96
03:42.340 --> 03:44.830 align:middle line:90%
right here on switch 2,
it says, I'm the root!

97
03:44.830 --> 03:46.870 align:middle line:84%
I have now the best bridge ID.

98
03:46.870 --> 03:48.280 align:middle line:90%
So I'm in designated
ports, which

99
03:48.280 --> 03:52.280 align:middle line:90%
means I'm also seeing
those BPDUs on Fa0/5,

100
03:52.280 --> 03:54.503 align:middle line:90%
and those are being
heard over on switch 3.

101
03:54.503 --> 03:56.920 align:middle line:90%
And I just realized that I
don't have terminal monitor on.

102
03:56.920 --> 03:59.230 align:middle line:84%
So you do a terminal monitor.

103
03:59.230 --> 04:00.542 align:middle line:84%
And let's do a show log.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

103
03:59.230 --> 04:00.542 align:middle line:84%
And let's do a show log.

104
04:00.542 --> 04:01.750 align:middle line:84%
We should have got a message.

105
04:01.750 --> 04:02.600 align:middle line:84%
There it is.

106
04:02.600 --> 04:04.173 align:middle line:84%
So there's our log message.

107
04:04.173 --> 04:05.840 align:middle line:90%
So here's a message
regarding root guard

108
04:05.840 --> 04:07.390 align:middle line:84%
enabled on that port.

109
04:07.390 --> 04:09.820 align:middle line:90%
And now we have
root guard blocking

110
04:09.820 --> 04:11.640 align:middle line:84%
on that port for VLAN 1.

111
04:11.640 --> 04:14.530 align:middle line:90%
And if we went back and we did
a show spanning-tree for VLAN 1,

112
04:14.530 --> 04:17.079 align:middle line:90%
it's also going to show us
that root inconsistent state

113
04:17.079 --> 04:17.829 align:middle line:84%
on that part.

114
04:17.829 --> 04:20.890 align:middle line:90%
And notice that the
root part of Fa0/4,

115
04:20.890 --> 04:23.920 align:middle line:90%
which leads up to switch
1, has not been modified.

116
04:23.920 --> 04:25.640 align:middle line:84%
It is still the root port.

117
04:25.640 --> 04:29.410 align:middle line:90%
And if it shows spanning-tree
inconsistent ports,

118
04:29.410 --> 04:32.120 align:middle line:90%
that's another easy way to
help find that very easily.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

118
04:29.410 --> 04:32.120 align:middle line:90%
that's another easy way to
help find that very easily.

119
04:32.120 --> 04:34.270 align:middle line:90%
So using root guard
is a great step

120
04:34.270 --> 04:36.340 align:middle line:90%
into securing our
topology, so it's not

121
04:36.340 --> 04:37.580 align:middle line:84%
changing in weird ways.

122
04:37.580 --> 04:39.490 align:middle line:90%
Now, there's yet
even another option

123
04:39.490 --> 04:41.620 align:middle line:90%
that we can use to help
protect our Spanning Tree,

124
04:41.620 --> 04:43.770 align:middle line:84%
and that is BPDU guard.

125
04:43.770 --> 04:45.640 align:middle line:90%
And we'll take a closer
look at what that is

126
04:45.640 --> 04:47.720 align:middle line:90%
and how it works
in the next video.

127
04:47.720 --> 04:50.060 align:middle line:90%
So I'll see you there
in just a moment.

128
04:50.060 --> 04:52.420 align:middle line:90%
Meanwhile, I hope this has
been informative for you.

129
04:52.420 --> 04:55.650 align:middle line:90%
And I'd like to thank
you for viewing.