WEBVTT

1
00:00.000 --> 00:01.200 align:middle line:84%


2
00:01.200 --> 00:03.360 align:middle line:90%
In life, there are
things called red flags.

3
00:03.360 --> 00:05.458 align:middle line:90%
When we see a red flag,
we should pay attention,

4
00:05.458 --> 00:06.750 align:middle line:84%
and say, whoa, what's going on?

5
00:06.750 --> 00:10.380 align:middle line:90%
Well, if we have access ports
or ports on our switches

6
00:10.380 --> 00:13.620 align:middle line:90%
that go to other networks
who are non-switches,

7
00:13.620 --> 00:16.620 align:middle line:90%
if we get BPDUs that are
received on those ports

8
00:16.620 --> 00:19.500 align:middle line:90%
where they're not expected,
that's a huge red flag.

9
00:19.500 --> 00:21.780 align:middle line:90%
So in addition to using
tools like Root Guard,

10
00:21.780 --> 00:24.397 align:middle line:90%
we can also use a feature
called BPDU Guard,

11
00:24.397 --> 00:26.980 align:middle line:90%
and that's what I'd like to talk
with you about in this video.

12
00:26.980 --> 00:31.050 align:middle line:90%
So here's the idea
behind BPDU Guard.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

12
00:26.980 --> 00:31.050 align:middle line:90%
So here's the idea
behind BPDU Guard.

13
00:31.050 --> 00:33.150 align:middle line:90%
If we enable BPDU
Guard, and let's imagine

14
00:33.150 --> 00:34.700 align:middle line:90%
we enabled it right
here on this port

15
00:34.700 --> 00:37.540 align:middle line:90%
that leads to computer two,
which Bob is sitting at.

16
00:37.540 --> 00:39.960 align:middle line:90%
And for some reason,
Bob's computer

17
00:39.960 --> 00:42.360 align:middle line:90%
or whatever Bob is
plugged in, to a switch

18
00:42.360 --> 00:46.170 align:middle line:90%
or directly to that port, if
it starts sending in BPDUs,

19
00:46.170 --> 00:48.430 align:middle line:84%
here's what BPDU Guard says.

20
00:48.430 --> 00:50.830 align:middle line:90%
It's going to error
disable the port.

21
00:50.830 --> 00:51.960 align:middle line:84%
So it's pretty strict.

22
00:51.960 --> 00:54.070 align:middle line:90%
One BPDU, and boom,
that port is down,

23
00:54.070 --> 00:55.830 align:middle line:90%
like, hey, I'm not
even messing around.

24
00:55.830 --> 00:57.940 align:middle line:90%
So it's pretty strict
as far as BPDUs guards.

25
00:57.940 --> 01:00.232 align:middle line:90%
We'd only want to have it on
ports where we would never
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

25
00:57.940 --> 01:00.232 align:middle line:90%
We'd only want to have it on
ports where we would never

26
01:00.232 --> 01:02.220 align:middle line:90%
expect to see a BPDU
come in, including

27
01:02.220 --> 01:05.129 align:middle line:90%
from an access port that's
connected to our end users.

28
01:05.129 --> 01:11.520 align:middle line:90%
Now another option that isn't
quite as severe is BPDU filter.

29
01:11.520 --> 01:14.700 align:middle line:90%
And think of BPDU filter
as a gentle, that's OK,

30
01:14.700 --> 01:16.320 align:middle line:84%
no big deal kind of attitude.

31
01:16.320 --> 01:20.340 align:middle line:90%
With BPDUs filter, if
Bob does send in a BPDU,

32
01:20.340 --> 01:21.610 align:middle line:84%
we're just going to ignore it.

33
01:21.610 --> 01:23.250 align:middle line:90%
So it's not like we're
going to shut down the port.

34
01:23.250 --> 01:25.583 align:middle line:90%
We're just going to ignore
it, pretend it didn't happen.

35
01:25.583 --> 01:29.218 align:middle line:90%
Also, if we have BPDU
filter enabled on that port,

36
01:29.218 --> 01:31.260 align:middle line:90%
that means we're also not
going to be sending out
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

36
01:29.218 --> 01:31.260 align:middle line:90%
that means we're also not
going to be sending out

37
01:31.260 --> 01:34.830 align:middle line:90%
BPDUs every two seconds,
out to an access device

38
01:34.830 --> 01:37.200 align:middle line:90%
that really has no need
to see that anyway.

39
01:37.200 --> 01:39.900 align:middle line:90%
So as a summary BPDU
filter simply reduces

40
01:39.900 --> 01:42.510 align:middle line:90%
the number of BPDU that
are sent and also ignores

41
01:42.510 --> 01:45.483 align:middle line:90%
BPDUs as they come in,
while BPDUs Guard has

42
01:45.483 --> 01:46.525 align:middle line:84%
a really strong attitude.

43
01:46.525 --> 01:49.410 align:middle line:90%
If it sees a BPDU coming
in on a port that's

44
01:49.410 --> 01:51.690 align:middle line:90%
protected with BPDU
Guard, it's going to error

45
01:51.690 --> 01:53.290 align:middle line:84%
disable the interface.

46
01:53.290 --> 01:54.660 align:middle line:84%
So here's what I propose we do.

47
01:54.660 --> 01:56.330 align:middle line:84%
I've reset these three devices.

48
01:56.330 --> 01:58.140 align:middle line:84%
So this guy is the root.

49
01:58.140 --> 02:00.080 align:middle line:90%
I have designated
port, designated port
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

49
01:58.140 --> 02:00.080 align:middle line:90%
I have designated
port, designated port

50
02:00.080 --> 02:01.470 align:middle line:84%
there and there.

51
02:01.470 --> 02:04.800 align:middle line:90%
Root ports here and here,
designated port here,

52
02:04.800 --> 02:08.620 align:middle line:90%
and then we're blocking
on switch 20/5.

53
02:08.620 --> 02:11.500 align:middle line:90%
So it's kind of a mean
trick, but let's do this.

54
02:11.500 --> 02:15.230 align:middle line:90%
Let's take 0/3, and
we'll shut it down.

55
02:15.230 --> 02:17.500 align:middle line:90%
So when we shut that down,
spanning tree on switch two

56
02:17.500 --> 02:20.150 align:middle line:90%
is going to reconverge, and
he'll start forwarding out 0/5,

57
02:20.150 --> 02:21.370 align:middle line:84%
they'll be fantastic.

58
02:21.370 --> 02:24.080 align:middle line:90%
And then while 0/3
is shut down, we'll

59
02:24.080 --> 02:27.050 align:middle line:90%
enable BPDU Guard
on the interface.

60
02:27.050 --> 02:30.620 align:middle line:90%
Which says, after you come
up, if you see a BPDU,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

60
02:27.050 --> 02:30.620 align:middle line:90%
Which says, after you come
up, if you see a BPDU,

61
02:30.620 --> 02:33.540 align:middle line:90%
go ahead and put the interface
in an error disable state.

62
02:33.540 --> 02:35.900 align:middle line:90%
So then we'll do a no
shut, let it come up,

63
02:35.900 --> 02:38.500 align:middle line:90%
and when it sees the BPDU is
coming in from the root switch,

64
02:38.500 --> 02:40.250 align:middle line:90%
even though they're
coming in this example

65
02:40.250 --> 02:43.670 align:middle line:90%
from the legitimate root switch,
because BPDU guard is enabled,

66
02:43.670 --> 02:47.737 align:middle line:90%
it'll go ahead or should go
ahead and shut down port 0/3.

67
02:47.737 --> 02:49.820 align:middle line:90%
So ideally, we'd want to
have this in a production

68
02:49.820 --> 02:52.970 align:middle line:90%
environment enabled either
specifically on the interfaces

69
02:52.970 --> 02:56.870 align:middle line:90%
or by default on the access
ports for any interfaces

70
02:56.870 --> 02:58.490 align:middle line:90%
where we don't
expect-- like clients

71
02:58.490 --> 03:01.970 align:middle line:90%
and so forth, where we don't
expect BPDUs to be coming in.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

71
02:58.490 --> 03:01.970 align:middle line:90%
and so forth, where we don't
expect BPDUs to be coming in.

72
03:01.970 --> 03:04.820 align:middle line:90%
Here on switch two, let's do a
show spanning tree for VLAN 1,

73
03:04.820 --> 03:07.811 align:middle line:90%
and currently our
root port is FA0/3,

74
03:07.811 --> 03:12.770 align:middle line:90%
we'll go to interface FA0/3, and
we'll shut that bad boy down,

75
03:12.770 --> 03:16.010 align:middle line:90%
and do show spanning
tree for VLAN 1,

76
03:16.010 --> 03:17.780 align:middle line:84%
and it is already converged.

77
03:17.780 --> 03:19.610 align:middle line:90%
Thanks to rapid spanning
tree, fantastic.

78
03:19.610 --> 03:21.980 align:middle line:84%
So FA0/3 is forwarding.

79
03:21.980 --> 03:25.340 align:middle line:90%
Now an interface
config for FA0/3,

80
03:25.340 --> 03:27.560 align:middle line:90%
let's go ahead and
enable BPDU Guard.

81
03:27.560 --> 03:32.690 align:middle line:90%
And the syntax is spanning
tree BPDU Guard enable.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

81
03:27.560 --> 03:32.690 align:middle line:90%
And the syntax is spanning
tree BPDU Guard enable.

82
03:32.690 --> 03:34.140 align:middle line:84%
And boom, it's enabled.

83
03:34.140 --> 03:40.126 align:middle line:90%
So we do a show spanning
tree for interface FA0/3,

84
03:40.126 --> 03:42.350 align:middle line:90%
and it's not running
because the port's down.

85
03:42.350 --> 03:43.558 align:middle line:84%
All right, we'll bring it up.

86
03:43.558 --> 03:49.240 align:middle line:90%
So we'll do a interface
FA0/3, no shut down.

87
03:49.240 --> 03:52.698 align:middle line:90%
All right, now we do a show
spanning tree for VLAN 1.

88
03:52.698 --> 03:53.240 align:middle line:84%
What's wrong?

89
03:53.240 --> 03:54.448 align:middle line:84%
Did I not bring that port up?

90
03:54.448 --> 03:57.170 align:middle line:90%
Let's do a show
interface status.

91
03:57.170 --> 03:58.083 align:middle line:84%
Oh, there we go.

92
03:58.083 --> 03:59.000 align:middle line:84%
It was error disabled.

93
03:59.000 --> 04:02.570 align:middle line:90%
So it just got bam,
got a BPDU and was
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

93
03:59.000 --> 04:02.570 align:middle line:90%
So it just got bam,
got a BPDU and was

94
04:02.570 --> 04:05.435 align:middle line:90%
error disabled, so it does
show interface status.

95
04:05.435 --> 04:08.210 align:middle line:84%


96
04:08.210 --> 04:09.370 align:middle line:84%
Error disabled.

97
04:09.370 --> 04:10.230 align:middle line:84%
There it shows up.

98
04:10.230 --> 04:14.750 align:middle line:90%
So FA0/3 is error disabled,
due to be BPDU Guard.

99
04:14.750 --> 04:16.820 align:middle line:90%
So if we went in and did
a shut and a no shut,

100
04:16.820 --> 04:19.898 align:middle line:90%
we'd have the same problem
because we'd get BPDUs again,

101
04:19.898 --> 04:21.690 align:middle line:90%
and then it would shut
down the port again.

102
04:21.690 --> 04:25.055 align:middle line:90%
So let's do a show run for
interface fast ethernet 0/3,

103
04:25.055 --> 04:26.240 align:middle line:84%
and let's go take it off.

104
04:26.240 --> 04:30.220 align:middle line:84%
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

104
04:26.240 --> 04:30.220 align:middle line:84%


105
04:30.220 --> 04:36.230 align:middle line:90%
And then we'll do a shut and
no shut and show spanning tree.

106
04:36.230 --> 04:36.810 align:middle line:84%
There we go.

107
04:36.810 --> 04:38.840 align:middle line:90%
So now we have Fast
Ethernet 0/3, which

108
04:38.840 --> 04:40.950 align:middle line:90%
is our root port
once again, and then

109
04:40.950 --> 04:43.610 align:middle line:90%
FA0/5, which is going
over to switch three

110
04:43.610 --> 04:45.225 align:middle line:90%
is in blocking
state, or if we want

111
04:45.225 --> 04:46.850 align:middle line:90%
to be official for
rapid spanning tree,

112
04:46.850 --> 04:48.327 align:middle line:84%
we could say it's discarded.

113
04:48.327 --> 04:49.910 align:middle line:90%
So thanks for joining
me in this video

114
04:49.910 --> 04:52.850 align:middle line:90%
as we've taken a look at how
we can use BPDU Guard to put

115
04:52.850 --> 04:54.890 align:middle line:90%
a port in error disabled
state the moment

116
04:54.890 --> 04:56.870 align:middle line:84%
it sees a BPDU coming into it.

117
04:56.870 --> 04:58.037 align:middle line:84%
I appreciate you joining me.

118
04:58.037 --> 04:59.328 align:middle line:84%
I'll see you in the next video.

119
04:59.328 --> 05:01.520 align:middle line:90%
Meanwhile, I hope this has
been informative for you,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

119
04:59.328 --> 05:01.520 align:middle line:90%
Meanwhile, I hope this has
been informative for you,

120
05:01.520 --> 05:04.810 align:middle line:90%
and I'd like to thank
you for viewing.