All language subtitles for 1. BPDU Guard Part 1

BP.

God is one of multiple security mechanisms available in spanning tree.

To protect your spending tree network.

This could be something as simple as a user connecting a cheap consumers switch to your network that

doesn't support spending tree and hence causing a loop or something malicious such as an attacker plugging

in a switch and making that switch the root of the spanning tree so that the attacker can analyze your

network traffic that traverses that switch or it could be an attacker simply connecting a switch to

your topology lowering the priority and degrading the performance of your network considerably by forcing

the network traffic to go through a low performance switch.

So one of the options you have to stop this is BP to you God which will disable a port if any BP to

use all received on that port.

This is useful on ports that are going to be used as access ports and that should never be connected

to another switch.

In other words ports that are going to be configured as Port Foss ports they are two ways to configure

BP to you God.

You can either do it on a per interface basis or configure it globally on a switch on a per port basis

you would type spending three port first and then spanning tree BP to you.

God enable or globally on the switch you can use the command spanning tree port Foster default so in

this topology let's assume that this hub shouldn't be connected to the network and will enable BP God

on switch 2 and switch 3 because we shouldn't be receiving BP to use on any of these ports.

These ports should be connected to user pieces rather than a hub

so committee spending 3 port fast edge PPD you

got we have globally enabled PPD you God on switch to at the moment port gigabit 0 1 is not enabled

for Port Fost and we can see that by using the command tro spanning tree interface interface gigabit

0 1 port fast so it's disabled but known gigabit 0 1 lets type spending 23 port fast

notice very quickly BP you God warns us that if BP to you is received on this port and the port has

been disabled so BP to you God.

Error detected on this port Port is placed in the error disabled state port has gone down so show interface

gigabit 0 1 interfaces down line protocol is down because the port was error disabled shows spending

23 notice the port is not shown in the output here if we look at gigabit 0 1 port fast we can see that

no spending tree information is available in this port because the port has been error disabled shows

spanning tree inconsistent ports

show spanning tree summary we can see that the switch is using rapid PBS tea and we can see that port

Frost edge.

BPT you guard default has enabled so I'll shut that port down and then no shut it and let's see what

happens again so no shut it and notice immediately.

The port is error disabled so do show run interface gigabit.

0 1.

We need to remove this port Fost command so no spanning tree.

Port fast

and do show run interface gigabit 0 1 We've now removed port fast so shut the port down.

And no shut it notice the port has come up shows banning tree blocked ports gigabit 0 1 is now being

blocked because that port is an alternate port on this segment the designated port is gigabit 0 1 on

switch 3 and we can see that by tapping shows spanning tree.

Notice gigabit 0 1 is the designated port on the segment.

This is a hub.

Please note.

So this is the designated port for this segment.

This port gigabit 0 1 is blocking on switch to so these ports should have been connected to pieces.

But if a user connected a hub or someone tried to do something malicious BBDO guard blocks the ports

immediately.

Now we can configure this on a per port basis so let's do that on gigabit 0 2 spanning tree people to

you PPD God in April

noticed immediately a PPD was received on the Port.

Port goes to the disable mode so if you enable it on an interface the port doesn't even need to be configured

as a port first port.

When a BP to use received on the port it immediately error disables so do show interface gigabit 0 2

notice the port is down it's error disabled.