© 2015 Mohamed Samir YouTube channel All rights reserved. Samir CCNP-SWITCHING Mohamed Samir YouTube channel Double CCIEs #27042(R/S&SP)

© 2015 Mohamed Samir YouTube channel All rights reserved. Samir Part III Working with Redundant Links

© 2015 Mohamed Samir YouTube channel All rights reserved. Samir Protecting the Spanning Tree Protocol Topology

© 2015 Mohamed Samir YouTube channel All rights reserved. Samir Protecting Against Unexpected BPDUs Root port:closest to the root Blocking port:neither root nor designated ports Alternate port:These ports are identified for quick use by the STP UplinkFast feature. Forwarding port:hese are ports with normal end-user connections Root Gurad:superior BPDU or one with a better bridge ID Switch(config-if)# spanning-tree guard root Verification: – Switch# show spanning-tree inconsistentports

© 2015 Mohamed Samir YouTube channel All rights reserved. Samir BPDU Guard Enabling PortFast on a port is not the same as disabling the STP on it. Switch(config)# spanning-tree portfast bpduguard default It can not prevent a hub or another switch not configuring STP

© 2015 Mohamed Samir YouTube channel All rights reserved. Samir Protecting Against Sudden Loss of BPDUs Loop Guard Unidirectional Link Detection (UDLD)

© 2015 Mohamed Samir YouTube channel All rights reserved. Samir Loop Guard When the loop guard blocks an inconsistent port, this message is logged: CatOS %SPANTREE-2-LOOPGUARDBLOCK: No BPDUs were received on port 3/2 in vlan 3. Moved to loop-inconsistent state. Cisco IOS %SPANTREE-2-LOOPGUARD_BLOCK: Loop guard blocking port FastEthernet0/24 on VLAN0050. Once the BPDU is received on a port in a loop-inconsistent STP state, the port transitions into another STP state. According to the received BPDU, this means that the recovery is automatic and intervention is not necessary. After recovery, this message is logged: CatOS %SPANTREE-2-LOOPGUARDUNBLOCK: port 3/2 restored in vlan 3. Cisco IOS %SPANTREE-2-LOOPGUARD_UNBLOCK: Loop guard unblocking port FastEthernet0/24 on VLAN0050. Switch(config)# spanning-tree loopguard default

© 2015 Mohamed Samir YouTube channel All rights reserved. Samir UDLD switch sends special Layer 2 UDLD frames identifying its switch port at regular intervals This requires both ends of the link to be configured for UDLD. The default is 15 seconds < max age time + 2 forward delay UDLD has two modes of operation: Normal mode: UDLD merely marks the port as having an undetermined state and generates a syslog message. Aggressive mode: UDLD messages are sent out once a second for 8 seconds. If none of those messages is echoed back, the port is placed in the errdisable state The switch globally enables UDLD only on ports that use fiber- optic media.

© 2015 Mohamed Samir YouTube channel All rights reserved. Samir Using BPDU Filtering to Disable STP on a Port Switch(config)# spanning-tree portfast bpdufilter default Switch(config-if)# spanning-tree bpdufilter {enable | disable}

© 2015 Mohamed Samir YouTube channel All rights reserved. Samir Any questions ?

© 2015 Mohamed Samir YouTube channel All rights reserved. Samir Thank you for your time ! شكرا جزاكم الله خير