CloudLabBox
Try the free demo

CCNA lab 13 of 46

Protecting spanning tree with PortFast and the STP guards

Someone has plugged a switch into a desk port and it wants to be root. Watch it hijack the spanning tree, then stop it with root guard and BPDU guard, speed up host ports with PortFast, and add loop guard and (carefully) BPDU filter.

Run this lab

It needs Lite: its 6 nodes are set to 6 vCPU and 6,144 MB in total. That fits the free demo too.

In your workspace: Shared, then CCNA 200-301 guided labs, then 13 - Protecting spanning tree with PortFast and the STP guards

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Intermediate
Time
About 55 minutes
Nodes need
6 vCPU, 6,144 MB
Smallest plan
Lite

The scenario

At Fenwick Solicitors, a trainee brought in a small switch to get more ports at their desk and plugged it into desk port ASW1 Gi1/1. That switch (ROGUE) has a bridge priority of 0 for VLAN 10, so it will try to become the root of the whole network. You'll see what that does, then lock the access layer down so it can't happen again.

DevicePortRole
DSW1Gi0/0, Gi0/1trunks to ASW1 and ASW2; SVI VLAN 10 10.13.10.1/24; intended root (4096)
ASW1Gi0/0 to DSW1, Gi0/1 to ASW2; Gi1/0 PC1; Gi1/1 desk portaccess switch
ASW2Gi0/0 to DSW1, Gi0/1 to ASW1; Gi1/0 PC2access switch
ROGUEGi0/0 to ASW1 Gi1/1 (starts shut down = unplugged)rogue switch, priority 0
PC1, PC2VLAN 1010.13.10.11, 10.13.10.12

"Plugging in" the rogue switch means no shutdown on ROGUE Gi0/0; "unplugging" it means shutdown.

What you’ll practise

  • Configure PortFast on host ports and explain edge ports
  • See a rogue switch take over as root and contain it with root guard
  • Err-disable a rogue switch port with BPDU guard and recover the port
  • Explain and enable loop guard
  • Explain BPDU filter and why it is dangerous on an interface

The tasks

  1. Make host ports edge ports with PortFast
  2. See the rogue switch take over
  3. Contain it with root guard
  4. Shut it out with BPDU guard
  5. Know BPDU filter (and why to avoid it)
  6. Add loop guard
  7. Protect the distribution layer

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Protecting spanning tree with PortFast and the STP guards6 nodes, 6 links. Every link is listed as text below the diagram.DSW1ASW1ASW2ROGUEPC1PC2Gi1/0eth0Gi1/0eth0Gi1/1Gi0/0Gi0/0Gi0/0Gi0/1Gi0/0Gi0/1Gi0/1
6 nodes, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • DSW1 Gi0/0 to ASW1 Gi0/0
  • DSW1 Gi0/1 to ASW2 Gi0/0
  • ASW1 Gi0/1 to ASW2 Gi0/1
  • ASW1 Gi1/0 to PC1 eth0
  • ASW1 Gi1/1 to ROGUE Gi0/0
  • ASW2 Gi1/0 to PC2 eth0
Nodes in Protecting spanning tree with PortFast and the STP guards, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
DSW1Cisco IOSvL2viosl2-adventerprisek9-m.ssa.high_iron_202009291 vCPU, 1,024 MB
ASW1Cisco IOSvL2viosl2-adventerprisek9-m.ssa.high_iron_202009291 vCPU, 1,024 MB
ASW2Cisco IOSvL2viosl2-adventerprisek9-m.ssa.high_iron_202009291 vCPU, 1,024 MB
ROGUECisco IOSvL2viosl2-adventerprisek9-m.ssa.high_iron_202009291 vCPU, 1,024 MB
PC1VPCS hostBuilt in to EVE-NGCounted as 1 vCPU, 1,024 MB
PC2VPCS hostBuilt in to EVE-NGCounted as 1 vCPU, 1,024 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder CCNA 200-301 guided labs.

  3. Open 13 - Protecting spanning tree with PortFast and the STP guards and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More CCNA labs

All CCNA labs

Related labs in other courses

CloudLabBox is independent of Cisco. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.