CloudLabBox
Try the free demo

CCNP ENCOR lab 7 of 36

Spanning-tree protection: BPDU guard, root guard and loop guard

A rogue switch has taken over as root bridge of the staff VLAN. Find it, then protect Fernhill's access layer with PortFast and BPDU guard on user ports, root guard towards a test-bench switch, loop guard on uplinks and automatic err-disable recovery.

Run this lab

It needs Lite: its 5 nodes are set to 5 vCPU and 4,096 MB in total. That fits the free demo too.

In your workspace: Shared, then CCNP ENCOR 350-401 guided labs, then 07 - Spanning-tree protection - BPDU guard root guard and loop guard

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Intermediate
Time
About 55 minutes
Nodes need
5 vCPU, 4,096 MB
Smallest plan
Lite

The scenario

Fernhill Freight's warehouse office reports short network freezes whenever somebody moves a desk. Two things are plugged into access switch ASW1 that shouldn't be trusted:

  • a small switch that someone connected to the desk socket on Gi1/1, and
  • the IT test-bench switch on Gi1/2, which legitimately needs a trunk, but whose owner likes experimenting with spanning-tree priorities.

Both are played by ROGUE, which is configured with priority 0 for every VLAN. The design says DSW1 is root for VLANs 10 and 99 and DSW2 is the backup root. Your job: prove what's wrong, then make sure no device at the edge can ever take over the topology again.

DevicePortRole
DSW1Gi0/0, Gi0/1trunks to DSW2 and ASW1; root (24576); Vlan10 10.10.10.2
DSW2Gi0/0, Gi0/1trunks to DSW1 and ASW1; backup root (28672)
ASW1Gi0/1, Gi0/2uplinks to DSW1, DSW2
ASW1Gi1/0PC1 (VLAN 10), 10.10.10.10
ASW1Gi1/1desk socket (VLAN 10): ROGUE Gi0/0
ASW1Gi1/2trunk to the test bench: ROGUE Gi0/1

Topology: DSW1 and DSW2 linked; ASW1 has an uplink to each; PC1 and two ROGUE links hang off ASW1.

What you’ll practise

  • Identify an unexpected root bridge from spanning-tree output
  • Protect edge ports with PortFast and BPDU guard, and explain BPDU filter's risks
  • Stop a downstream switch becoming root with root guard
  • Protect alternate and root ports against unidirectional failures with loop guard
  • Read err-disabled and root-inconsistent states and configure err-disable recovery

The tasks

  1. Find the real root
  2. Lock down the user ports with BPDU guard
  3. Recover err-disabled ports automatically
  4. Keep the test bench below the distribution switches
  5. Protect the uplinks with loop guard
  6. Confirm the user experience

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Spanning-tree protection - BPDU guard root guard and loop guard5 nodes, 6 links. Every link is listed as text below the diagram.DSW1DSW2ASW1ROGUEPC1Gi1/0eth0Gi0/1Gi0/1Gi0/1Gi0/2Gi1/1Gi0/0Gi1/2Gi0/1Gi0/0Gi0/0
5 nodes, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • DSW1 Gi0/0 to DSW2 Gi0/0
  • DSW1 Gi0/1 to ASW1 Gi0/1
  • DSW2 Gi0/1 to ASW1 Gi0/2
  • ASW1 Gi1/0 to PC1 eth0
  • ASW1 Gi1/1 to ROGUE Gi0/0
  • ASW1 Gi1/2 to ROGUE Gi0/1
Nodes in Spanning-tree protection: BPDU guard, root guard and loop guard, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
DSW1Cisco IOSvL2viosl2-adventerprisek9-m.ssa.high_iron_202009291 vCPU, 768 MB
DSW2Cisco IOSvL2viosl2-adventerprisek9-m.ssa.high_iron_202009291 vCPU, 768 MB
ASW1Cisco IOSvL2viosl2-adventerprisek9-m.ssa.high_iron_202009291 vCPU, 768 MB
ROGUECisco IOSvL2viosl2-adventerprisek9-m.ssa.high_iron_202009291 vCPU, 768 MB
PC1VPCS hostBuilt in to EVE-NGCounted as 1 vCPU, 1,024 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder CCNP ENCOR 350-401 guided labs.

  3. Open 07 - Spanning-tree protection - BPDU guard root guard and loop guard and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More CCNP ENCOR labs

All CCNP ENCOR labs

CloudLabBox is independent of Cisco. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.