Karteikarten
Chapter 8: Protecting STP
Karten in diesem Stapel (31)
- 1Root GuardIf another switch advertises a superior BPDU, or one with a better bridge ID, on a port where Root Guard is enabled, the local switch will not allow the new switch to become the root.
- 2What happen when a superior BPDU is received on a port where Root Guard is enabled?The port will be kept in the root-inconsistent STP state
- 3Root-Inconsistent STP stateNo data can be sent or received in that state, but the switch can listen to BPDUs received on the port to detect a new root advertising itself.
- 4How to enable Root Guard?Switch(config-if)# spanning-tree guard root
- 5How affect the Root Guard feature in a Vlan - port?Root Guard affects the entire port so that a root bridge never can be allowed on any VLAN on the port
- 6How we can see root-inconsistent state?Switch# show spanning-tree inconsistentports
- 7BPDU Guard• Protect the integrity of switch ports that have PortFast enabled
• If any BPDU is received on a port where BPDU Guard is enabled, that port immediately is put into the ERRDISABLE state - 8How to activate BPDU Guard?• Globally
Switch(config)# spanning-tree portfast bpduguard default
• Per-port basis
Switch(config-if)# [ no] spanning-tree bpduguard enable - 9When to use BPDU Guard?• You should use BPDU Guard on all switch ports where STP PortFast is enabled
• On access layer switch ports - 10What could happen if Ethernet hub is connected to the PortFast port?BPDU Guard does not prevent a bridging loop from forming if an Ethernet hub is connected to the PortFast port. Because a hub does not transmit BPDUs itself.
A loop could form if the hub became connected to two locations in the network - 11Name two STP features that help detect or prevent the unexpected loss of BPDUs■ Loop Guard
■ Unidirectional Link Detection (UDLD) - 12How works Loop Guard feature?When enabled, Loop Guard keeps track of the BPDU activity on non designated ports. While BPDUs are received, the port is allowed to behave normally. When BPDUs go missing, Loop Guard moves the port into the loop-inconsistent state
- 13What happen when BPDUs are receiving again?Loop Guard allows the port to move through the normal STP states and become active
- 14How to enable Loop Guard?• As a global default
Switch(config)# spanning-tree loopguard default
• On a specific switch port
Switch(config-if)# [ no ] spanning-tree guard loop - 15Loop Guard per-port basisAlthough Loop Guard is configured on a switch port, its corrective blocking action is taken on a per-VLAN basis
- 16Where enable Loop Guard?The switch figures out which ports are nondesignated and monitors the BPDU activity to keep them nondesignated.
- 17When to use Loop Guard?In F.O connections, because only the Rx can fail.
- 18UDLD STP feature• Monitors a port to see whether the link is truly bidirectional
• Sends special Layer 2 UDLD frames identifying its switch port at regular intervals. UDLD expects the far-end switch to echo those frames back across the same link, with the far-end switch port’s identification added. - 19What message interval timers UDLD uses?• The default is 15 seconds
• UDLD can detect a unidirectional link after about three times the UDLD message interval. 45 seconds total, using the default
*The objective is detect a unidirectional link condition before STP has time to move a blocked port into the Forwarding state - 20UDLD has two modes of operation■ Normal mode
■ Aggressive mode - 21Normal mode• Port is allowed to continue its operation
• UDLD merely marks the port as having an undetermined state and generates a syslog message. - 22Aggressive mode• The switch takes action to reestablish the link. UDLD messages are sent out once a second for 8 seconds. If none of those messages is echoed back, the port is placed in the errdisable state so that it cannot be used.
- 23How to config UDLD?• Per-port basis
• You can enable it globally for all fiber optic switch ports
• By default, UDLD is disabled on all switch ports - 24To enable it globallySwitch(config)# udld { enable | aggressive | message time 'seconds' }
• For normal mode, use ENABLE keyword
• For aggressive mode, use AGGRESSIVE
• Message time, to set interval to seconds, ranging from 1 to 90 sec. The def is 7 sec. - 25To enable in individual switch portsSwitch(config-if)# udld { enable | aggressive | disable }
* Disable keyword to completely disable UDLD on a fiber-optic interface. - 26What happen if Message interval differ?• The default UDLD message interval times differ among Catalyst switch
• Although two neighbors might have mismatched message time values, UDLD still works correctly. - 27How to enable an errdisable state originated by aggressive mode?Switch# udld reset
*all ports errdisabled - 28BPDU filteringYou always should allow STP to run on a switch to prevent loops. However, in special cases when you need to prevent BPDUs from being sent or processed on one or more switch ports, you can use BPDU filtering to effectively disable STP on those ports.
- 29How to configure BPDU filtering? (global)• Global default
Switch(config)# spanning-tree portfast bpdufilter default
*The default keyword indicates that BPDU filtering will be enabled automatically on all ports that have PortFast enabled - 30How to configure BPDU filtering? (per-port)Switch(config-if)# spanning-tree bpdufilter { enable | disable }
* Enable BPDU filtering only under controlled circumstances in which
you are absolutely sure that a switch port will have a single host connected and that a loop will be impossible. - 31Troubleshooting STP Protection
Informationen
- Beschreibung
- 300-115 CCNP SWITCH 300-115 (Part III: Working with Redundant Links) Karteikarten am Chapter 8: Protecting STP, erstellt von Luis Domínguez am 26/04/2018.
- Erstellt von
- Luis Domínguez · Apr 2018
- Aktualisiert
- 30 Apr 2018
- Aufrufe
- 0
- Bewertung