Lab 9.1: Layer 2 STP Protection Lab

Lab Overview

This lab demonstrates how to protect a switched enterprise network from rogue devices, root bridge manipulation, and Layer 2 forwarding loops by combining PortFast, BPDU Guard, Root Guard, and Loop Guard.

Lab Goal: Build a secure STP design where access ports are protected from unauthorized switches, downstream switches cannot become the root bridge, and redundant links remain safe if BPDUs stop arriving.

Skills Covered
PortFast
BPDU Guard
Errdisable Recovery
Root Guard
Loop Guard

Estimated Time
60–90 minutes

Difficulty
Intermediate to Advanced

Important Note
Do not enable BPDU Guard on trunk/uplink ports.

Network Topology

Use the provided topology image for the lab.

Interface Mapping:
SW1 ↔ SW2 : G0/1
SW2 ↔ SW3 : G0/2
SW1 ↔ PC : G1/0
SW2 ↔ Rogue Switch : G1/0
SW3 ↔ SW4 : G1/1
SW3 ↔ SW5 : G1/2

Lab Objectives

Configure PortFast on access ports
Enable BPDU Guard globally and per-interface
Verify err-disabled behavior when a rogue switch sends BPDUs
Configure errdisable recovery for BPDU Guard
Apply Root Guard on downstream switch-facing ports
Verify root-inconsistent state when a superior BPDU is received
Configure Loop Guard on redundant STP links
Simulate BPDU loss and observe loop-inconsistent behavior

Step-by-Step Configuration

Interface Plan Used in This Lab:
SW1 G0/1 ↔ SW2 G0/1
SW2 G0/2 ↔ SW3 G0/2
SW1 G1/0 ↔ PC1
SW2 G1/0 ↔ Rogue Switch
SW3 G1/1 ↔ SW4
SW3 G1/2 ↔ SW5

Part 1: STP Edge Port Protection

! On SW1 - access port toward PC1
conf t
interface g1/0
 description User Access Port - PC1
 switchport mode access
 spanning-tree portfast
 spanning-tree bpduguard enable
 exit

! Optional global BPDU Guard on all PortFast ports
spanning-tree portfast bpduguard default

! Enable errdisable recovery for BPDU Guard
errdisable recovery cause bpduguard
errdisable recovery interval 300
end

Part 2: BPDU Protection

! On SW2 - switch-facing public ports
conf t
interface g1/0
 description Research
 spanning-tree bpduguard enable
 exit
 
 ! Enable errdisable recovery for BPDU Guard
errdisable recovery cause bpduguard
errdisable recovery interval 300

Part 3: STP Topology Protection

! On SW3 - downstream switch-facing ports
conf t
interface g1/1
 description Link to SW4
 switchport mode trunk
 spanning-tree guard root
 exit

interface g1/2
 description Link to SW5
 switchport mode trunk
 spanning-tree guard loop
 exit

! Optional global loop guard
spanning-tree loopguard default
end

Suggested Test Actions

! Test BPDU Guard
- Connect an unauthorized switch to SW2 G1/0
- Confirm the port transitions to err-disabled

! Test Root Guard
- Configure the downstream switch to advertise a superior bridge priority
- Confirm the port enters root-inconsistent state

! Test Loop Guard
- Stop or filter BPDUs on the redundant link
- Confirm the port enters loop-inconsistent state

Verification Checklist

Check	Command	Expected Result
PortFast enabled	`show spanning-tree interface g1/0 detail`	Interface shows PortFast mode
BPDU Guard active	`show spanning-tree interface g1/0 detail`	BPDU Guard enabled on access port
Err-disabled port	`show interfaces status err-disabled`	Port listed due to BPDU Guard violation
Errdisable recovery	`show errdisable recovery`	bpduguard recovery enabled
Root Guard status	`show spanning-tree inconsistentports`	Port shown as root-inconsistent
Loop Guard status	`show spanning-tree inconsistentports`	Port shown as loop-inconsistent
STP details	`show spanning-tree vlan 1`	Root bridge and port roles verified

Troubleshooting Guide

Problem: Port goes err-disabled immediately
Cause: BPDU Guard received a BPDU on an access/PortFast port
Fix: Remove the rogue switch, then use errdisable recovery or manually shut/no shut the port

Problem: Downstream switch cannot become root
Cause: Root Guard is blocking superior BPDUs
Fix: Verify Root Guard is only placed on the correct downstream-facing ports

Problem: Redundant link stuck in inconsistent state
Cause: BPDUs are not being received consistently
Fix: Check cabling, STP path, and confirm Loop Guard is appropriate for the interface

Problem: Port does not recover automatically
Cause: Errdisable recovery timer not configured or not expired yet
Fix: Verify errdisable recovery cause bpduguard and the timer value

Best Practice: Use BPDU Guard on edge ports, Root Guard on downstream switch-facing ports, and Loop Guard on redundant STP links. Do not enable Loop Guard on PortFast access ports.

Short Student Summary

This lab shows how to secure STP at the edge and in the core: PortFast + BPDU Guard protects user ports, Root Guard prevents unwanted root bridge changes, and Loop Guard protects redundant links when BPDUs stop arriving.

🔐 Access Denied