spanning tree bpdu guard command

I'm having this issue where I have a P2P link between two sites. The moment I would unplug cable from the existing port on one side to another port (say in a router), what happens is that the ISP switch detects a change in MAC address at their end and consequently disables their port (as per them, its a security measure). This is annoying as I can't even do my testing. What I have done is that currently one end of the link terminates into a Cisco Gigbit switch 2960 G. I've enabled BPDU guard command and it works fine. Now, i want to terminate this into an HWIC-4ESW card on a 2800 series router. Can I issue the same command on my router's int f0/0/0 so that it stops sending any BPDUs to the ISP switch, otherwise ISP is going to shut down the port at their end and I loose connectivity.

Given below is the current config of the switchport for bpdu. Can I do anything like this on HWIC-4ESW interface of the router so that it stops sending any BPDUs ?

LANSwitch1#sh running-config interface gigabitEthernet 0/20
Building configuration...

Current configuration : 133 bytes
!
interface GigabitEthernet0/20
 description CrossConnect-AAPT
 spanning-tree bpdufilter enable
 spanning-tree bpduguard enable
end

nabeel92Asked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Don JohnstonInstructorCommented:
>what happens is that the ISP switch detects a change in MAC address at their end and consequently disables their port

>Can I issue the same command on my router's int f0/0/0 so that it stops sending any BPDUs to the ISP switch, otherwise ISP is going to shut down the port at their end and I loose connectivity.

First off, BPDU guard makes your port shutdown if it sees a BPDU. BPDU filter is how you stop a BPDU from being transmitted. Second, this doesn't have anything to do with Spanning Tree. What you need to do is prevent a different MAC address from showing up at the ISP.

What you can do is change the MAC address of the router interface to that of the device that the ISP has currently registered.

mac-address xxxx.xxxx.xxxx

The only catch is that the device with that MAC address cannot be on the same network as router interface.
0
nabeel92Author Commented:
Thanks for clarifying the concept !

The only catch is that the device with that MAC address cannot be on the same network as router interface >> They both are on the same network but I think If i shut down that original switchport (whose MAC address is registered with ISP) and use that MAC instead on the router interface, then I think i wont be running into any problem ?
0
Don JohnstonInstructorCommented:
Switches (layer 2) do not use the MAC address of an interface when they create frames. They use the "base mac address" (an address assigned to the chassis).

If your ISP is locking you down to one specific MAC address, connecting a switch to the provider is problematic since any MAC address received by the switch could go to the ISP interface.

If you could provide a bit more information about your network topology and what you're trying to accomplish it would allow me to suggest the best solution.
0
Big Business Goals? Which KPIs Will Help You

The most successful MSPs rely on metrics – known as key performance indicators (KPIs) – for making informed decisions that help their businesses thrive, rather than just survive. This eBook provides an overview of the most important KPIs used by top MSPs.

nabeel92Author Commented:
Site 1 Rtr ------- ISP Switch ------- LAN Switch (My switch on site 2) ------- Site 2 Router

Basically what's happening is that when i terminate this cross connect between the two sites into this LAN switch, that switchport doesn't detect any settings and changes to its default of 100 mb/half duplex. Previously, It used to go directly into the router and worked in Full Duplex. That's why I want to make the change.

I was working at it the other day. ISP switch connection was plugged into LAn switch port # 20. The moment I unplugged it from there and plugged it into switch port # 19, the port went off. I then had to call their WAN Support who confirmed that port is disabled due to the change in MAC. Later, they shut/noshut it to bring it back up. I played around couple of more time but same thing happened that change in port would result in port getting shutdown. So i guess they maybe looking at the individual port MAC and not the chassis MAC address ?
Now, I'm thinking to terminate the cable from ISP switch directly into the router and shutdown the switchport. For that, do I need to change the router's interface MAC address to that of Switchport 0/20 ?
0
Don JohnstonInstructorCommented:
Why connect the ISP switch to your switch at Site 2? Connect it directly to the router like you have at Site 1.
0
nabeel92Author Commented:
Exactly ...
Reason is because there were not enough spare ports available on Router 1 .. Now i have put in a second HWIC-4ESW card so I dont have to terminate into the switch. But when i tried to do it last time, the MAC detection features at ISP blocked the link.
0
Don JohnstonInstructorCommented:
Ahhh... Okay. Then here's what you need to do. Because you can only have one MAC address show up at the ISP device, you'll need to create a VLAN for that connection. And turn off any traffic that would be sourced by the switch. Then create a trunk to the router for all the other devices.


Switch:
vlan 10
 name internet
vlan 20
 name office
int range g0/1 -22
 switchport mode access
 switchport access vlan 20
int g0/23
 description Link to Router
 switchport mode trunk
int g0/24
 description Link to ISP
 switchport mode access
 switchport access vlan 10
 no cdp enable
 spanning-tree portfast
 spanning-tree bpdu-filter
 
Router
int f0/0.10
 encap dot1q 10
 ip address 192.168.10.1 255.255.255.0
int f0/0.20
 encap dot1q 20
 ip address 192.168.20.1 255.255.255.0
 

Open in new window

0
nabeel92Author Commented:
Ok, given below is the status of the switchport which is half duplex.

Port        Name                           Status          Vlan       Duplex  Speed Type
Gi0/20    CrossConnect-AAPT  connected    1             a-half   a-100 10/100/1000BaseTX

LANSwitch1#sh running-config interface gigabitEthernet 0/20
Building configuration...

Current configuration : 133 bytes
!
interface GigabitEthernet0/20
 description CrossConnect-AAPT
 spanning-tree bpdufilter enable
 spanning-tree bpduguard enable
end

I can see the trunk link between router and switch, that bit is fine.

On the router, I've already configured

r2_core#sh running-config interface gigabitEthernet 0/0.1
Building configuration...

Current configuration : 108 bytes
!
interface GigabitEthernet0/0.1
 encapsulation dot1Q 1 native
 ip address 172.16.0.66 255.255.255.248
end

I'm using vlan 1 between the two links. Do I need to it or is it fine ?

The only difference I see is that I change the port type on interface gig 0/20 to access and that's it ?
0
nabeel92Author Commented:
Just making sure if this is what I'll do before I make this change on live environment right now ;)
0
Don JohnstonInstructorCommented:
The link to the ISP has to be in a different VLAN than everything else on the switch. You also have to disable CDP.
0
nabeel92Author Commented:
Ok, then ill use vlan 5 which is not being used and see how it goes ! I'll just update u ...
0
nabeel92Author Commented:
just tried it but no luck !
assigned gig 0/20 to vlan 19 (not used anywhere in the network). config for port is given below

interface GigabitEthernet0/20
 description CrossConnect-AAPT
 switchport access vlan 19
 switchport mode access
 no cdp enable
 spanning-tree bpdufilter enable
 spanning-tree bpduguard enable
end

On the router, I defined

interface GigabitEthernet0/0.19
 encapsulation dot1Q 19
 ip address 172.16.0.66 255.255.255.248
end

Trunk is already established between the router and the switch !
0
nabeel92Author Commented:
But that's fine since I plan to terminate this into the router directly. In that case, could you just confirm me if I just need to change the MAC of the router port to that of switchport gig 0/20 and it would be fine ?
0
Don JohnstonInstructorCommented:
>just tried it but no luck !

What doesn't work?

Are you sure the trunk to the router is established? "show int trunk"

If you know the MAC address that the ISP currently has registered, you can change the router MAC "mac-address xxxx.xxxx.xxxx".

But I would have the ISP clear their table and let it learn the MAC of the router.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
nabeel92Author Commented:
The switchport was still operating in half duplex mode when i tried the suggested configuration. The trunk is established. Given below is the output of show interface trunk. Trunk with my router is on interface gig 0/23.

LANSwitch1#sh interfaces trunk

Port        Mode         Encapsulation  Status        Native vlan
Gi0/5       on           802.1q         trunking      1
Gi0/22      on           802.1q         trunking      1
Gi0/23      on           802.1q         trunking      1
Gi0/24      on           802.1q         trunking      1

Port        Vlans allowed on trunk
Gi0/5       1-4094
Gi0/22      1-4094
Gi0/23      1-4094
Gi0/24      1-4094

Port        Vlans allowed and active in management domain
Gi0/5       1,19,100,140,160,180,190
Gi0/22      1,19,100,140,160,180,190
Gi0/23      1,19,100,140,160,180,190
Gi0/24      1,19,100,140,160,180,190

Port        Vlans in spanning tree forwarding state and not pruned
Gi0/5       1,19,100,140,160,180,190
Gi0/22      1,19,100,140,160,180,190
Gi0/23      1,19,100,140,160,180,190
Gi0/24      140
LANSwitch1#
0
Don JohnstonInstructorCommented:
Which interface is connected to the router?
0
nabeel92Author Commented:
interface gig 0/23
0
Don JohnstonInstructorCommented:
So everything works now?
0
nabeel92Author Commented:
well, everything was already working. I was under the impression that the configuration you suggested was to make the switchport gig 0/20 (from ISP switch to LAN Switch) work in full duplex mode as it's been working in half duplex.  Anyhow, since this didnt change the port to full duplex so I will at some time later terminate the ISP switch cable directly into the router (after changing the MAC address of the router port) and hopefully will get full duplex link between ISP and my router.
Sorry, if there was any confusion from my end thru my words.
0
nabeel92Author Commented:
Simply excellent !
0
Don JohnstonInstructorCommented:
You'll only be able to get the link at full duplex if ISP equipment supports full duplex.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Routers

From novice to tech pro — start learning today.