|
0:00:12
|
In our next section here we're going to look at some more of the advanced spanning tree features.
|
|
0:00:17
|
The first of which is the BPDU filter feature that is used to either
|
|
0:00:23
|
drop spanning tree packets as they come in an interface or drop spanning tree packets as they go out an interface.
|
|
0:00:30
|
So this command can be configured either at the link level or in global config, which in either case
|
|
0:00:37
|
it is the same effect as disabling spanning tree on a per interface basis
|
|
0:00:42
|
of if we configure it globally, essentially disabling it on every interface.
|
|
0:00:48
|
So this typically would be used at the access layer
|
|
0:00:52
|
down towards the end hosts so that we are not sending them information about the root bridges in our topology.
|
|
0:01:00
|
The reason that we would potentially want to do this is that if someone is trying to do some sort of attack on spanning tree
|
|
0:01:06
|
maybe a Layer 2 man in the middle attack or some sort of Layer 2 denial service attack, we don't want to give them the information
|
|
0:01:14
|
about who is the current root bridge, what is their MAC address, and what are the priority values that they have assigned.
|
|
0:01:22
|
So if the end host learns this information they could potentially craft malformed spanning tree packets
|
|
0:01:27
|
to advertise alternate paths to the root bridge.
|
|
0:01:32
|
So implementation wise the feature is very straightforward.
|
|
0:01:36
|
We could go to the interface level and let's say that we do this on switch one's link to router three.
|
|
0:01:46
|
In this case router three is...or not on router three. Let's look at the diagram. This would be on
|
|
0:01:55
|
switch one's link to router five.
|
|
0:01:59
|
So router five is on FastEthernet zero slash five. It's configured in VLAN 30.
|
|
0:02:06
|
At this point if we look at the show spanning tree interface FastEthernet zero slash five,
|
|
0:02:13
|
we see that this is considered an edge port
|
|
0:02:17
|
because we currently have portfast running in global config.
|
|
0:02:22
|
So if we show run include spanning tree,
|
|
0:02:27
|
we see the global command spanning tree portfast default. So for now I'm going to remove this.
|
|
0:02:34
|
Okay, we're not running spanning tree portfast by default on all of the interfaces now.
|
|
0:02:39
|
So if on
|
|
0:02:41
|
switch one we look at the show spanning tree interface FastEthernet zero slash five
|
|
0:02:48
|
notice the change is that FastEthernet five is no longer an edge port.
|
|
0:02:51
|
It's a normal point to point link that is running spanning tree.
|
|
0:02:55
|
This means that switch one should be sending BPDUs out this interface.
|
|
0:03:02
|
We see it says up to this point 8191 BPDUs have been sent out.
|
|
0:03:09
|
If we check this again, 8197, so we could tell we are sending BPDUs out the interface.
|
|
0:03:17
|
At this link level then, if we were to say spanning tree BPDU filter enable, then we will stop sending BPDUs.
|
|
0:03:28
|
So we can think of this as kind of like the passive interface command for spanning tree.
|
|
0:03:33
|
If we clear the interface counters then look at the show spanning tree for the interface detail
|
|
0:03:43
|
we should see...Or let's see, is there a clear spanning tree counters? Yes.
|
|
0:03:50
|
So now let's look at show spanning tree interface FastEthernet five detail and I just want to see the BPDUs.
|
|
0:04:00
|
Right now we're not sending any BPDUs. We have not received any BPDUs.
|
|
0:04:04
|
Okay, this is again when we have this configured at the link level.
|
|
0:04:09
|
Now the disadvantage of this is that if the device on the other end does start to run spanning tree,
|
|
0:04:16
|
so if we go to router five and say bridge one protocol IEEE, then at the link level bridge group one
|
|
0:04:26
|
and on router five we look at the show spanning tree one,
|
|
0:04:31
|
we should see that we will send BPDUs once we
|
|
0:04:41
|
move into the forwarding state so it's going to take us 30 seconds to do this based on the default timers.
|
|
0:04:48
|
Now we see that we are sending BPDUs. On the other end of the link on switch one,
|
|
0:04:55
|
when we look at the counters for the interface, it says that we're not receiving these.
|
|
0:05:01
|
Technically we are. If we were to look at some sort of Layer 1 packet capture on the link between router five and switch one,
|
|
0:05:08
|
router five is sending the BPDUs but switch one is filtering them out.
|
|
0:05:14
|
You could potentially run into a case where there would then be a spanning tree loop
|
|
0:05:19
|
if you had multiple links going to the same portion of the network where the BPDU filter feature was configured.
|
|
0:05:28
|
So assuming that this is going to a portion of the network that is not running spanning tree,
|
|
0:05:34
|
and does not have multiple connections to the switches, then it should be fine.
|
|
0:05:39
|
Likewise this feature also can be configured globally in which case it's going to be a little bit
|
|
0:05:47
|
easier to control whether the BPDU filter should be on or off.
|
|
0:05:54
|
Next on router five let's remove the bridge group from the interface.
|
|
0:05:59
|
So now we are no longer running spanning tree.
|
|
0:06:03
|
On switch one I removed the BPDU filter from the interface level.
|
|
0:06:09
|
If we look at the detailed output we should see now that we are sending BPDUs.
|
|
0:06:18
|
Okay, we're not going to receive them anymore because router five disabled it's spanning tree process
|
|
0:06:25
|
but at least we are sending them.
|
|
0:06:29
|
The other option for this feature would be to configure it globally in conjunction with portfast.
|
|
0:06:36
|
So if we say spanning tree portfast default,
|
|
0:06:42
|
which again means that now every interface that is not a trunk link will be running portfast.
|
|
0:06:48
|
If we show spanning tree interface FastEthernet five portfast we see the portfast process is enabled.
|
|
0:06:57
|
Additionally we can say spanning tree portfast BPDU filter default
|
|
0:07:05
|
This means that for any interface that is currently in the portfast mode we will not be sending BPDUs out.
|
|
0:07:15
|
Now it's a little bit different behavior when we look at this from the interface level to the global level
|
|
0:07:21
|
where at the interface level it means that we will not send spanning tree out and we will not receive the packets in.
|
|
0:07:27
|
So it's a bi-directional filter, inbound and outbound.
|
|
0:07:29
|
In global config, it is only an outbound filter.
|
|
0:07:35
|
The reason why is that the spanning tree portfast process
|
|
0:07:40
|
is still listening for BPDUs to come in
|
|
0:07:44
|
and in which case they are received in, we would revert the interface out of the portfast state.
|
|
0:07:52
|
So if we look at the show spanning tree portfast we can see it's enabled. If we show interface FastEthernet five
|
|
0:07:59
|
detail and include the BPDUs, we should see that we are not sending them out the link.
|
|
0:08:08
|
So if we do clear spanning tree counters
|
|
0:08:28
|
we should see here at some point
|
|
0:08:35
|
the process is going to stop. I may need to go back to exec mode. Let's say show run include spanning tree.
|
|
0:08:47
|
So we have portfast default and portfast BPDU filter default.
|
|
0:08:54
|
This link
|
|
0:08:58
|
we could see is no longer sending BPDUs. So it sends them up to some point to try to detect the other devices running spanning tree
|
|
0:09:06
|
but at this point we're no longer sending them. Okay, if we look again at the
|
|
0:09:11
|
show spanning tree interface FastEthernet five portfast, right now it's in the portfast state.
|
|
0:09:19
|
Okay, the next step would be to look at what happens when the interface does start to run spanning tree on the other side.
|
|
0:09:26
|
So on router five we'll now go to the link and enable the bridge group
|
|
0:09:34
|
which then means that switch one should be receiving BPDUs
|
|
0:09:40
|
which then in turn disables portfast and now the interface runs a normal non-edge port in spanning tree.
|
|
0:09:51
|
The key point being here that if you combine these two features together, which is the portfast default and portfast BPDU filter default,
|
|
0:10:01
|
the switch will automatically figure out what interfaces should be edge ports.
|
|
0:10:06
|
It does this by looking for interfaces that BPDUs are not coming in.
|
|
0:10:13
|
For the interfaces that do not receive BPDUs in, we in turn will not send BPDUs out.
|
|
0:10:19
|
That's because we're running the BPDU filter feature.
|
|
0:10:23
|
But in the case that we do start to receive spanning tree packets inbound
|
|
0:10:28
|
then we will revert the interface out of the portfast state and disable the BPDU filter.
|
|
0:10:35
|
So it's a way to dynamically control whether we should run spanning tree
|
|
0:10:42
|
and whether we should send, or whether we should run the port as an edge port,
|
|
0:10:48
|
and whether we should run spanning tree on the link.
|
|
0:10:55
|
So the idea behind this is that you're basically automating which interfaces should run portfast, which ones should not,
|
|
0:11:02
|
and then the ones that are running portfast you're not going to send the spanning tree information down to those interfaces.
|
|
0:11:10
|
Now there's a comment here - what would be the purpose of this? It sounds like it would be a security concern.
|
|
0:11:15
|
It is a potential security issue. Okay? We'll look at this when we get to the
|
|
0:11:21
|
actual security section and we talk about the different Layer 2
|
|
0:11:25
|
filtering mechanisms and the Layer 2 protection mechanisms that the Catalyst IOS has built in
|
|
0:11:30
|
but this does leave you open to a Layer 2 man in the middle attack.
|
|
0:11:36
|
Okay, running these two features together, portfast default and portfast BPDU filter default.
|
|
0:11:41
|
Now the way that the attack works is that let's say we have switch one here that is going to the rest of the Layer 2 network.
|
|
0:11:53
|
Okay, somewhere out there on the Layer 2 network we have the root bridge
|
|
0:11:58
|
which means that from switch one's perspective this interface would be the root port.
|
|
0:12:05
|
Now we have a bunch of links that go down to the access layer. These are supposed to be going to the end hosts.
|
|
0:12:11
|
Now if someone takes two or more of these links and plugs them in to the same device
|
|
0:12:19
|
let's say this is the PC. PC has two NIC cards - NIC 1 and NIC 2. These are links 1 and 2 on the switch.
|
|
0:12:27
|
There's nothing now stopping the end host from advertising a superior BPDU
|
|
0:12:38
|
essentially declaring itself as the root bridge.
|
|
0:12:44
|
Now what would happen in that case is that Layer 2 connectivity is not going to break.
|
|
0:12:51
|
It's just that now this host must be used as transit to get to different portions of the Layer 2 network.
|
|
0:12:58
|
And this is what is considered a man in the middle attack.
|
|
0:13:00
|
So there's some device that is inserting itself into the transit path of traffic
|
|
0:13:05
|
but it is transparent both to the sender and the receiver.
|
|
0:13:10
|
So the idea behind this attack is that you're just going to run some sort of packet sniffer
|
|
0:13:15
|
and then you could see all the traffic that's going through the Layer 2 network.
|
|
0:13:19
|
So we'll see next there are some features in spanning tree that we can prevent this case
|
|
0:13:24
|
and then also later in the dedicated security section, what other things besides
|
|
0:13:30
|
spanning tree can be used to prevent this type of security hole.
|
