Lab 5. Spanning Tree. Overview. JNCIS-ENT Bootcamp

Transcription

1 Lab 5 Spanning Tree Overview This lab demonstrates basic configuration and monitoring tasks when implementing spanning tree and some related protection features on EX Series switches. In this lab, you use the command-line interface (CLI) to configure and monitor RSTP as well as bridge protocol data unit (BPDU) and loop protection. All devices are connected to a common management network which facilitates access to the CLI. These exercises assume you already have some basic understanding of the JUNOS CLI interfaces or you have read the JNCIA-JUNOS documentation or similar. Note that your lab login (password given to you separately) grants you all permissions needed to complete this lab; however, some restrictions have been made to prevent loss of connectivity to the devices. Please be careful, and have fun! By completing this lab, you will perform the following tasks: Update the existing configuration. Configure and monitor RSTP. Configure and monitor BPDU protection. Please refer to the next page lab diagram to perform this exercise: 1

2 Lab Diagram Lab 5: Implementing Spanning Tree Bridge Priority: 4K Bridge Priority: 8K / /24 srxx-1 ge-0/0/1 ge-0/0/2 srxx / /24 ge-0/0/8 ge-0/0/10 ge-0/0/10 ge-0/0/8 Bridge Priority: 32K (default) ge-0/0/9 exx-1 exx-2 Bridge Priority: 32K (default) ge-0/0/9 VLAN: v /24 vr11 ge-0/0/6 ge-0/0/7 VLAN: v /24 vr12 Virtual Routers VLAN: v /24 vr21 ge-0/0/6 ge-0/0/7 VLAN: v /24 vr22 2

3 Part 1: Logging In Using the CLI The goal of this lab part is to become familiar with the access details for your pod of routers & switches and to log in through the CLI. To perform this lab you will have to login in 2x EX switches and 2x SRX devices. 4 sessions in total! srxx-1, srxx-2, exx-1 & exx-2 (being X the initial of the POD being assigned to you) Note Please do NOT delete interface ge-0/0/0 or me0 as this is your management interface which provides access to your session!! Do NOT delete either the security section of your configurations. This allows your system to allow any traffic in/out. Note 2 It is recommended that you use the console connection to access your assigned station. Using the console connection ensures persistent connectivity even when the management network access is unavailable. If needed, review the instructions about how to connect to your system using the console port. Having said that, you can also use the management IP address to perform this lab. Chose the one you want Note 3 Remember that the exercise proposed in this documentation is generic and the examples given here apply only to one particular pod of devices. Please adapt the example to your assigned set of devices (srxa-1, srxa-2, exa-1 & exa-2 or srxb-1, srxb-2, exb-1 & exb-2 or srxc-1, srxc-2, exc-1 & exc-2 or srxd-1, srxd-2, exd-1 & exd2). Look at you lab diagram and mind the pod of systems that you have been assigned! Step 1.1 Log in to both EX systems with the username lab using the password given to you. Note that both the name and password are case-sensitive. You can connect to your SRX or EX Series devices either using the console connection through the terminal server or through a Telnet or SSH session using the SRX Series device s management IP address. Use the one access method that you prefer. Here is an example on how to login via console into your exx-1 switch. Please open a similar session to the pairing switch exx-2 [luis@js2 ~]$ telnet Trying Connected to ( ). Escape character is '^]'. 3

4 exa-1 (ttyu0) login: lab Password: Enter configuration mode and load the lab5-start configuration from the /var/home/lab/jncis/ directory. Commit your changes when complete. {master:0 configure Entering configuration mode {master:0[edit] load override jncis/lab5-start load complete {master:0[edit] commit configuration check succeeds commit complete {master:0[edit] Repeat the same for the other switch exx-2. Login in the system, load the lab5-start configuration file, etc. ~]$ telnet Step 1.2 Open a separate session to your two assigned SRX Series devices. Note you can connect to your SRX Series device using the console connection through the terminal server or through a Telnet or SSH session using the SRX Series device s management IP address. [luis@js2 ~]$ telnet Trying Connected to ( ). Escape character is '^]'. login: lab Password: --- JUNOS 12.1R1.9 built :12:49 UTC lab@srxa-1> 4

5 Enter configuration mode and load the lab5-start configuration from the /var/home/lab/jncis/ directory. Commit your changes when complete. configure Entering configuration mode [edit] load override jncis/lab5-start load complete [edit] commit commit complete Exiting configuration mode Note Not likely, but if you happen to get a message like this: lab@host1-a# commit warning: You have changed mpls flow mode. You have to reboot the system for your change to take effect. If you have deployed a cluster, be sure to reboot all nodes. commit complete As the message suggest, please reboot the machine by issuing a request system reboot and keep going. Ignore this note if you do not receive a warning of this kind Repeat the same for the other SRX srxx-2. Login in the system, load the lab5-start.config configuration file, etc. [luis@js2 ~]$ telnet Part 2: Modifying the existing configuration Step 2.1 In this lab part, you will modify the configuration to prepare for subsequent lab parts. Refer to network diagram for this lab for topological and configuration details. Return to your assigned EX switch. From your assigned ESX switch, navigate to the [edit vlans] hierarchy level and add the VLANs assigned to virtual routers attached to the remote team s switch. Once this step is done, you should see a total of four VLANs defined on your switch; v11, v12, v21, and v22. 5

6 {master:0[edit] edit vlans {master:0[edit vlans] show v11 { vlan-id 11; l3-interface vlan.11; v12 { vlan-id 12; l3-interface vlan.12; {master:0[edit vlans] lab@exa-1# set remote-network1-vlan-name vlan-id remote-network1-vlan-id {master:0[edit vlans] lab@exa-1# set remote-network2-vlan-name vlan-id remote-network2-vlan-id {master:0[edit vlans] lab@exa-1# show v11 { vlan-id 11; l3-interface vlan.11; v12 { vlan-id 12; l3-interface vlan.12; v21 { vlan-id 21; v22 { vlan-id 22; Step 2.2 Navigate to the [edit interfaces] hierarchy and associate ge-0/0/8.0 with all vlans. {master:0[edit vlans] lab@exa-1# top edit interfaces {master:0[edit interfaces] lab@exa-1# show ge-0/0/8 unit 0 { family ethernet-switching { port-mode trunk; vlan { members [ v11 v12 ]; 6

7 {master:0[edit interfaces] delete ge-0/0/8 unit 0 family ethernet-switching vlan {master:0[edit interfaces] lab@exa-1# set ge-0/0/8 unit 0 family ethernet-switching vlan members all {master:0[edit interfaces] lab@exa-1# show ge-0/0/8 unit 0 { family ethernet-switching { port-mode trunk; vlan { members all; Step 2.3 Use the copy command to replicate the configuration associated with ge-0/0/8 to the ge-0/0/10 interface. {master:0[edit interfaces] lab@exa-1# copy ge-0/0/8 to ge-0/0/10 {master:0[edit interfaces] lab@exa-1# show ge-0/0/10 unit 0 { family ethernet-switching { port-mode trunk; vlan { members all; Step 2.4 Activate the configuration changes using the commit command. Next, issue the run show ethernet-switching interfaces command. Note Do NOT forget to follow these steps again and configure the other switch exx-2!! {master:0[edit interfaces] lab@exa-1# commit configuration check succeeds commit complete 7

8 {master:0[edit interfaces] run show ethernet-switching interfaces Interface State VLAN members Tag Tagging Blocking ge-0/0/1.0 down default untagged unblocked ge-0/0/6.0 up v11 11 untagged unblocked ge-0/0/7.0 up v12 12 untagged unblocked ge-0/0/8.0 up v11 11 tagged unblocked v12 12 tagged unblocked v21 21 tagged unblocked v22 22 tagged unblocked ge-0/0/10.0 up v11 11 tagged unblocked v12 12 tagged unblocked v21 21 tagged unblocked v22 22 tagged unblocked Based on the resulting output, are any of the listed interfaces currently blocking traffic? As shown in the sample output, you should see all interfaces in the unblocked blocking state, which means all interfaces should be forwarding traffic rather than blocking traffic. Part 3: Configuring and Monitoring RSTP In this lab part, you will configure and monitor RSTP. First, you will perform some ping tests on your SRX Series device to identify the need for spanning tree within a Layer 2 network. Next, you will configure RSTP on your assigned devices. Finally, you will verify the effects of enabling RSTP in a Layer 2 network with redundant paths. You will need to refer to the network diagram for this lab for some of the configuration tasks performed in this lab part. Step 3.1 Note The next lab steps are performed on your assigned SRX Series devices. If needed, refer to the management network diagram for access details. Return to one of your assigned SRX Series device. From your assigned SRX Series device, attempt to ping the IP addresses assigned to the VLAN interfaces defined on your EX Series switch. That is the network1-address and network2-address or the addresses of the vr devices. Refer to the network diagram for this lab, if needed. 8

9 [edit] run ping PING ( ): 56 data bytes 64 bytes from : icmp_seq=0 ttl=64 time=9.501 ms 64 bytes from : icmp_seq=0 ttl=63 time= ms (DUP!) 64 bytes from : icmp_seq=1 ttl=64 time=1.937 ms 64 bytes from : icmp_seq=2 ttl=64 time=1.798 ms 64 bytes from : icmp_seq=3 ttl=64 time=1.769 ms ^C ping statistics packets transmitted, 4 packets received, +1 duplicates, 50% packet loss round-trip min/avg/max/stddev = 1.769/10.992/39.953/ ms [edit] lab@srxa-1# run ping count 5 PING ( ): 56 data bytes 64 bytes from : icmp_seq=0 ttl=64 time=2.765 ms 64 bytes from : icmp_seq=0 ttl=64 time=3.678 ms (DUP!) 64 bytes from : icmp_seq=1 ttl=64 time=2.201 ms 64 bytes from : icmp_seq=1 ttl=64 time=3.558 ms (DUP!) 64 bytes from : icmp_seq=2 ttl=64 time=7.214 ms 64 bytes from : icmp_seq=2 ttl=64 time=8.276 ms (DUP!) 64 bytes from : icmp_seq=3 ttl=64 time=4.154 ms 64 bytes from : icmp_seq=3 ttl=64 time=5.055 ms (DUP!) 64 bytes from : icmp_seq=4 ttl=64 time=2.223 ms ping statistics packets transmitted, 5 packets received, +4 duplicates, 0% packet loss round-trip min/avg/max/stddev = 2.201/4.347/8.276/2.024 ms [edit] lab@srxa-1# run ping PING ( ): 56 data bytes 64 bytes from : icmp_seq=0 ttl=64 time=9.370 ms 64 bytes from : icmp_seq=0 ttl=63 time= ms (DUP!) 64 bytes from : icmp_seq=1 ttl=64 time=1.751 ms 64 bytes from : icmp_seq=2 ttl=64 time=1.797 ms 64 bytes from : icmp_seq=3 ttl=64 time=1.734 ms ^C ping statistics packets transmitted, 8 packets received, +1 duplicates, 30% packet loss round-trip min/avg/max/stddev = 1.734/6.872/40.006/ ms Do the ping tests succeed? What might these result indicate? 9

10 Your results may vary from those shown above. In the sample output, the ping tests are not clearly successful. In some situations you may not see any response while in other situations you may see some intermittent replies; including duplicate ICMP echo replies. These results are often indicative of a Layer 2 loop. Step 3.2 Activate the RSTP configuration on both SRX devices (the protocol is actually preconfigured in your device but not activated). Issue the commit and-quit command to activate the change and return to operational mode. [edit] lab@srxa-1# show protocols inactive: rstp { bridge-priority 4k; [edit] lab@srxa-1# activate protocols rstp [edit] lab@srxa-1# commit and-quit commit complete Exiting configuration mode lab@srxa-1> Note Do NOT forget to follow these steps again and configure the other srxx-2!! Step 3.3 Return to your assigned EX Series switches. On your assigned EX Series switches, enable the RSTP protocol. Next, activate the configuration changes and return to operational mode. {master:0[edit interfaces] lab@exa-1# top set protocols rstp {master:0[edit interfaces] lab@exa-1# commit and-quit configuration check succeeds commit complete Exiting configuration mode Based on the priority values listed on the network diagram for this lab, can you predict which device will be elected the root bridge? 10

11 Based on the assigned priority values, srxx-1, where X represents your assigned pod value, should be elected the root bridge. Step 3.4 Issue the show spanning-tree bridge command. {master:0 lab@exa-1> show spanning-tree bridge STP bridge parameters Context ID : 0 Enabled protocol : RSTP Root ID : :26:88:02:74:90 Root cost : Root port : ge-0/0/8.0 Hello time : 2 seconds Maximum age : 20 seconds Forward delay : 15 seconds Message age : 1 Number of topology changes : 2 Time since last topology change : 61 seconds Topology change initiator : ge-0/0/8.0 Topology change last recvd. from : 00:26:88:e9:d2:88 Local parameters Bridge ID : :23:9c:13:a8:41 Extended system ID : 0 Internal instance ID : 0 What is your switch s bridge ID? The answer will vary. In the sample output, the bridge ID is :23:9c:13:a8:41. Remember that the bridge ID is created by combining the bridge priority (32K by default) and the system MAC address. The system MAC address is typically the same as the public base address for the device. The public base address can be viewed on EX Series switches using the following command: {master:0 lab@exa-1> show chassis mac-addresses FPC 0 MAC address information: Public base address 00:23:9c:13:a8:40 Public count 64 11

12 Can you determine which device is elected as the root bridge? The srxx-1 device, where X represents your assigned pod value, should be elected as the root bridge based on the bridge priority value of Which interface on your switch has been selected as the root port? The answer depends on the device you check it. On switch exx-1, where X represents your assigned pod value, you should see ge-0/0/8.0 elected as the root port. On switch exx-2, where X represents your assigned pod value, you should see ge-0/0/10.0 elected as the root port. A sample capture taken from exx-2 follows: {master:0 lab@exa-2> show spanning-tree bridge STP bridge parameters Context ID : 0 Enabled protocol : RSTP Root ID : :26:88:02:74:90 Root cost : Root port : ge-0/0/10.0 Hello time : 2 seconds Maximum age : 20 seconds Forward delay : 15 seconds Message age : 1 Number of topology changes : 2 Time since last topology change : 340 seconds Topology change initiator : ge-0/0/10.0 Topology change last recvd. from : 00:26:88:e9:d2:8a Local parameters Bridge ID : :23:9c:13:91:81 Extended system ID : 0 Internal instance ID : 0 What is the cumulative cost to the root bridge from your designated switch? Regardless of your assigned switch, the cumulative cost to the root bridge should be based on the active topology. 12

13 Step 3.5 Issue the show spanning-tree interface command to determine the state and role of each switch port. {master:0 show spanning-tree interface Spanning tree interface parameters for instance 0 Interface Port ID Designated Designated Port State Role port ID bridge ID Cost ge-0/0/ : : c13a FWD DESG ge-0/0/ : : c13a FWD DESG ge-0/0/ : : FWD ROOT ge-0/0/ : : b BLK ALT Does your switch currently have any ports in the blocking (BLK) state? If so, which interface? Regardless of the switch you look at, you should have one switch port in the blocking (BLK) state. The actual interface in the blocking state will depend on your device. If you look at switch exx-1, where X represents your assigned pod value, you should see ge-0/0/10.0 in the blocking state. If you look at switch is exx-2, you should see ge- 0/0/8.0 in the blocking state. A sample capture taken from exx-2 follows: {master:0 lab@exa-2> show spanning-tree interface Spanning tree interface parameters for instance 0 Interface Port ID Designated Designated Port State Role port ID bridge ID Cost ge-0/0/ : : c FWD DESG ge-0/0/ : : c FWD DESG ge-0/0/ : : b BLK ALT ge-0/0/ : : FWD ROOT Why are all the port costs the same for all interfaces? They are all the same because they are using the default port cost for 1 Gbps Ethernet. If a port has been changed to influence root port election you might see something like 13

14 the following output where the influenced port and path have a lower value than the default for 1 Gbps Ethernet: {master:0 lab@exa-1> show spanning-tree interface Spanning tree interface parameters for instance 0 Interface Port ID Designated Designated Port State Role port ID bridge ID Cost ge-0/0/ : : c13a FWD DESG ge-0/0/ : : c13a FWD DESG ge-0/0/ : : FWD ROOT ge-0/0/ : : b BLK ALT Step 3.6 Issue the show ethernet-switching interfaces command to view the effects of the spanning tree calculations on Ethernet switching interfaces. {master:0 lab@exa-1> show ethernet-switching interfaces Interface State VLAN members Tag Tagging Blocking ge-0/0/1.0 down default untagged blocked by STP ge-0/0/6.0 up v11 11 untagged unblocked ge-0/0/7.0 up v12 12 untagged unblocked ge-0/0/8.0 up v11 11 tagged unblocked v12 12 tagged unblocked v21 21 tagged unblocked v22 22 tagged unblocked ge-0/0/10.0 up v11 11 tagged blocked by STP v12 12 tagged blocked by STP v21 21 tagged blocked by STP v22 22 tagged blocked by STP Are any Ethernet switching interfaces now in the blocking state? If so, which interfaces and why? Regardless of the switch you look at, you should have two Ethernet switching ports in the blocking state. In all cases, ge-0/0/1.0 should be blocked by STP because it is not physically up. The second interface in the blocking state will depend on the device. If you look at exx-1, where X represents your assigned pod value, you should see ge- 0/0/10.0 in the blocking state. If you look at exx-2, where X represents your assigned pod value, you should see ge-0/0/8.0 in the blocking state. The second interface is also being blocked by STP due to the least cost path calculation to the root bridge. 14

15 Step 3.7 Issue the show spanning-tree interface ge-0/0/y detail command for the interface currently designated as the root port (where y is either ge-0/0/8 or ge-0/0/10 depending on the switch you are checking). {master:0 lab@exa-1> show spanning-tree interface ge-0/0/8 detail Spanning tree interface parameters for instance 0 Interface name : ge-0/0/8.0 Port identifier : Designated port ID : Port cost : Port state : Forwarding Designated bridge ID : :26:88:02:74:90 Port role : Root Link type : Pt-Pt/NONEDGE Boundary port : NA Edge delay while expiry count : 1 Rcvd info while expiry count : 0 What is the Link type for this interface? The Link type for the root port should be Pt-Pt/NONEDGE. This is the default link type for an interface operating in full-duplex that receives BPDUs. Step 3.8 Issue the show spanning-tree interface ge-0/0/6 detail command. {master:0 lab@exa-1> show spanning-tree interface ge-0/0/6 detail Spanning tree interface parameters for instance 0 Interface name : ge-0/0/6.0 Port identifier : Designated port ID : Port cost : Port state : Forwarding Designated bridge ID : :23:9c:13:a8:41 Port role : Designated Link type : Pt-Pt/EDGE Boundary port : NA Edge delay while expiry count : 1 Rcvd info while expiry count : 0 15

16 What is the Link type for this interface? Can you explain why it is different than the root port? The Link type for ge-0/0/6 should be Pt-Pt/EDGE. This is the expected link type for this interface because it is operating in full-duplex and is not receiving BPDUs from the connected virtual router. For an interface operating in half-duplex mode, you see a link type of shared rather than point-to-point. The following output confirms the current duplex setting for ge-0/0/6: {master:0 lab@exa-1> show interfaces ge-0/0/6 extensive match "Link mode" Link mode: Full-duplex, Flow control: None, Remote fault: OK, Step 3.9 Return to your assigned SRX Series devices. On one of your assigned SRX Series device, use the ping utility and attempt to ping the IP addresses assigned to the VLAN interfaces defined on your EX Series switch (the same ones as in step 3.1). Refer to the network diagram for this lab, if needed. lab@srxa-1> ping count 10 rapid PING ( ): 56 data bytes!!!!!!!!!! ping statistics packets transmitted, 10 packets received, 0% packet loss round-trip min/avg/max/stddev = 1.560/1.825/2.337/0.293 ms lab@srxa-1> ping count 10 rapid PING ( ): 56 data bytes!!!!!!!!!! ping statistics packets transmitted, 10 packets received, 0% packet loss round-trip min/avg/max/stddev = 1.234/1.343/1.551/0.098 ms lab@srxa-1> ping count 10 rapid PING ( ): 56 data bytes!!!!!!!!!! ping statistics packets transmitted, 10 packets received, 0% packet loss round-trip min/avg/max/stddev = 1.633/2.045/2.742/0.343 ms 16

17 Do the ping tests succeed? Yes, at this time the ping tests should succeed Part 4: Configuring and Monitoring BPDU Protection Step 4.1 In this lab part, you will enable some protection features. First, you will enable the ge-0/0/9.0 interface for Layer 2 operations as an edge port. Next, you will configure BPDU protection and monitor the effects of this protection feature. Finally, you will administratively clear a BPDU error condition. This lab section could be performed on the srxx-1 and exx-1 pair of devices only. Return to your assigned EX Series switches. On your EX Series switches, enter configuration mode and navigate to the [edit interfaces] hierarchy level. {master:0 lab@exa-1> configure Entering configuration mode {master:0[edit] lab@exa-1# edit interfaces Enable ge-0/0/9 for Layer 2 operations as an access port for the default VLAN {master:0[edit interfaces] lab@exa-1# set ge-0/0/9 unit 0 family ethernet-switching Step 4.2 Navigate to the [edit protocols rstp] hierarchy. Define ge-0/0/9.0 as an edge port. Next, issue the commit command to activate the configuration changes. {master:0[edit interfaces] lab@exa-1# top edit protocols rstp {master:0[edit protocols rstp] lab@exa-1# set interface ge-0/0/9.0 edge {master:0[edit protocols rstp] lab@exa-1# commit configuration check succeeds commit complete 17

18 Step 4.3 Issue the run show spanning-tree interface ge-0/0/9.0 detail command. {master:0[edit protocols rstp] run show spanning-tree interface ge-0/0/9.0 detail Spanning tree interface parameters for instance 0 Interface name : ge-0/0/9.0 Port identifier : Designated port ID : Port cost : Port state : Forwarding Designated bridge ID : :23:9c:13:a8:41 Port role : Designated Link type : Pt-Pt/EDGE Boundary port : NA Edge delay while expiry count : 1 Rcvd info while expiry count : 0 Is ge-0/0/9.0 designated as an edge port? Yes, ge-0/0/9.0 should now be designated as a point-to-point edge (Pt-PT/EDGE) interface as shown in the sample output. What is the state and role of ge-0/0/9.0? At this time the newly added interface should be present in the generated output and should assume the forwarding state and designated role. Step 4.4 Enable the BPDU protection feature under the [edit protocols rstp] hierarchy and activate the configuration change using the commit command. {master:0[edit protocols rstp] lab@exa-1# set bpdu-block-on-edge {master:0[edit protocols rstp] lab@exa-1# commit 18

19 configuration check succeeds commit complete Step 4.5 Issue the run show ethernet-switching interfaces command. {master:0[edit protocols rstp] run show ethernet-switching interfaces Interface State VLAN members Tag Tagging Blocking ge-0/0/1.0 down default untagged blocked by STP ge-0/0/6.0 up v11 11 untagged unblocked ge-0/0/7.0 up v12 12 untagged unblocked ge-0/0/8.0 up v11 11 tagged unblocked v12 12 tagged unblocked v21 21 tagged unblocked v22 22 tagged unblocked ge-0/0/9.0 up default untagged unblocked ge-0/0/10.0 up v11 11 tagged blocked by STP v12 12 tagged blocked by STP v21 21 tagged blocked by STP v22 22 tagged blocked by STP What are the interface and blocking states for ge-0/0/9.0? The interface and blocking states for interface ge-0/0/9.0 should be up and unblocked respectively. Step 4.6 Return to your assigned SRX Series device. On your SRX Series device, enter configuration mode and navigate to the [edit interfaces] hierarchy level. configure Entering configuration mode [edit] edit interfaces [edit interfaces] Activate the ge-0/0/9 interface. Next, issue the commit command to activate the configuration change. 19

20 [edit interfaces] show ge-0/0/9 ## ## inactive: interfaces ge-0/0/9 ## unit 0 { family ethernet-switching { port-mode trunk; vlan { members all; [edit interfaces] lab@srxa-1# activate ge-0/0/9 [edit interfaces] lab@srxa-1# commit commit complete Step 4.7 Return to your assigned EX Series switch. On your EX Series switch, issue the run show ethernet-switching interfaces command to determine the current state of the ge-0/0/9.0 interface. {master:0[edit protocols rstp] lab@exa-1# run show ethernet-switching interfaces Interface State VLAN members Tag Tagging Blocking ge-0/0/1.0 down default untagged blocked by STP ge-0/0/6.0 up v11 11 untagged unblocked ge-0/0/7.0 up v12 12 untagged unblocked ge-0/0/8.0 up v11 11 tagged unblocked v12 12 tagged unblocked v21 21 tagged unblocked v22 22 tagged unblocked ge-0/0/9.0 down default untagged Disabled by bpdu-control ge-0/0/10.0 up v11 11 tagged blocked by STP v12 12 tagged blocked by STP v21 21 tagged blocked by STP v22 22 tagged blocked by STP What are the interface and blocking states for ge-0/0/9.0? The interface and blocking states for interface ge-0/0/9.0 should be down and disabled by bpdu-control respectively. 20

21 Step 4.8 Issue the run show spanning-tree interface ge-0/0/9.0 detail command. {master:0[edit protocols rstp] run show spanning-tree interface ge-0/0/9.0 detail Spanning tree interface parameters for instance 0 Interface name : ge-0/0/9.0 Port identifier : Designated port ID : Port cost : Port state : Blocking Designated bridge ID : :23:9c:13:a8:41 Port role : Disabled (Bpdu-Inconsistent) Link type : Pt-Pt/EDGE Boundary port : NA Edge delay while expiry count : 2 Rcvd info while expiry count : 0 What is the state and role of ge-0/0/9.0? Currently, the ge-0/0/9.0 interface should show the Blocking state and Disabled (Bpdu-Inconsistent) port role. Step 4.9 Return to your assigned SRX Series device. On your SRX Series device, deactivate again the ge-0/0/9 interface. Next, issue the commit and-quit command to activate the configuration change and return to operational mode. [edit interfaces] lab@srxa-1# deactivate ge-0/0/9 [edit interfaces] lab@srxa-1# show ge-0/0/9 ## ## inactive: interfaces ge-0/0/9 ## unit 0 { family ethernet-switching { port-mode trunk; vlan { members all; 21

22 [edit interfaces] commit and-quit commit complete Exiting configuration mode Step 4.10 Return to your assigned EX Series switch. On your EX Series switch, clear the current BPDU error condition. Next, issue the run show ethernet-switching interfaces ge-0/0/9.0 command to verify the error condition has been cleared. {master:0[edit protocols rstp] run clear ethernet-switching bpdu-error {master:0[edit protocols rstp] run show ethernet-switching interfaces ge-0/0/9.0 Interface State VLAN members Tag Tagging Blocking ge-0/0/9.0 up default untagged unblocked Has the error condition been administratively removed? Step 4.11 Yes, as shown in the sample output, the error condition should now be gone thanks to the illustrated clear command. If the error condition persists, check the configurations on your assigned devices. Log out of all your assigned EX Series switches and SRX devices. {master:0[edit protocols rstp] top {master:0[edit] exit Exiting configuration mode {master:0 exit exa-1 (ttyu0) login: STOP You have completed Lab 5! 22