zNetLaB › Guided labs › Security
Protect the edge 57 — PortFast and BPDU Guard on user ports
Security Intermediate 3 devices 4 checked tasks 100 points Plan lab
Scenario — in Nellore users wait 30 seconds for the link light and someone once plugged a small switch into a wall socket and flipped the root of the building. Make Fa0/1 and Fa0/2 (the user ports) edge ports with PortFast and protect them with BPDU Guard, and make this switch (SW-Access) a safe root candidate with priority 28672 so it can never win the election against the core. You build it in a browser, type real commands at each device, and every task below is
checked against the running configuration — so you find out it is wrong before anybody else does.
Open this lab in the simulator
The simulator runs in your browser with nothing to install. This lab is part of the full simulator: open it free for 7 days with a new account, then with a plan. It needs an account, which keeps your progress.
The scenario
in Nellore users wait 30 seconds for the link light and someone once plugged a small switch into a wall socket and flipped the root of the building. Make Fa0/1 and Fa0/2 (the user ports) edge ports with PortFast and protect them with BPDU Guard, and make this switch (SW-Access) a safe root candidate with priority 28672 so it can never win the election against the core.
Your role: a security engineer. Level: Intermediate Done when: all 4 goals show as passed (100 points).
Network status
Devices: 1 switch, 2 PCs, cabled as drawn. No Layer 1 or Layer 2 faults: every link is connected and up. User-1 is a host with 10.76.0.11/24. User-2 is a host with 10.76.0.12/24. SW-Access starts with an empty configuration. Known problems
None: nothing is misconfigured. The network is simply not finished: what the goals list is what you have to build or secure. Goals
Fa0/1 and Fa0/2 are PortFast edge ports (35 pts) BPDU Guard is on both user ports (35 pts) The switch priority is 28672 (15 pts) The users still reach each other (15 pts) The activity, in order
Fa0/1 and Fa0/2 are PortFast edge ports Why: PortFast skips the 30-second listening/learning wait for host ports; never use it toward another switch. Verify with: show spanning-tree interface FastEthernet0/1 BPDU Guard is on both user ports Why: This is the task that checks your configuration directly: the line must really be there, not just look right. Verify with: show running-config The switch priority is 28672 Why: This is the task that checks your configuration directly: the line must really be there, not just look right. Verify with: show running-config The users still reach each other Why: A ping needs a route in BOTH directions. This is the end-to-end proof that everything before it worked. Verify with: ping 10.76.0.12 Tips
Work in the order given: later goals depend on the earlier ones. After every change, run the verify command before moving on; do not guess. Stuck? Read the verify output first. It names the interface, neighbour or route that is wrong. Common mistake: PortFast on a trunk — a real loop risk Common mistake: PortFast without BPDU Guard Common mistake: Making the access switch a root candidate Why this matters
PortFast skips the listening and learning delay on ports that only ever face end hosts. BPDU Guard shuts such a port the moment a BPDU arrives, which is what a switch plugged in by mistake sends — so a user cannot change the topology.
What you will be able to do
Enable PortFast on access ports only
Add BPDU Guard to edge ports
Explain errdisable
The network
Catalyst 2960-24TT, PC — 3 devices in all, already cabled.
Fa0/1 Fa0 Fa0/2 Fa0 SW-Access User-1 10.76.0.11/24 User-2 10.76.0.12/24 Drawn from this lab: devices, cables, ports and the addresses already set. Device Model Address already set
SW-Access Catalyst 2960-24TT configure it User-1 PC 10.76.0.11 / 255.255.255.0 User-2 PC 10.76.0.12 / 255.255.255.0
Cabling
SW-Access Fa0/1 ↔ User-1 Fa0 SW-Access Fa0/2 ↔ User-2 Fa0
What is configured at the start
Nothing is configured to start with beyond the addresses above: you build the configuration from a clean start.
Tasks, and how each one is checked
Every task is decided by reading the live network — a neighbour in FULL, a ping that succeeds, a line in the running configuration — not by looking for a keyword you typed. The same command shows you what the lab sees.
# Task Pts How to verify it yourself
1 Fa0/1 and Fa0/2 are PortFast edge ports 35 On SW-Access: show spanning-tree interface Fa0/1 portfast. and On SW-Access: show spanning-tree interface Fa0/2 portfast. 2 BPDU Guard is on both user ports 35 On SW-Access: show running-config contains the line(s) matching interface FastEthernet0/1 … spanning-tree bpduguard enable. and On SW-Access: show running-config contains the line(s) matching interface FastEthernet0/2 … spanning-tree bpduguard enable. 3 The switch priority is 28672 15 On SW-Access: show running-config contains the line(s) matching spanning-tree vlan 1 priority 28672. 4 The users still reach each other 15 On User-1: ping 10.76.0.12 must succeed.
Stuck? Ask the coach
Tell the coach what you see or what you tried. It gives you a hint, not the answer, the way a senior engineer would. Included with a free trial or any plan.
Ask the coach
Common mistakes
PortFast on a trunk — a real loop risk
PortFast without BPDU Guard
Making the access switch a root candidate
Reference solution
Try it yourself first — the lab checks your work either way. This is one configuration that makes every task pass, device by device:
SW-Access interface range fa0/1 - 2
switchport mode access
spanning-tree portfast
spanning-tree bpduguard enable
exit
spanning-tree vlan 1 priority 28672 Where this is examined
CCNA 2.0 STP enhancements; Security+ 3.2; CCNP ENCOR.
This lab practises these topics in the zNetLaB certification courses:
Spanning Tree (RSTP/PVST+) — CCNA · Network Access Trunking, EtherChannel, RSTP and MST — CCNP Enterprise · ENCOR · Infrastructure Switched campus: VTPv3, MST, EtherChannel, UDLD, loop guard — CCIE Enterprise Infrastructure · Network Infrastructure VLANs, trunking, STP, EtherChannel, VTP — CompTIA Network+ · Network Implementation Spanning tree: choosing the root — Switching and VLAN Mastery · Loop prevention and bundling
Related labs
Where to start
The lessons all guided labs plans
CCNA®, CCNP® and Cisco® are trademarks of Cisco Systems, Inc. zNetLaB is not affiliated with or endorsed by Cisco.