Security - BPDU Guard, BPDU Filter, Root Guard and Protected Switchports

[@miguelcjoseph1585]

Awesome, thank you sir. Was wondering around to better understand BPDU guard, and filter from an attack perspective to have a clear understanding. Thank you again, was refreshing.

[@tinkering-thoughts]

Awesome stuff. Easy to understand your teaching

[@rizhmian]

Rob, it was a great lecture. Thank you.

[@davidtrevor8967]

Hello Rob, imagine another device sending BPDUs connected to the switch with BPDU Filter on. Are the BPDU frames getting forwarded by the switch to other ports?

[@noelrakshit]

Hey Rob, it ways a great video. I have a question. Is it advisable to configure BPDU guard on non-edge ports? I understand that this is used towards the edge ports and not allowing any rouge switches to access. but what in the case of an existing ring?

[@RobRikerTechChannel]

Bad idea, if a BPDU is received, the port goes down. NOT advisable at all.

[@Shumbaroarmedia]

Great tutorial , what software is that ?

[@RobRikerTechChannel]

EVE-NG

[@warman]

What program is that which shows the networks?

[@RobRikerTechChannel]

EVE-NG community

[@brendanbass5495]

This was awesome

[@ChatBuck]

Hi Rob, do you have any advice for a KVM environment within a server in a DC that uses BDPU Guard. We have found a vulnerability that allows a customer to create a bridge, and send STP which then causes the Cisco switch to disable. So far we are unable to find a solution.

[@RobRikerTechChannel]

What about BPDU filter, it drops the incoming BPDU, but doesn't error disable the port. Not sure if your looking for that or the customer side. I'd have to know more about the situation to advise.

[@ChatBuck]

@@RobRikerTechChannel Hi Rob, thanks for the reply. This wont work because it would need to be enabled in each customers VM which is not possible to do. What we need really is something to sit between customers VM's and our Port to filter these. I have reached out to you on Twitter also and would love to possibly commission yourself for a few hours to come up with a solution.

[@RobRikerTechChannel]

I'm sure we can figure something out.

[@ChatBuck]

@@RobRikerTechChannel I have sent you an email, thanks for reaching out.

[@ChatBuck]

@@RobRikerTechChannel Hi Rob have you had time to look at this? We are just really keen to patch this up

[@it-fre4ki]

How many RAM have your EVE-NG Server? What are the specs?

[@RobRikerTechChannel]

128 GB RAM. Intel Xeon processors that support Intel VTX

[@8124K-u4x]

holy fuck i tihnk its beyond ccna