Campus lan and Wireless lan solution Design Guide

BPDU Guard 
In L2 networks, loops can be your worst nightmare. To combat this, we use STP (Spanning Tree Protocol), but 
this can also be used to hurt the network if we don’t protect it. 
In spanning tree, a root bridge is elected. This decides which ports will be put in a forwarding or blocking state. 
If a device is added with a lower priority than the current root bridge, it will take over causing a topology change 
and possibly blocking traffic from a wanted path. 
BPDU guard is a protocol designed to solve this problem. When enabled, if a switch sees BDPU traffic coming 
from a port, it will automatically set it to the “errdisabled” state so that no traffic can pass. 
802.1X 
Authentication is very important for the security of the network. A potential attacker can sneak into a building 
and plug into an enabled network port and gain access to the network. 
802.1X is an IEEE standard used for restricting unauthorized access to the network by making users authenticate 
before they are allowed onto the network. 802.1X uses three different parts for authentication. 

Supplicant – This is software which runs on the user device that collects credentials and forwards them 
to be authenticated. 

Authenticator – This is the network access device, usually a switch, the supplicant sends the user 
credentials to. The credentials are then forwarded to the authentication server. 

---

© 2020 Cisco and/or its affiliates. All rights reserved. 
Page 26 of 76

Authentication server – This is a RADIUS server that validates the credentials based off information in its 
database. 
Cisco Umbrella 
With remote workers and sites being more prevalent in today’s networks, it can be difficult to secure the 
network from malware and phishing attacks. 
Cisco Umbrella provides a first line of security for wherever users access the internet by using DNS as a security 
tool. Since DNS is a core part of the internet, it is used to block requests to malicious domains and IP addresses 
before a connection is established. It learns of these current and future threats through a growing database built 
on machine learning and Internet activity patterns. This means Cisco Umbrella can identify and block threats 
before they even launch. 
Cisco Umbrella also provides network administrators visibility of Internet activity across all endpoint devices on 
or off the corporate network. This allows users to easily view any malicious domains or IP addresses attempted 
to be accessed by users. 

---

© 2020 Cisco and/or its affiliates. All rights reserved. 
Page 27 of 76
Design Fundamentals: LAN High Availability 
To mitigate the concerns about unavailability of network resources, campus LAN designs include high 
availability / resiliency options, such as redundant links, switches, and switch components. Designing for high 
availability in the LAN must also consider the entire lifecycle of the deployment, including the need for updates 
and upgrades on the network. This section discusses high availability features specific to the LAN side of the 
network.