CCNA Routing and Switching
Scaling Networks

OSPF Practice Skills Assessment – Packet Tracer

A few things to keep in mind while completing this activity:

  1. Do not use the browser Back button or close or reload any exam windows during the exam.
  2. Do not close Packet Tracer when you are done. It will close automatically.
  3. Click the Submit Assessment button in the browser window to submit your work.

Introduction

In Part I of this practice skills assessment, you will configure the Company A network with routing and ACLs. You will configure dynamic routing with OSPFv2  and distribute a  default route. In addition, you will configure two access control lists.

In Part II of this practice skills assessment, you will configure the Company A network with  RPVST+, port security, EtherChannel, DHCP, VLANs and trunking, and routing between VLANs. In addition you will perform an initial configuration on a switch, secure switch ports and create SVIs.  You will also control access to the switch management network with an access control list.

All IOS device configurations should be completed from a direct terminal connection to the device console from an available host.

Some values that are required to complete the configurations have not been given to you. In those cases, create the values that you need to complete the requirements. These values may include certain IP addresses, passwords, interface descriptions, banner text, and other values.

For the sake of time, many repetitive but important configuration tasks have been omitted from this activity. Many of these tasks, especially those related to device security, are essential elements of a network configuration. The intent of this activity is not to diminish the importance of full device configurations.

You will practice and be assessed on the following skills:

  • Configuration of initial device settings
  • IPv4 address assignment and configuration
  • Configuration and addressing of device interfaces
  • Configuration of the OSPFv2 routing protocol
  • Configuration of a default route
  • Configuration of ACL to limit device access
  • Configuration of switch management settings including SSH
  • Configuration of port security
  • Configuration of unused switch ports according to security best practices
  • Configuration of RPVST+
  • Configuration of  EtherChannel
  • Configuration of a router as a DHCP server
  • Configuration of VLANs and trunks
  • Configuration of routing between VLANs

You are required to do the following:

Site 1:

  • Configure initial device  settings.
  • Configure interfaces with  IPv4 addresses, descriptions, and other settings.
  • Configure  and customize OSPFv2.

HQ:

  • Configure interfaces with  IPv4 addresses, descriptions, and other settings.
  • Configure  and customize  OSPFv2.
  • Configure named and numbered ACLs.
  • Configure and propagate a default route through OSPFv2.

Site 2:

  • Configure interfaces with  IPv4 addresses, descriptions, and other settings.
  • Configure DHCP pools and excluded addresses.
  • Configure routing between VLANs.
  • Configure a standard ACL.
  • Configure OSPFv2.

SW-A:

  • Create and name VLANs.
  • Configure EtherChannel.
  • Configure trunking.
  • Assign access ports to VLANs.
  • Configure remote management settings.
  • Activate and configure RPVST+.
  • Secure unused switch ports.
  • Configure port security.

SW-B:

  • Create and name VLANs.
  • Configure EtherChannel.
  • Configure trunking.
  • Assign access ports to VLANs.
  • Configure remote management settings with SSH.
  • Activate RPVST+.

SW-C:

  • Create and name VLANs.
  • Configure EtherChannel.
  • Configure trunking.
  • Assign access ports to VLANs.
  • Configure remote management settings.
  • Activate and configure RPVST+.
  • Configure switch ports with PortFast and BPDU Guard.

Internal PC hosts:

  • Configure as DHCP clients.
  • Assign static IPv4 addresses where indicated.


Tables

Note: You are provided with the networks that interfaces should be configured on. Unless you are told to do differently in the detailed instructions below, you are free to choose the host addresses to assign.

Addressing Table:

Device

Interface

Network

Configuration Details

Site 1

S0/0/0

192.168.100.20/30

any address in the network

192.168.100.22

G0/0

192.168.8.0/24

first host address

192.168.8.1

G0/1

192.168.9.0/24

first host address

192.168.9.1

HQ

S0/0/0

192.168.100.20/30

any address in the network

192.168.100.21

S0/0/1

192.168.100.36/30

any address in the network

192.168.100.37

S0/1/0

203.0.113.16/29

(The first address in this network is already in use on the ISP router. Any other address in the network can be assigned to this interface.)

203.0.113.18

Site 2

S0/0/1

192.168.100.36/30

any address in the network

192.168.100.38

G0/1.2

10.10.2.0/24

first  address in the network

10.10.2.1

G0/1.4

10.10.4.0/24

first address in the network

10.10.4.1

G0/1.8

10.10.8.0/24

first address in the network

10.10.8.1

G0/1.15

10.10.15.0/24

first address in the network

10.10.15.1

G0/1.25

10.10.25.0/24

first address in the network

10.10.25.1

SW-A

SVI

10.10.25.0/24

the highest address in the network

10.10.25.254

SW-B

SVI

10.10.25.0/24

the second to the highest address in the network

10.10.25.253

SW-C

SVI

10.10.25.0/24

the third to the highest address in the network

10.10.25.252

Manage-1A

NIC

192.168.8.0/24

any address in the network

192.168.8.2

Clerk-1C

NIC

192.168.9.0/24

any address in the network

192.168.9.2

Admin-A

NIC

10.10.15.0/24

any available address in network

10.10.15.2

Admin-B

NIC

10.10.15.0/24

any available address in network

10.10.15.3

VLAN Switch Port Assignment Table:

VLAN

Name

Network

Device

Switch Ports

2

sales

10.10.2.0/24

SW-A

Fa0/5

SW-C

Fa0/7

4

prod

10.10.4.0/24

SW-A

Fa0/10

SW-C

Fa0/10

8

acct

10.10.8.0/24

SW-A

Fa0/15

SW-C

Fa0/15

15

admin

10.10.15.0/24

SW-A

Fa0/24

SW-C

Fa0/24

25

SVI-NET

10.10.25.0/24

SW-A

SVI

SW-B

SVI

SW-C

SVI

99

null

N/A

SW-A

all unused ports

Port-Channel Groups:

Channel

Device

Interfaces

1

SW-A

Fa0/1, Fa0/2

SW-C

Fa0/1, Fa0/2

2

SW-A

Fa0/3, Fa0/4

SW-B

Fa0/3, Fa0/4

3

SW-B

Fa0/5, Fa0/6

SW-C

Fa0/5, Fa0/6

Instructions

All configurations must be performed through a direct terminal connection to the device console line  from an available host.

Part I: OSPFv2 Router Configuration

Step 1: Plan the Addressing.

Determine the IP addresses that you will use for the required interfaces on the devices and  LAN hosts. Follow the configuration details provided in the Addressing Table.

Step 2: Configure Site 1.

Configure Site 1  with initial settings:

  • Configure the router host name:  Site-1. This value must be entered exactly as it appears here.

Router(config)#hostname Site-1

  • Prevent the router from attempting to resolve command line entries to IP addresses.

Site-1(config)#  no ip domain look up

  • Protect device configurations from unauthorized access with an encrypted  secret  password.

Site-1(config)#  enable secret class

  • Secure the router console and remote access lines.

Site-1(config)#line console 0
Site-1(config-line)#password cisco
Site-1(config-line)#login

Site-1(config)#line vty 0 4
Site-1(config-line)#password cisco
Site-1(config-line)#login

Site-1(config)#line aux 0
Site-1(config-line)#password cisco
Site-1(config-line)#login

 

  • Prevent system status messages from interrupting console output.

Site-1(config)#line console 0
Site-1(config-line)#logging synchronous

  • Configure a message-of-the-day banner.

Site-1(config)#banner motd “Authorized Access Only”

  • Encrypt all clear text passwords.

Site-1(config)#service password-encryption

Step 3: Configure the Router Interfaces.

Configure the interfaces of  all  routers for full connectivity with the following:

  • IP addressing
  • Descriptions for  serial  interfaces.
  • Configure DCE settings where required. Use a rate of  128000.
  • The Ethernet subinterfaces on Site 2 will configured later in this assessment.

Step 4: Configure inter-VLAN routing on Site 2.

Configure router  Site 2  to route between  VLANs using information in the Addressing Table and VLAN Switch Port Assignment Table. The VLANs will be configured on the switches later in this assessment.

  • Do  not  route the VLAN 99 network.

Step 5: Configure Default Routing.

On  HQ, configure  a default route to the Internet.  Use the exit interface argument.  

Step 6: Configure OSPF Routing.

a. On all routers:

  • Configure multiarea OSPFv2 to route between all internal networks. Use a process ID of  1.
  • Use the area numbers shown in the topology.
  • Use the correct wild card masks for all network statements.
  • You are  not  required to route the  SVI-NET  VLAN  network on  Site 2.
  • Prevent routing updates from being sent to the LANs.

b. On the  HQ  router:

  • Configure multiarea OSPFv2 to distribute the default route to the other routers.

Step 7: Customize Multiarea OSPFv2.

Customize multiarea OSPFv2 by performing the following configuration tasks:

a. Set the bandwidth of  all  serial interfaces to  128 kb/s.

b. Configure OSPF router IDs as follows:

  • Site 1:  1.1.1.1
  • HQ:  2.2.2.2
  • Site 2:  3.3.3.3
  • The configured router IDs  should be in effect  on all three routes.

c. Configure the OSPF cost of the link between  Site 1  and  HQ  to  7500.

Step 8: Configure OSPF MD5 Authentication on the Required Interfaces.

Configure OSPF to authenticate routing updates with MD5 authentication on the OSPF interfaces.

  • Use a key value of  1.
  • Use  xyz_OSPF  as the password.
  • Apply MD5 authentication to the required interfaces.

Step 9: Configure Access Control Lists.

You will configure two access control lists in this step. You should use the  any  and  host  keywords in the ACL statements as required. The ACL specifications are as follows:

a. Restrict access to the vty lines on  HQ  with an ACL:

  • Create a  named standard ACL  using the name  TELNET-BLOCK. Be sure that you enter this name exactly as it appears in this instruction.
  • Allow only  Admin Host  to access the vty lines of  HQ.
  • No other Internet hosts (including hosts not visible in the topology) should be able to access  the vty lines of  HQ.
  • Your solution should consist of  one  ACL statement.
  • Your ACL should be placed in the most efficient location as possible to conserve network bandwidth and device processing resources.

b. Block ping requests from the Internet with an ACL:

  • Use access list number  101.
  • Allow only  Admin Host  to ping addresses within the Company A network. Only echo messages should be permitted.
  • Prevent all other Internet hosts (not only the Internet hosts visible in the topology) from pinging  addresses inside the  Company A  network. Block echo messages only.
  • All other traffic should be allowed.
  • Your ACL should consist of  three  statements.
  • Your ACL should be placed in the most efficient location as possible to conserve network bandwidth and device processing resources.

c. Control access to the management interfaces (SVI) of the three  switches attached to  Site 2  as follows:

  • Create a standard ACL.
  • Use the number  1  for the list.
  • Permit only addresses from the  admin  VLAN  network to access any  address on the  SVI-NET  VLAN  network.
  • Hosts on the    admin  VLAN  network should be able to reach all other destinations.
  • Your list should consist of  one  statement.
  • Your ACL should be placed in the most efficient location as possible to conserve network bandwidth and device processing resources.
  • You will be able to test this ACL at the end of Part II  of this assessment.

Part II: Switching and DHCP Configuration

Step 1: Create and name VLANs.

On  all three switches  that are attached to Site 2, create and name the VLANs shown in the VLAN Table.

  • The VLAN names that you configure must match the values in the table exactly.
  • Each switch should be configured with all of the VLANs shown in the table.

Step 2:  Assign switch ports to VLANs.

Using the VLAN table, assign  switch ports to the VLANs you created in Step 1, as follows:

  • All switch ports that you assign to VLANsn should be configured to  static access mode.
  • All switch ports that you assign to VLANs  should be activated.
  • Note that all of the unused ports on  SW-A  should be assigned to VLAN 99. This configuration step on switches SW-B and SW-C is  not  required in this assessment  for the sake of time.
  • Secure the unused switch ports on  SW-A  by shutting them down.

Step 3:  Configure the SVIs.

Refer to the Addressing Table. Create and address the SVIs on all three  of the switches that are attached to Site 2. Configure the switches so that they can communicate with hosts on other networks. Full connectivity will be established after routing between VLANs has been configured later in this assessment.

Step 4:  Configure Trunking and EtherChannel.

a. Use the information in the Port-Channel Groups table to configure EtherChannel as follows:

  • Use LACP.
  • The switch ports on  both  sides of  Channels 1 and 2 should initiate negotiations for  channel establishment.
  • The switch ports on the  SW-B  side of  Channel 3 should initiate negotiations with the switch ports on SW-C.
  • The switch ports on the  SW-C  side of Channel 3 should  not  initiate negotiations with the switch ports on the other side of the channel.
  • All channels should be ready to forward data after they have been configured.

b. Configure all port-channel interfaces as trunks.

c. Configure static trunking on the switch port on  SW-B  that is connected to  Site 2.

Step 5:  Configure Rapid PVST+.

Configure Rapid PVST+  as follows:

a. Activate Rapid PVST+ and set root priorities.

  • All three switches should be configured to run Rapid PVST+.
  • SW-A  should be configured as root primary for  VLAN 2  and  VLAN 4  using the default primary priority values.
  • SW-A  should be configured as  root  secondary for  VLAN 8  and  VLAN 15  using the default secondary priority values.
  • SW-C  should  be configured as root primary  for  VLAN 8  and  VLAN 15  using the default primary priority values.
  • SW-C  should be  configured as root secondary  for  VLAN 2  and  VLAN 4  using the default secondary priority values.

b. Activate PortFast and BPDU Guard on  the  active  SW-C  switch access  ports.

  • On  SW-C, configure PortFast on the access ports that are connected to hosts.
  • On  SW-C,  activate BPDU Guard on the access ports that are connected to hosts.

Step 6:  Configure switch security.

You are required to complete the following only  on some of the devices in the network  for this assessment.  In reality, security should be configured on all devices in the network.

a. Configure port security on all active access ports that have hosts connected on  SW-A.

  • Each active access  port should accept only two MAC addresses before a security action occurs.
  • The learned MAC addresses should be recorded in the running configuration.
  • If a security violation occurs, the switch ports should provide notification that a violation has occurred but  not  place the interface in an  err-disabled  state.

b. On  SW-B, configure the virtual terminal lines to accept  only  SSH connections.

  • Use a domain name of  ccnaPTSA.com.
  • Use  SW-B  as the host name.
  • Use a modulus value of  1024.
  • Configure SSH  version  2.
  • Configure the vty lines to only accept SSH connections.
  • Configure user-based authentication for the SSH connections with a user name ofnetadmin  and a  secret  password of  SSH_secret9. The user  name and password must match the values provided here exactly.

c. Ensure that all unused switch ports on  SW-A  have been secured as follows:

  • They should be assigned to VLAN 99.
  • They should all be in access mode.
  • They should be shutdown.

Step 7: Configure Site 2 as a DHCP server for the hosts attached to the SW-A and SW-C switches.

Configure three DHCP pools as follows:

  • Refer to the information in the Addressing Table.
  • Create a DHCP pool for hosts on  VLAN 2  using the pool name  vlan2pool.
  • Create a DHCP pool for hosts on  VLAN 4  using the pool name  vlan4pool.
  • Create a DHCP pool for hosts on  VLAN 8  using the pool name  vlan8pool.
  • All VLAN pool names  must  match the provided values exactly.
  • Exclude the  first five  addresses from each pool.
  • Configure a DNS server address of  192.168.200.225.
  • All hosts should be able to communication with hosts on other networks.

Step 8: Configure host addressing.

Hosts should be able to ping each other and  external hosts after they have been correctly addressed, where permitted.

  • Hosts on VLANs 2, 4, and 8 should be configured to receive addresses dynamically over DHCP.
  • Hosts on VLAN 15 should be addressed statically as indicated in the  Addressing Table. Once configured,  the hosts should be able to ping hosts on other networks.
  • Hosts on the LANs attached to  Site 1  should be statically assigned addresses that enable them to communicate with hosts on other networks, as indicated in the Addressing Table.

Configuration

#####–SITE 1

hostname East
no ip domain-lookup
enable secret cisco
line console 0
logging synchronous
password cisco
login
line aux 0
password cisco
login
line vty 0 15
password cisco
login
service password-encryption
banner motd @Authorized acces only!@

interface serial 0/0/0
bandwidth 128
clock rate 12800
ip address 192.168.100.22 255.255.255.252
description 2-Central
ip ospf cost 7500
ip ospf message-digest-key 1 md5 xyz_OSPF
ip ospf authentication message-digest
no shutdown
exit

interface gi 0/0
ip address 192.168.8.1 255.255.255.0
description Manage-1A
no shutdown
interface gi 0/1
ip address 192.168.9.1 255.255.255.0
description Clerk-1C
no shutdown
exit

— OSPF
router ospf 1
router-id 1.1.1.1
area 0 authentication message-digest
network 192.168.100.20 0.0.0.3 area 0
network 192.168.8.0 0.0.0.255 area 1
network 192.168.9.0 0.0.0.255 area 1
passive-interface GigabitEthernet0/0
passive-interface GigabitEthernet0/1
no auto-summary
exit

####################
########–HQ

hostname Central
no ip domain-lookup
enable secret cisco
line console 0
logging synchronous
password cisco
login
line aux 0
password cisco
login
line vty 0 15
password cisco
login
service password-encryption
banner motd @Authorized acces only @

ip route 0.0.0.0 0.0.0.0 s0/1/0
interface serial 0/0/0
bandwidth 128
ip address 192.168.100.21 255.255.255.252
description 2-East
ip ospf cost 7500
ip ospf message-digest-key 1 md5 xyz_OSPF
ip ospf authentication message-digest
no shutdown
exit

interface serial 0/0/1
bandwidth 128
ip address 192.168.100.37 255.255.255.252
description 2-West
clock rate 128000
ip ospf message-digest-key 1 md5 xyz_OSPF
ip ospf authentication message-digest
no shutdown
exit

interface serial 0/1/0
bandwidth 128
ip address 203.0.113.18 255.255.255.248
description 2-INTERNET
no shutdown
exit

— OSPF
router ospf 1
router-id 2.2.2.2
area 0 authentication message-digest
default-information originate
network 192.168.100.20 0.0.0.3 area 0
network 192.168.100.36 0.0.0.3 area 0
passive-interface Serial0/1/0
no auto-summary
exit

–ACCESS LIST
ip access-list standard TELNET-BLOCK
permit host 198.51.100.5
line vty 0 15
access-class TELNET-BLOCK in

interface serial 0/1/0
ip access-group 101 in
exit

#######################
###### –SITE 2

hostname West
no ip domain-lookup
enable secret cisco
line console 0
logging synchronous
password cisco
login
line vty 0 15
password cisco
login
service password-encryption
banner motd @Authorized acces only.@

interface serial 0/0/1
bandwidth 128
ip address 192.168.100.38 255.255.255.252
description 2-Central
ip ospf message-digest-key 1 md5 xyz_OSPF
ip ospf authentication message-digest
no shutdown

interface gi 0/1
no shutdown

interface gi 0/1.2
encapsulation dot1q 2
ip address 10.10.2.1 255.255.255.0
interface gi 0/1.4
encapsulation dot1q 4
ip address 10.10.4.1 255.255.255.0
interface gi 0/1.8
encapsulation dot1q 8
ip address 10.10.8.1 255.255.255.0
interface gi 0/1.15
encapsulation dot1q 15
ip address 10.10.15.1 255.255.255.0
interface gi 0/1.25
encapsulation dot1q 25
ip address 10.10.25.1 255.255.255.0
exit

— OSPF
router ospf 1
router-id 3.3.3.3
passive-interface GigabitEthernet0/1
network 192.168.100.36 0.0.0.3 area 0
network 10.10.2.0 0.0.0.255 area 2
network 10.10.4.0 0.0.0.255 area 2
network 10.10.8.0 0.0.0.255 area 2
network 10.10.15.0 0.0.0.255 area 2
no auto-summary
passive-interface g0/1.2
passive-interface g0/1.4
passive-interface g0/1.8
passive-interface g0/1.15
exit

– ROUTE SUMMARIZATION
interface serial 0/0/1
ip summary-address eigrp 100 10.10.0.0 255.255.240.0

– DHCP
ip dhcp excluded-address 10.10.2.1 10.10.2.5
ip dhcp excluded-address 10.10.4.1 10.10.4.5
ip dhcp excluded-address 10.10.8.1 10.10.8.5
ip dhcp pool vlan2pool
network 10.10.2.0 255.255.255.0
default-router 10.10.2.1
dns-server 192.168.200.225
ip dhcp pool vlan4pool
network 10.10.4.0 255.255.255.0
default-router 10.10.4.1
dns-server 192.168.200.225
ip dhcp pool vlan8pool
network 10.10.8.0 255.255.255.0
default-router 10.10.8.1
dns-server 192.168.200.225
exit

–ACCESS LIST
access-list 1 permit 10.10.15.0 0.0.0.255
interface gi0/1.25
ip access-group 1 out

#######–SW-A

hostname Bldg1
no ip domain-lookup
enable secret cisco
line console 0
logging synchronous
password cisco
login
line vty 0 15
password cisco
login
service password-encryption
banner motd @Authorized acces only!@

ip default-gateway 10.10.25.1
vlan 2
name sales
vlan 4
name prod
vlan 8
name acct
vlan 15
name admin
vlan 25
name SVI-NET
vlan 99
name null
interface vlan 25
ip address 10.10.25.254 255.255.255.0
no shutdown

interface fa0/5
switchport mode acces
switchport acces vlan 2

interface fa0/10
switchport mode acces
switchport acces vlan 4

interface fa0/15
switchport mode acces
switchport acces vlan 8

interface fa0/24
switchport mode acces
switchport acces vlan 15

interface range fa0/6-9,fa0/11-14,fa0/16-23
switchport mode acces
switchport acces vlan 99
shutdown

interface range gi1/1-2
switchport mode acces
switchport acces vlan 99
shutdown

– ETHERCHANNEL
interface range fa0/1-2
channel-group 1 mode active
interface port-channel 1
switchport mode trunk
interface range fa0/3-4
channel-group 2 mode active
interface port-channel 2
switchport mode trunk
exit

–PVST+
spanning-tree mode rapid-pvst
spanning-tree vlan 2 root primary
spanning-tree vlan 4 root primary
spanning-tree vlan 8 root secondary
spanning-tree vlan 15 root secondary

–SECURITY
interface fa0/5
switchport port-security
switchport port-security violation restrict
switchport port-security maximum 2
switchport port-security mac-address sticky

interface fa0/10
switchport port-security
switchport port-security violation restrict
switchport port-security maximum 2
switchport port-security mac-address sticky

interface fa0/15
switchport port-security
switchport port-security violation restrict
switchport port-security maximum 2
switchport port-security mac-address sticky

interface fa0/24
switchport port-security
switchport port-security violation restrict
switchport port-security maximum 2
switchport port-security mac-address sticky

#######–SW-B

hostname Bldg2
no ip domain-lookup
enable secret cisco
line console 0
logging synchronous
password cisco
login
line vty 0 15
password cisco
login
service password-encryption
banner motd @Authorized acces only!@

– SSH
ip ssh version 2
ip domain-name ccnaPTSA.com
crypto key generate rsa
username netadmin password SSH_secret9
line vty 0 4
login local
transport input ssh
line vty 5 15
login local
transport input ssh

ip default-gateway 10.10.25.1
vlan 2
name sales
vlan 4
name prod
vlan 8
name acct
vlan 15
name admin
vlan 25
name SVI-NET
vlan 99
name null
interface vlan 25
ip address 10.10.25.253 255.255.255.0
no shutdown
interface gi 1/1
switchport mode trunk

– ETHERCHANNEL
interface range fa0/3-4
channel-group 2 mode active
interface port-channel 2
switchport mode trunk
interface range fa0/5-6
channel-group 3 mode active
interface port-channel 3
switchport mode trunk

–PVST+
spanning-tree mode rapid-pvst

#########– SW-C

hostname Bldg3
no ip domain-lookup
enable secret cisco
line console 0
logging synchronous
password cisco
login
line vty 0 15
password cisco
login
service password-encryption
banner motd @Authorized acces only !@

ip default-gateway 10.10.25.1
vlan 2
name sales
vlan 4
name prod
vlan 8
name acct
vlan 15
name admin
vlan 25
name SVI-NET
vlan 99
name null
interface vlan 25
ip address 10.10.25.252 255.255.255.0
no shutdown

interface fa0/7
switchport mode acces
switchport acces vlan 2

interface fa0/10
switchport mode acces
switchport acces vlan 4

interface fa0/15
switchport mode acces
switchport acces vlan 8

interface fa0/24
switchport mode acces
switchport acces vlan 15

– ETHERCHANNEL
interface range fa0/1-2
channel-group 1 mode active
no shutdown
interface port-channel 1
switchport mode trunk

interface range fa0/5-6
channel-group 3 mode passive
no shutdown
interface port-channel 3
switchport mode trunk

–PVST+
spanning-tree mode rapid-pvst
spanning-tree vlan 2 root secondary
spanning-tree vlan 4 root secondary
spanning-tree vlan 8 root primary
spanning-tree vlan 15 root primary

–Port Fast BPDU Guard
interface range fa0/7, fa0/10, fa0/15, fa0/24
spanning-tree portfast
spanning-tree bpduguard enable
no shutdown