Spanning Tree Protocol (STP) and RSTP

Spanning Tree Protocol (STP) prevents Layer 2 loops in switched networks with redundant links. Without STP, broadcast storms, MAC address table instability, and duplicate frame delivery would cripple the network.

Why STP Is Necessary

Redundant links between switches are essential for high availability. But at Layer 2, redundant links create loops:

• Broadcast storms: Broadcasts circle endlessly between switches, consuming all bandwidth
• MAC table instability: The switch learns the same MAC address on multiple ports, causing constant updates
• Duplicate frames: End hosts receive multiple copies of the same frame

STP solves these problems by logically blocking redundant links, creating a loop-free tree topology while maintaining backup paths.

Root Bridge Election

The root bridge is the central point of the spanning tree. All traffic flows through or toward the root bridge.

Bridge ID (BID)

The Bridge ID determines root bridge election:

Root bridge election rules:

1. The switch with the lowest Bridge Priority becomes root
2. If priorities are equal, the switch with the lowest MAC address wins

Configuring Root Bridge

Switch(config)# spanning-tree vlan 10 root primary      ! Sets priority to 24576
Switch(config)# spanning-tree vlan 10 root secondary     ! Sets priority to 28672
Switch(config)# spanning-tree vlan 10 priority 4096      ! Manual priority setting

On the Exam: Remember that priority must be set in multiples of 4096 (0, 4096, 8192, 12288, 16384, 20480, 24576, 28672, 32768, ...). The default priority is 32768.

STP Port Roles

How Ports Are Selected

Root port selection (per non-root switch):

1. Lowest root path cost (sum of all link costs to the root)
2. Lowest sender Bridge ID
3. Lowest sender port priority
4. Lowest sender port number

STP Path Costs:

STP Port States (Classic STP — 802.1D)

Total convergence time for classic STP: 30-50 seconds (max age + listening + learning)

RSTP (Rapid Spanning Tree Protocol — 802.1w)

RSTP significantly improves convergence time compared to classic STP—converging in seconds instead of 30-50 seconds.

RSTP Port States

RSTP Port Roles

How RSTP Achieves Faster Convergence

1. Proposal/Agreement mechanism: Switches negotiate port roles directly instead of waiting for timers
2. Alternate port: Pre-determined backup root port that activates immediately
3. Edge ports: Ports connected to end devices transition immediately to forwarding
4. No listening state: The listening state is eliminated (combined into discarding)

Rapid PVST+ (Per-VLAN Rapid Spanning Tree)

Rapid PVST+ runs a separate RSTP instance for each VLAN. This allows:

• Different root bridges for different VLANs (load balancing)
• Per-VLAN topology optimization
• VLAN-specific tuning

Switch(config)# spanning-tree mode rapid-pvst    ! Enable Rapid PVST+

Example: Load balancing across two switches

! On Switch A — root for VLANs 10-20
Switch-A(config)# spanning-tree vlan 10-20 root primary

! On Switch B — root for VLANs 21-30
Switch-B(config)# spanning-tree vlan 21-30 root primary

STP Protection Mechanisms (v1.1 additions)

PortFast

Allows access ports to skip listening and learning, transitioning directly to forwarding.

Switch(config-if)# spanning-tree portfast          ! Per-interface
Switch(config)# spanning-tree portfast default      ! All access ports globally

Warning: Only enable PortFast on ports connected to end devices, never on switch-to-switch links.

BPDU Guard

Shuts down a port if it receives a BPDU. Used with PortFast to prevent accidental loops.

Switch(config-if)# spanning-tree bpduguard enable           ! Per-interface
Switch(config)# spanning-tree portfast bpduguard default     ! Globally on PortFast ports

BPDU Filter

Suppresses BPDU sending and receiving on a port. Effectively disables STP on the port.

Switch(config-if)# spanning-tree bpdufilter enable

Caution: BPDU Filter is dangerous—it removes STP protection. Use with extreme care and only in specific scenarios (e.g., service provider connections).

Root Guard

Prevents a port from becoming a root port. If a superior BPDU is received, the port is placed in root-inconsistent (blocking) state.

Switch(config-if)# spanning-tree guard root

Use case: Apply on distribution switch ports facing access switches to prevent an access switch from ever becoming root.

Loop Guard

Prevents a port from transitioning to forwarding if BPDUs stop being received (which could indicate a unidirectional link failure).

Switch(config-if)# spanning-tree guard loop

STP Verification Commands

Switch# show spanning-tree                       ! All VLANs
Switch# show spanning-tree vlan 10                ! Specific VLAN
Switch# show spanning-tree interface Gi0/1        ! Specific port
Switch# show spanning-tree summary                ! Summary with root status
Switch# show spanning-tree root                   ! Root bridge info for all VLANs

On the Exam: STP is heavily tested. Know root bridge election (lowest priority + MAC wins), port roles (root, designated, alternate), RSTP convergence (proposal/agreement), and the protection mechanisms (PortFast, BPDU Guard, root guard, loop guard) added in v1.1.