5.2 Spanning Tree Protocols: STP, RSTP, and MSTP

Spanning Tree Protocols: STP, RSTP, and MSTP

Quick Summary: In modern enterprise campus topologies, redundant physical cabling between access, aggregation, and core switches is essential to eliminate single points of failure. However, redundant Layer 2 links inevitably form physical bridging loops. Because Ethernet frame headers lack a Time-to-Live (TTL) mechanism, unmanaged Layer 2 loops trigger catastrophic broadcast storms, MAC address table thrashing, and duplicate packet delivery within milliseconds. Spanning Tree protocols mathematically calculate a loop-free, active logical tree topology by dynamically blocking redundant backup links. While legacy IEEE 802.1D STP converges slowly (30–50 seconds), IEEE 802.1w Rapid STP (RSTP) delivers sub-second convergence, and IEEE 802.1s Multiple STP (MSTP)—the default on Aruba AOS-CX—groups VLANs into instances to achieve scalable load balancing across uplinks.

---

The Hazards of Layer 2 Redundancy

At Layer 3 (the Network layer), both IPv4 and IPv6 packets feature loop-mitigation headers: the IPv4 Time-to-Live (TTL) field and the IPv6 Hop Limit field. Each router decrements this value by 1; if the counter reaches 0, the router discards the packet. In sharp contrast, standard Layer 2 Ethernet frames contain no TTL or hop counter. Once an Ethernet frame enters a physical loop, it circulates indefinitely until physical links are unplugged or switch hardware crashes.

An uncontrolled Layer 2 loop produces three devastating network failures:

1. Broadcast Storms: Broadcast frames (e.g., ARP requests, DHCP Discover) are flooded out every active port in a VLAN. In a physical loop (such as three switches connected in a triangle), each switch receives the broadcast frame, duplicates it, and floods it to neighboring switches. Within seconds, millions of circulating broadcast frames consume 100% of link bandwidth, saturating switch backplanes and exhausting control plane CPUs.
2. MAC Address Table Thrashing (Flapping): Layer 2 switches learn endpoint locations by examining the Source MAC address of incoming frames. When a broadcast or flooded unicast frame circulates rapidly around a loop, the switch receives identical source MAC addresses alternately across different physical interfaces (e.g., port 1/1/1, then port 1/1/2, then port 1/1/1 again). The switch continuously overwrites its MAC address table (CAM table), rendering unicast forwarding completely dysfunctional.
3. Multiple Frame Transmission: End-user devices receive identical, duplicate copies of unicast frames, corrupting upper-layer application dialogues and crashing client operating systems.

---

Evolution of Spanning Tree Standards: 802.1D, 802.1w, and 802.1s

To prevent loops while maintaining redundant physical cabling, the IEEE developed a progression of open-standard protocols:

---

Root Bridge Election Mechanics and Bridge ID Structure

Every Spanning Tree topology converges around a single central reference point known as the Root Bridge. The election of the Root Bridge is fully deterministic, governed by the Bridge Identifier (BID).

Under modern IEEE standards (including 802.1w and 802.1s), the 8-byte (64-bit) Bridge Identifier consists of three components:

+-----------------------------------------------------------------------------------+
|                                 BRIDGE IDENTIFIER (BID)                           |
|                                                                                   |
|  |<----------------- 2 Bytes (16 bits) ------------------>|<-- 6 Bytes (48b) -->|  |
|  +---------------------------+----------------------------+---------------------+  |
|  | Bridge Priority (4 bits)  | System ID Extension (12b)  | Base MAC Address    |  |
|  | Multiples of 4096         | VLAN ID or MSTP Instance ID| Switch Chassis MAC  |  |
|  +---------------------------+----------------------------+---------------------+  |
+-----------------------------------------------------------------------------------+

1. Bridge Priority (4 bits): Configured by the network administrator. Because only the 4 most significant bits are used, priority values can only be set in multiples of 4096 (0, 4096, 8192, 12288, 16384, 20480, 24576, 28672, 32768 [factory default], 36864, 40960, 45056, 49152, 53248, 57344, 61440).
2. System ID Extension (12 bits): Encodes the specific VLAN ID (in PVST+) or MSTP Instance ID (in MSTP). This allows a single switch chassis with one base MAC address to generate unique BIDs for multiple spanning tree instances.
3. Base MAC Address (48 bits / 6 bytes): The unique hardware MAC address burned into the switch backplane or chassis management module.

The Election Hierarchy

All switches periodically transmit Bridge Protocol Data Units (BPDUs) advertising their BID:

1. Lowest Priority Wins: The switch advertising the lowest numerical Bridge Priority is elected Root Bridge (e.g., a priority of 0 or 4096 defeats the factory default of 32768).
2. MAC Address Tiebreaker: If two or more switches share the exact same lowest configured priority, the switch with the lowest numerical base MAC address wins the election.

Enterprise Design Principle: Never leave Spanning Tree priority at the factory default of 32768. An unconfigured access switch with an older, numerically lower MAC address could inadvertently win the election, pulling all campus transit traffic through a low-speed access switch. Core/aggregation switches should be explicitly configured as the primary root (priority 0) and secondary root (priority 4096).

AOS-CX syntax: the command takes a multiplier of 4096, from 0 to 15 (default 8). spanning-tree priority 0 gives priority 0, and spanning-tree priority 1 gives 4096.

---

Spanning Tree Port Roles and Operational States

Once the Root Bridge is elected, Spanning Tree calculates the shortest loop-free path from every non-root switch back to the Root Bridge based on Root Path Cost (calculated from link speeds: 10 Gbps = cost 2,000; 1 Gbps = cost 20,000; 100 Mbps = cost 200,000 under the 802.1t path cost standard).

Port Roles in RSTP / MSTP

Every switch interface in the spanning tree topology is assigned one of four distinct roles:

1. Root Port (RP): The single port on a non-root switch that has the lowest administrative Path Cost to the Root Bridge. Each non-root switch has exactly one Root Port. Root Ports actively forward user data.
2. Designated Port (DP): The port on a physical network segment (link) that advertises the lowest Path Cost back to the Root Bridge. Every link has exactly one Designated Port. All active ports on the Root Bridge are Designated Ports. Designated Ports actively forward user data.
3. Alternate Port (AP): An interface that provides an alternate, redundant path to the Root Bridge, discarding data traffic. An Alternate Port receives superior BPDUs from a neighboring switch. If the local Root Port fails, the Alternate Port immediately transitions to the Root Port role.
4. Backup Port (BP): An interface that provides a redundant path to the same shared segment, receiving superior BPDUs from the same switch. Rare in switched full-duplex topologies.

Port States Comparison

While legacy 802.1D used five states (Disabled, Blocking, Listening, Learning, Forwarding), RSTP and MSTP streamline operation into three states:

The RSTP Proposal/Agreement Handshake

In legacy 802.1D, moving a port from Blocking to Forwarding required waiting through the Listening timer (15 seconds) and Learning timer (15 seconds), taking 30 to 50 seconds to converge. RSTP eliminates these timers on point-to-point full-duplex links through the Proposal/Agreement handshake:

1. A switch port coming up sends a BPDU with the Proposal flag set.
2. The downstream switch performs a Sync operation, temporarily setting all non-edge designated ports to Discarding to prevent temporary loops.
3. The downstream switch immediately returns a BPDU with the Agreement flag set.
4. The upstream port transitions directly from Discarding to Forwarding within milliseconds.

Ports connected to end-user workstations do not participate in handshakes; administrators designate them as Edge Ports (spanning-tree port-type admin-edge), allowing them to transition directly to Forwarding with zero delay.

---

MSTP Architecture: Regions, Instances, and CIST

While running a separate spanning tree instance for every individual VLAN (Per-VLAN Spanning Tree) provides traffic engineering, it severely degrades switch performance in campus environments with hundreds of VLANs because the switch CPU must generate and process hundreds of distinct BPDU streams every two seconds.

Multiple Spanning Tree Protocol (MSTP - IEEE 802.1s) solves this by decoupling VLANs from spanning tree instances. Administrators group hundreds of VLANs into a small number of logical Multiple Spanning Tree Instances (MSTIs)—typically two to four instances.

MSTP Region Requirements

An MSTP Region is an interconnected collection of switches that view and execute the same instance mappings. For two or more switches to reside in the same MSTP Region, three attributes must match identically:

1. Configuration Name (config-name): An alphanumeric string (up to 32 characters) identifying the region.
2. Configuration Revision Number (config-revision): A 16-bit integer (0 to 65535) used to track administrative revisions.
3. VLAN-to-Instance Mapping Table: The exact assignment of VLAN IDs to MST instances.

If any of these three parameters differ between two neighboring switches, they treat each other as residing in different MSTP regions. Communication between different regions, or between an MSTP region and a legacy 802.1D/802.1w network, is managed seamlessly by the Common and Internal Spanning Tree (CIST) and the Internal Spanning Tree (IST / Instance 0).

Uplink Load Balancing with Multiple Instances

By configuring two MST instances, network architects achieve active-active uplink load balancing:

• Instance 1 (VLANs 10, 20): Aggregation Switch A is Root Bridge (Priority 0); Aggregation Switch B is Secondary (Priority 4096). Traffic for VLANs 10 and 20 flows primarily through Switch A.
• Instance 2 (VLANs 30, 40): Aggregation Switch B is Root Bridge (Priority 0); Aggregation Switch A is Secondary (Priority 4096). Traffic for VLANs 30 and 40 flows primarily through Switch B.

---

AOS-CX Spanning Tree Configuration and Tuning

AOS-CX switches enable MSTP globally by default. The following commands configure an AOS-CX switch as the Primary Root Bridge for MST Instance 1 (priority multiplier 0 = 0) and Secondary Root for MST Instance 2 (multiplier 1 = 4096) within an enterprise region:

switch# configure terminal

! Step 1: Enable Spanning Tree globally and verify MSTP mode
switch(config)# spanning-tree
switch(config)# spanning-tree mode mstp

! Step 2: Configure MSTP Region Parameters
switch(config)# spanning-tree config-name CAMPUS-CORE
switch(config)# spanning-tree config-revision 1
switch(config)# spanning-tree instance 1 vlan 10,20
switch(config)# spanning-tree instance 2 vlan 30,40

! Step 3: Configure Root Bridge Priorities for Instances
switch(config)# spanning-tree priority 0
switch(config)# spanning-tree instance 1 priority 0
switch(config)# spanning-tree instance 2 priority 1

! Step 4: Configure Access Edge Ports for Host Interfaces
switch(config)# interface 1/1/1-1/1/24
switch(config-if-<1/1/1-1/1/24>)# spanning-tree port-type admin-edge
switch(config-if-<1/1/1-1/1/24>)# exit

Essential Verification Commands

---

Common Exam Traps

• Priority Multiplier Syntax: STP priorities are multiples of 4096 (0-61440). AOS-CX expects the multiplier (0-15), so spanning-tree priority 1000 is rejected and spanning-tree priority 1 means 4096.
• MSTP Region Mismatch: If two switches have identical configuration names and revision numbers but differ by even one VLAN in their instance mapping (e.g., Switch A maps VLAN 10-20 to Instance 1 while Switch B maps VLAN 10-21), they will not form a single MSTP region. Instead, they will communicate across the boundary via CIST/IST.
• Default Mode Awareness: The factory default spanning tree mode on Aruba AOS-CX is MSTP, whereas older legacy systems or other vendors often default to PVST+ or RPVST+.
• Alternate vs. Backup Role: An Alternate Port blocks traffic because it receives a superior BPDU from another switch (providing an alternate path to root). A Backup Port blocks traffic because it receives a superior BPDU from the same switch across a shared collision domain (hub).