7.2 Spanning Tree Protocol Mechanics

7.2 Spanning Tree Protocol Mechanics

Core Blueprint Focus: Cisco 350-401 ENCOR v1.2 topic 3.1.c (configure and verify RSTP and MST) covers Spanning Tree Protocol operations across enterprise campus networks. Candidates must analyze 802.1D STP vs. 802.1w Rapid Spanning Tree (RSTP / Rapid PVST+) convergence mechanisms, master port roles and states, evaluate the Proposal/Agreement sync handshake, and design scalable Multiple Spanning Tree (MST / 802.1s) multi-region hierarchies.

Ethernet networks lack a Time-to-Live (TTL) or hop-count mechanism in the Layer 2 header. If redundant physical paths exist between switches without an active loop-prevention algorithm, broadcast, multicast, and unknown unicast frames circulate indefinitely, triggering broadcast storms, MAC address table thrashing/instability, and multiple frame duplication that completely saturate switch CPU and link bandwidth within seconds.

1. STP Foundations & 802.1D Operations

The original IEEE 802.1D Spanning Tree Protocol (STP) builds a loop-free logical tree topology by electing a single Root Bridge and transitioning redundant switch ports into a blocking state.

+-----------------------------------------------------------------------------------+
|                         BRIDGE IDENTIFIER (BID) FORMAT                            |
+-----------------------------------------------------------------------------------+
| Legacy 802.1D Bridge ID (8 Bytes):                                                |
| +-----------------------------------+-------------------------------------------+ |
| |      Bridge Priority (2 Bytes)    |             MAC Address (6 Bytes)         | |
| |            (0 - 65535)            |            (Switch Hardware Base)         | |
| +-----------------------------------+-------------------------------------------+ |
|                                                                                   |
| 802.1t / PVST+ Extended System ID Format (8 Bytes):                               |
| +---------------------+-----------------------+---------------------------------+ |
| |  Priority (4 Bits)  |  Sys-ID-Ext (12 Bits) |      MAC Address (6 Bytes)      | |
| |  (Multiples of 4096)|       (VLAN ID)       |     (Switch Hardware Base)      | |
| +---------------------+-----------------------+---------------------------------+ |
+-----------------------------------------------------------------------------------+

Bridge ID & Root Bridge Election

• Bridge Priority (4 bits): Configurable in increments of 4096 (e.g., 0, 4096, 8192, 16384, 20480, 24576, 28672, 32768, ... 61440). Default is 32768.
• System ID Extension (12 bits): Carries the VLAN ID (1 to 4094), allowing Per-VLAN Spanning Tree (PVST+ / RPVST+) to maintain unique Bridge IDs per VLAN.
• MAC Address (48 bits): The unique hardware base MAC address of the switch supervisor.
• Election Criterion: The switch with the lowest Bridge ID (Priority + System ID Extension + MAC Address) becomes the Root Bridge for that spanning tree instance.

Spanning Tree Path Cost & Port Roles

Once the Root Bridge is elected, all non-root switches determine the shortest loop-free path to the Root Bridge based on cumulative Root Path Cost:

802.1D Port Roles & Four-Step Decision Tiebreaker

1. Root Port (RP): Exactly one port on each non-root switch with the lowest cumulative path cost to the Root Bridge. Forwards traffic.
2. Designated Port (DP): Exactly one port per physical segment that forwards traffic away from the Root Bridge toward that segment.
3. Non-Designated / Blocking Port (NDP / ALT): All other ports that receive BPDUs but do not forward traffic, breaking the Layer 2 loop.

+-----------------------------------------------------------------------------------+
|                    STP FOUR-STEP PATH SELECTION TIEBREAKER                        |
+-----------------------------------------------------------------------------------+
|  1. Lowest Cumulative Root Path Cost                                              |
|  2. Lowest Neighbor Bridge ID (Sender BID)                                        |
|  3. Lowest Neighbor Port Priority / Port ID (Sender Port Number: Priority.Number) |
|  4. Lowest Local Port ID (Local Priority.Number - e.g., Gi1/0/1 over Gi1/0/2)   |
+-----------------------------------------------------------------------------------+

802.1D Port States & Timers (30-50 Second Convergence)

In legacy 802.1D, bringing an interface into service requires waiting $15\text{s (Listening)} + 15\text{s (Learning)} = 30\text{ seconds}$. Recovering from an indirect link failure requires $20\text{s (Max Age)} + 15\text{s} + 15\text{s} = 50\text{ seconds}$.

2. Rapid Spanning Tree Protocol (IEEE 802.1w / RSTP)

IEEE 802.1w (RSTP) fundamentally re-architects spanning tree convergence. Instead of passively waiting for fixed timers (Max Age and Forward Delay) to expire, RSTP uses an active Proposal/Agreement handshake on point-to-point links to transition ports to Forwarding in milliseconds.

RSTP Port Roles Comparison

+-----------------------------------------------------------------------------------+
|                             RSTP PORT ROLES TOPOLOGY                              |
+-----------------------------------------------------------------------------------+
|                                                                                   |
|                               +-------------------+                               |
|                               |    ROOT BRIDGE    |                               |
|                               +-------------------+                               |
|                                 /               \                                 |
|                   Designated   /                 \  Designated                    |
|                      Port [DP]/                   \[DP] Port                      |
|                              /                     \                              |
|                             v                       v                             |
|                     +-------------+           +-------------+                     |
|                     |  Switch B   |           |  Switch C   |                     |
|                     +-------------+           +-------------+                     |
|                     | Root Port   |           | Root Port   |                     |
|                     |   [RP]      |           |   [RP]      |                     |
|                     +-------------+           +-------------+                     |
|                       [DP]     \                 /     [DP]                       |
|             Designated Port     \               /  Alternate Port                 |
|                                  v             v    [ALT - Discarding]            |
|                               +-------------------+                               |
|                               |     Switch D      |                               |
|                               +-------------------+                               |
+-----------------------------------------------------------------------------------+

• Root Port (RP): The single port on a non-root bridge providing the lowest cost path to the Root Bridge. State: Forwarding.
• Designated Port (DP): The port on a segment responsible for forwarding traffic away from the Root Bridge onto that segment. State: Forwarding.
• Alternate Port (ALT): A port offering an alternative path toward the Root Bridge. It receives BPDUs from other switches and acts as an immediate hot-standby replacement for the switch's local Root Port if the primary RP fails. State: Discarding.
• Backup Port (BKUP): A port providing a redundant path to the same segment on a shared collision domain (e.g., connected through a legacy hub). It receives BPDUs generated by its own switch. State: Discarding.

RSTP Port States

RSTP consolidates 802.1D's Disabled, Blocking, and Listening states into a single operational state: Discarding.

RSTP Link Types & Edge Ports

RSTP determines its fast-convergence capability based on the Link Type:

1. Edge Port (PortFast): Connected directly to an end host (PC, server, printer). It transitions immediately to Forwarding upon link-up, bypassing listening/learning. Edge ports never generate Topology Change (TC) notifications when links flap. If an edge port receives a BPDU, it immediately loses edge status and behaves as a regular RSTP port.
2. Point-to-Point Link (P2P): Operates in Full-Duplex mode connecting directly to another switch. Uses the rapid Proposal/Agreement handshake.
3. Shared Link: Operates in Half-Duplex mode. RSTP falls back to legacy 802.1D timer-based convergence.

3. Proposal/Agreement Handshake & RSTP Topology Changes

Step-by-Step Proposal/Agreement Handshake Mechanics

1. Link Initialization: When a full-duplex point-to-point link comes up between Switch A (Upstream) and Switch B (Downstream), both ports initially enter the Discarding state.
2. Proposal Transmission: Switch A believes it is designated for this link and transmits a configuration BPDU with the Proposal bit set to 1.
3. The Synchronization (Sync) Process:
   • Switch B receives the Proposal. Because Switch A offers a superior Bridge ID/Cost, Switch B acknowledges that this link will become its new Root Port.
   • To prevent temporary forwarding loops during the transition, Switch B initiates a Sync operation: it immediately transitions all of its non-edge Designated Ports into the Discarding state.
   • Edge ports (PortFast) and Alternate/Backup ports are unaffected.
4. Agreement Return: Once all non-edge downstream ports are safely synchronized in the Discarding state, Switch B sends a BPDU back to Switch A with the Agreement bit set to 1.
5. Immediate Forwarding: Upon receiving the Agreement BPDU, Switch A immediately transitions its port to Forwarding (zero timer delay). Switch B transitions its Root Port to Forwarding and repeats the Proposal handshake downstream to subsequent switches.

RSTP Topology Change (TC) Mechanics

In legacy 802.1D, any port transitioning up or down generated a Topology Change Notification (TCN) BPDU that had to travel all the way to the Root Bridge before the Root flooded a TC flag across the domain.

In 802.1w RSTP, topology changes operate with direct localized flooding:

• TC Trigger: A Topology Change is generated ONLY when a non-edge port transitions to the Forwarding state. A port going down does NOT trigger a TC.
• TC Flooding: The switch that detected the transition starts a tcWhile timer equal to $2 \times \text{Hello Time}$ (4 seconds). It transmits BPDUs with the TC bit set out all active non-edge Designated and Root ports.
• Fast MAC Address Flushing: When a switch receives a BPDU with the TC bit set, it immediately purges all MAC addresses learned on all non-edge ports (except the port on which the TC BPDU arrived). It does not wait for a 15-second or 300-second aging timer.

4. Multiple Spanning Tree Protocol (IEEE 802.1s / MSTP)

In Cisco Rapid Per-VLAN Spanning Tree Plus (RPVST+), the switch creates an independent Spanning Tree instance for every single configured VLAN. In enterprise networks with 500 VLANs, a switch must generate and process 500 BPDUs every 2 seconds, consuming excessive CPU cycles, memory, and ASIC bandwidth.

Multiple Spanning Tree Protocol (MSTP / IEEE 802.1s) solves this scaling crisis by decoupling VLANs from spanning tree instances. It maps hundreds of VLANs into a small number of Multiple Spanning Tree Instances (MSTIs) (e.g., Instance 1 for odd VLANs, Instance 2 for even VLANs).

+-----------------------------------------------------------------------------------+
|                         MST REGION & INSTANCE HIERARCHY                           |
+-----------------------------------------------------------------------------------+
|                                                                                   |
|  +-----------------------------------------------------------------------------+  |
|  |                       MST REGION: "CAMPUS-REGION-1"                         |  |
|  |   Configuration Name: CAMPUS-REGION-1 | Revision: 1 | Mapping Digest: MD5   |  |
|  |                                                                             |  |
|  |   +---------------------------------------------------------------------+   |  |
|  |   | IST (Instance 0) - Internal Spanning Tree                           |   |  |
|  |   | - Connects all switches inside the region                           |   |  |
|  |   | - Communicates with external CST / PVST+ legacy domains             |   |  |
|  |   +---------------------------------------------------------------------+   |  |
|  |                                                                             |  |
|  |   +---------------------------------+   +-------------------------------+   |  |
|  |   | MSTI 1 (Instance 1)             |   | MSTI 2 (Instance 2)           |   |  |
|  |   | - Maps VLANs: 10, 20, 30        |   | - Maps VLANs: 40, 50, 60      |   |  |
|  |   | - Root: Switch-A (Distribution) |   | - Root: Switch-B (Distributn) |   |  |
|  |   +---------------------------------+   +-------------------------------+   |  |
|  +-----------------------------------------------------------------------------+  |
|                                         |                                         |
|                              CIST / CST | Boundary Links                          |
|                                         v                                         |
|  +-----------------------------------------------------------------------------+  |
|  |                   EXTERNAL CST / PVST+ / OTHER MST REGIONS                  |  |
+-----------------------------------------------------------------------------------+

MST Region Attributes

An MST Region is a collection of interconnected switches that execute the same MSTI topology. For switches to belong to the same MST Region, they must match on three exact attributes:

1. Configuration Name: Case-sensitive string (up to 32 characters, e.g., CAMPUS-CORE).
2. Revision Number: 16-bit integer (0 to 65535). Must be incremented manually by the administrator when mappings change; does not auto-increment.
3. VLAN-to-Instance Mapping Table: An exact mapping of VLANs (1 to 4094) to MST instances. The switch computes an MD5 digest hash over the 4096-entry table and advertises this 16-byte signature in BPDUs. If the hash differs by a single VLAN mapping, the switches are placed into different regions!

MST Tree Concepts: IST, CST, CIST, and MSTI

• IST (Internal Spanning Tree / Instance 0): The default spanning tree instance running inside every MST region. It collects BPDU information for the entire region and represents the entire region as a single virtual bridge to external networks.
• CST (Common Spanning Tree): The single spanning tree that interconnects all distinct MST regions and any legacy 802.1D/802.1w bridges in the network.
• CIST (Common and Internal Spanning Tree): The unified overarching spanning tree topology comprising the CST outside regions and the IST inside each region.
• MSTI (Multiple Spanning Tree Instance): User-configured instances (1 to 4094) that exist strictly inside an MST region. MSTI BPDUs are never transmitted outside the region; they are encapsulated inside the single IST BPDU (M-Record TLVs).
• CIST Regional Root: The switch within an MST region that has the lowest path cost toward the global CIST Root Bridge. Boundary ports on the Regional Root forward or block for the entire region.

5. Cisco IOS-XE Spanning Tree Configuration & Verification

1. Rapid PVST+ Configuration

! Configure Rapid PVST+ globally
Switch(config)# spanning-tree mode rapid-pvst

! Set Bridge Priority for specific VLANs (Root Primary / Secondary)
Switch-A(config)# spanning-tree vlan 10,20 root primary
Switch-A(config)# spanning-tree vlan 30,40 root secondary
! (Alternatively, specify explicit priority in increments of 4096:)
Switch-A(config)# spanning-tree vlan 10 priority 4096

! Configure access ports as Edge Ports with BPDU Guard
Switch-A(config)# interface range GigabitEthernet 1/0/1 - 24
Switch-A(config-if-range)# spanning-tree portfast
Switch-A(config-if-range)# spanning-tree bpduguard enable

2. Multiple Spanning Tree (MST) Configuration

! Step 1: Enable MST globally
Switch(config)# spanning-tree mode mst

! Step 2: Configure MST Region parameters
Switch(config)# spanning-tree mst configuration
Switch(config-mst)# name CAMPUS-REGION-1
Switch(config-mst)# revision 1
Switch(config-mst)# instance 1 vlan 10,20,30
Switch(config-mst)# instance 2 vlan 40,50,60
Switch(config-mst)# exit

! Step 3: Configure Instance Priorities
Switch(config)# spanning-tree mst 1 priority 4096
Switch(config)# spanning-tree mst 2 priority 8192

3. Verification & Troubleshooting Commands

! Verify MST Region configuration and MD5 digest
Switch# show spanning-tree mst configuration
Name      [CAMPUS-REGION-1]
Revision  1   Instances configured 3

Digest    : 0x9A4E7F20B6D105C8A33E2B8940C155E2

Instance  Vlans mapped
--------  ---------------------------------------------------------------------
0         1-9,11-19,21-29,31-39,61-4094
1         10,20,30
2         40,50,60
-------------------------------------------------------------------------------

! Inspect specific MST Instance topology
Switch# show spanning-tree mst 1

##### MST1    vlans mapped:   10,20,30
Bridge        address 5006.0420.0001  priority  4097  (4096 sysid 1)
Root          this switch is the root

Interface        Role Sts Cost      Prio.Nbr Type
---------------- ---- --- --------- -------- --------------------------------
Gi1/0/48         Desg FWD 20000     128.48   P2p
Gi1/0/49         Desg FWD 20000     128.49   P2p