3.4 MSTP Architecture & Spanning Tree Operations

As enterprise campus networks scale to hundreds of VLANs, network architects face a fundamental dilemma between single spanning tree and per-VLAN spanning tree implementations:

• Single Spanning Tree (IEEE 802.1D/802.1w CST): Runs a single spanning tree instance across all VLANs in the switched fabric. While CPU and memory overhead remain negligible, redundant links are completely blocked for all VLANs simultaneously, leaving 50% of available uplink bandwidth unutilized.
• Per-VLAN Spanning Tree (PVST+ / Junos VSTP): Maintains an independent spanning tree instance for every single VLAN configured on the switch. While this enables load balancing (e.g., VLAN 10 uses Link A while VLAN 20 uses Link B), it imposes severe CPU and control-plane scaling limits. Maintaining 500 active VLANs requires generating and processing 500 distinct BPDU streams every two seconds, exhausting switch CPU resources and causing adjacency timeouts.

---

The IEEE 802.1s Solution: Multiple Spanning Tree Protocol (MSTP)

IEEE 802.1s Multiple Spanning Tree Protocol (MSTP) solves this scalability dilemma by decoupling VLANs from individual spanning tree instances. Instead of running one instance per VLAN or one instance for all VLANs, MSTP maps multiple VLANs to a small, manageable number of logical instances (typically 2 to 4). For example, VLANs 1–250 can map to Instance 1, and VLANs 251–500 can map to Instance 2. This delivers active/active uplink load balancing with minimal CPU and control plane overhead.

---

MSTP Architecture: Regions, CST, IST, and CIST

Understanding MSTP requires distinguishing its hierarchical structural components:

1. The MST Region

An MST Region is an interconnected collection of switches that share identical spanning tree parameters. For two or more switches to reside within the same MST Region, three specific attributes must match identically:

1. Configuration Name: A case-sensitive alphanumeric string (1 to 32 characters) representing the region name.
2. Revision Level: A 16-bit integer (0 to 65,535) denoting the configuration version.
3. VLAN-to-Instance Mapping Digest: A 16-octet (128-bit) MD5 hash calculated from the 4,096-element array mapping VLANs to instance numbers.

Critical Gotcha: The actual VLAN mapping table is never transmitted inside BPDUs. Instead, Junos computes a 16-byte MD5 digest of the mapping table and advertises this signature. If an engineer maps VLAN 99 to Instance 1 on Switch A, but forgets to add VLAN 99 on Switch B, the resulting MD5 hashes differ. Consequently, Switch A and Switch B treat each other as belonging to different MST regions, collapsing inter-switch links into boundary ports and breaking instance load balancing.

2. Spanning Tree Hierarchies

Within and between MST regions, MSTP operates three distinct tree layers:

• Internal Spanning Tree (IST / Instance 0): The mandatory default instance running within every MST region. Instance 0 connects all bridges within the region and calculates a loop-free internal topology. Crucially, MSTP does not transmit individual BPDUs for each MSTI; instead, all MSTI configuration records (M-records) are encapsulated within the single BPDU stream transmitted by the IST.
• Common Spanning Tree (CST): The single spanning tree that interconnects all separate MST regions, as well as any legacy 802.1D or 802.1w bridges in the network. The CST treats each entire MST region as a single opaque "black-box" pseudo-bridge.
• Common and Internal Spanning Tree (CIST): The unified spanning tree topology comprising the external CST connecting regions together plus the internal IST running inside each individual region. One bridge in the entire enterprise network is elected as the CIST Root Bridge.
• Multiple Spanning Tree Instances (MSTIs): Independent spanning tree instances (numbered 1 through 64) that exist strictly inside an MST region. MSTIs never extend beyond regional boundaries. Each MSTI elects its own Regional Root Bridge, calculates its own root path costs, and establishes independent port roles, allowing distinct VLAN groups to forward traffic over opposing physical uplinks.

3. Boundary and Master Ports

• Boundary Port: An interface that connects an MST bridge to a switch in a different MST region or to a bridge running standard STP/RSTP.
• CIST Regional Root: The switch within an MST region that provides the lowest path cost toward the external CIST Root Bridge.
• Master Port: The designated boundary port on the CIST Regional Root that provides the path toward the external CIST Root.

Output note: Command output shown here is a schematic teaching example, not a captured device session. Field names and feature support depend on platform and Junos release.

Configuring MSTP in Junos OS

Configuring MSTP in Junos requires entering the [edit protocols mstp] hierarchy. In the following example, two distribution switches (Dist-A and Dist-B) are configured in region CORP-CAMPUS to achieve active/active load sharing across dual uplinks:

• Dist-A acts as Root for MSTI 1 (VLANs 10–50) with priority 4096, and secondary for MSTI 2 with priority 8192.
• Dist-B acts as Root for MSTI 2 (VLANs 51–100) with priority 4096, and secondary for MSTI 1 with priority 8192.

Configuration on Dist-A:

[edit protocols mstp]
set configuration-name CORP-CAMPUS
set revision-level 1
set bridge-priority 4096

set msti 1 vlan [ 10-50 ]
set msti 1 bridge-priority 4096

set msti 2 vlan [ 51-100 ]
set msti 2 bridge-priority 8192

set interface ge-0/0/0.0
set interface ge-0/0/1.0
set interface ge-0/0/10.0 edge

Configuration on Dist-B:

[edit protocols mstp]
set configuration-name CORP-CAMPUS
set revision-level 1
set bridge-priority 8192

set msti 1 vlan [ 10-50 ]
set msti 1 bridge-priority 8192

set msti 2 vlan [ 51-100 ]
set msti 2 bridge-priority 4096

set interface ge-0/0/0.0
set interface ge-0/0/1.0
set interface ge-0/0/10.0 edge

With this configuration, traffic for VLANs 10–50 forwards across Dist-A while blocking on Dist-B, and traffic for VLANs 51–100 forwards across Dist-B while blocking on Dist-A. If either switch or uplink fails, the alternate switch immediately assumes root forwarding for both instances.

---

Spanning Tree Operational Verification Commands

Junos provides a robust suite of operational commands to verify spanning tree convergence and identify topology anomalies:

1. Verifying Bridge Status: show spanning-tree bridge

Displays the switch's local Bridge ID, the elected Root Bridge ID, root port, and configured timer parameters for the CIST and all local MSTIs:

user@Dist-A> show spanning-tree bridge

STP bridge parameters
Context ID                          : 0
Enabled protocol                    : MSTP

  Root ID                           : 4096.00:05:85:11:22:33
  Root cost                         : 0
  Root port                         : none (is root)
  Hello time                        : 2 seconds
  Maximum age                       : 20 seconds
  Forward delay                     : 15 seconds
  Bridge priority                   : 4096

STP MSTI bridge parameters
  MSTI 1 :
    Bridge priority                 : 4096
    Root ID                         : 4096.00:05:85:11:22:33
    Root cost                       : 0
    Root port                       : none (is root)
  MSTI 2 :
    Bridge priority                 : 8192
    Root ID                         : 4096.00:05:85:aa:bb:cc
    Root cost                       : 20000
    Root port                       : ge-0/0/1.0

2. Verifying Port Roles and States: show spanning-tree interface

Displays the operational role and forwarding state of each interface per instance:

user@Dist-A> show spanning-tree interface

Spanning tree interface parameters for instance 0
Interface    Port ID    Designated    Designated         Port    State      Role
                          port ID     bridge ID          Cost
ge-0/0/0.0    128:513     128:513     4096.000585112233  20000   FWD        DESG
ge-0/0/1.0    128:514     128:514     4096.000585112233  20000   FWD        DESG

Spanning tree interface parameters for MSTI 1
Interface    Port ID    Designated    Designated         Port    State      Role
ge-0/0/0.0    128:513     128:513     4096.000585112233  20000   FWD        DESG
ge-0/0/1.0    128:514     128:514     4096.000585112233  20000   FWD        DESG

Spanning tree interface parameters for MSTI 2
Interface    Port ID    Designated    Designated         Port    State      Role
ge-0/0/0.0    128:513     128:513     4096.000585112233  20000   BLK        ALT
ge-0/0/1.0    128:514     128:514     4096.000585aabbcc  20000   FWD        ROOT

3. Checking BPDU Traffic and Topology Changes: show spanning-tree statistics interface

Identifies whether interfaces are transmitting and receiving BPDUs, and exposes excessive Topology Change (TC) counts:

user@Dist-A> show spanning-tree statistics interface ge-0/0/0.0

Interface   BPDUs sent  BPDUs received  Next BPDU  TC       TC
                                        in (secs)  rx       tx
ge-0/0/0.0  14520       14518           1          2        2

---

Common Spanning Tree Pitfalls and Troubleshooting Workflows

When troubleshooting spanning tree anomalies in production, follow a systematic diagnostic methodology:

1. Unintended Root Bridge Placement: If an access switch boots with default priority 32768 and has a lower MAC address than the distribution core, it can hijack the Root Bridge role. Remedy: Always explicitly configure core and distribution switches with low priorities (e.g., 4096 or 8192) and apply root-protect on access-facing ports.
2. MST Region Parameter Mismatches: Typos in configuration-name, mismatched revision-level, or missing VLAN mappings cause switches to form separate regions. Remedy: Compare the calculated digest signature on both switches using show spanning-tree mstp configuration. If the MD5 hashes do not match identically, audit the VLAN allocations line-by-line.
3. Topology Change Storms: If access interfaces connecting to user PCs are not configured as edge ports, every PC connection/disconnection triggers a TC notification, wiping MAC tables across the campus. Remedy: Inspect show spanning-tree statistics interface for rapidly incrementing TC counts and enforce edge on all host interfaces.
4. Unidirectional Link Failures: A fiber strand break may allow a switch to transmit but not receive BPDUs. The downstream switch ceases hearing BPDUs, transitions its alternate port into forwarding, and forms a destructive loop. Remedy: Enable aggressive Layer 2 link-fault detection mechanisms such as Loop Protect or unidirectional link detection (UDLD).