Interpret basic operations of Rapid PVST+ Spanning Tree Protocol

This is the deepest topic in Domain 2. Expect several questions, usually built around a diagram where you must identify the root bridge, the root ports, and which port is blocking. Work through this section slowly and draw the examples on paper.

Why Layer 2 loops are catastrophic

Good network design uses redundant links so that one cable or one switch failing does not take down the building. But Ethernet has no built-in loop protection. An IP packet has a TTL (time to live) that decrements at each router until the packet dies; an Ethernet frame has no TTL, so a frame that enters a loop circles forever. Three things happen:

1. Broadcast storm. A host sends one broadcast (an ARP request, say). SW1 floods it out all ports, including two links toward SW2. SW2 floods each copy out all its ports, including back toward SW1. SW1 floods those again. Within seconds, one broadcast has become millions of copies, every link is at 100% utilization, and every CPU on the segment is busy processing broadcasts. Hosts become unusable. The only cure without STP is to unplug a cable.
2. MAC address table instability. Because copies of the same frame arrive on different ports moments apart, each switch keeps rewriting the entry for the source MAC, flapping between ports. Unicast frames get sent the wrong way, then the right way, then the wrong way.
3. Multiple frame transmission. A host receives several copies of the same unicast frame, confusing protocols that expect exactly one.

Spanning Tree Protocol (STP) prevents all three by logically blocking enough redundant ports to turn the physical mesh into a loop-free tree, while leaving the redundant cables plugged in, ready to be unblocked if an active link fails. The name comes from graph theory: a “spanning tree” is a set of links that reaches every node with no loops.

The STP family

The original 802.1D builds a single tree for the entire switched network (a Common Spanning Tree), so every VLAN is forced to use the same blocked ports even if a different tree would balance traffic better. Cisco’s PVST+ (Per-VLAN Spanning Tree Plus) runs a separate STP instance for each VLAN, letting you make SW1 the root for VLANs 10 and 20 while SW2 is root for VLANs 30 and 40 so both uplinks carry traffic. PVST+ is the default mode on Cisco Catalyst switches, but it still uses the slow 802.1D timers.

802.1w RSTP (Rapid Spanning Tree) kept the same election logic but redesigned the port states and added a handshake so links can go forwarding in a second or two rather than 30 to 50 seconds. Rapid PVST+ is Cisco’s combination: RSTP behavior, one instance per VLAN. This is what the blueprint asks you to interpret, and it is what you should enable on every Cisco switch:

SW1(config)# spanning-tree mode rapid-pvst

RSTP and Rapid PVST+ are backward compatible; a Rapid PVST+ switch that receives an 802.1D BPDU on a port falls back to legacy STP behavior on that port only. The 2004 revision of 802.1D absorbed 802.1w, so today “802.1D-2004” technically means RSTP, but the exam uses 802.1D to mean the old slow protocol.

The Bridge ID (BID)

Every switch identifies itself in STP by a Bridge ID, an 8-byte value made of a 2-byte priority field and the switch’s 6-byte base MAC address. (STP was invented when switches were called bridges; the terms mean the same thing here.) With PVST+ and Rapid PVST+, the 2-byte priority field is split:

Because only 4 bits are available for the configurable priority, it must be a multiple of 4096: 0, 4096, 8192, 12288, 16384, 20480, 24576, 28672, 32768, 36864, 40960, 45056, 49152, 53248, 57344, or 61440. The switch adds the VLAN ID to the priority when displaying it, so the default for VLAN 10 shows as 32778 (32768 + 10), and for VLAN 1 as 32769.

SW1# show spanning-tree vlan 10
VLAN0010
  Spanning tree enabled protocol rstp
  Root ID    Priority    24586
             Address     0011.2233.4455
             Cost        4
             Port        24 (GigabitEthernet0/24)
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec

  Bridge ID  Priority    32778  (priority 32768 sys-id-ext 10)
             Address     00aa.bbcc.dd01
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec
             Aging Time  300 sec

Interface           Role Sts Cost      Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------------------
Gi0/1               Desg FWD 4         128.1    P2p Edge
Gi0/23              Altn BLK 4         128.23   P2p
Gi0/24              Root FWD 4         128.24   P2p

The Root ID block describes the root bridge as this switch understands it; the Bridge ID block describes this switch. When this switch is the root, the output says This bridge is the root under Root ID, and there is no root port. The protocol rstp line confirms Rapid PVST+ mode (it says ieee for PVST+).

Root bridge election

STP first elects one switch per VLAN as the root bridge, the trunk of the tree. All forwarding decisions are then made relative to the root. The rule:

The switch with the lowest Bridge ID becomes root. Compare priority first; if priorities tie, the lowest MAC address wins.

Because every switch ships with priority 32768, in an unconfigured network the root is simply the switch with the lowest MAC address, which is usually the oldest switch, often an old, slow access switch in a closet. That is a poor choice, so you always set the priority deliberately on your core or distribution switch.

The election works by exchanging BPDUs (Bridge Protocol Data Units), which are small frames sent to the multicast MAC 0180.C200.0000 every hello time, 2 seconds by default. A BPDU contains the sender’s BID, the BID of the switch the sender believes is root, the cost to reach that root, and the sender’s port ID. At boot every switch claims to be root. When a switch receives a BPDU with a lower root BID than its own claim, it adopts that root and starts relaying BPDUs about it. Within a few hellos, everyone agrees. In 802.1D only the root originates BPDUs and the others relay them; in RSTP every switch generates its own BPDUs every hello, which is part of what makes failure detection faster.

Configuring the root. Two styles exist:

! Style 1: set an explicit priority (must be a multiple of 4096)
SW1(config)# spanning-tree vlan 10 priority 4096
! Style 2: macro that picks a priority guaranteed to win
SW1(config)# spanning-tree vlan 10 root primary
SW2(config)# spanning-tree vlan 10 root secondary
! Apply to several VLANs at once
SW1(config)# spanning-tree vlan 10,20,30 root primary

root primary looks at the current root’s priority and sets this switch to 24576, or if the current root is already lower than 24576, to 4096 less than the current root. root secondary always sets 28672, which beats the default 32768 but loses to the primary, so this switch takes over if the primary dies. Both are one-time macros: the running config shows the resulting spanning-tree vlan 10 priority 24576 line, not the word “primary,” and the switch will not readjust later if someone else configures a lower priority.

Path cost

After the root is chosen, each switch computes its root path cost: the sum of the port costs along the path toward the root. Only incoming ports count: when a BPDU arrives on a port, the switch adds that port’s cost to the cost carried in the BPDU. Costs are based on link speed.

The short costs (16-bit) were defined when 10 Gbps was the fastest link and cannot distinguish 10 Gbps from 100 Gbps. RSTP defined the 32-bit long method, which Cisco switches support but do not use by default; enable it with spanning-tree pathcost method long if you have links faster than 10 Gbps. The exam uses the short values: memorize 100, 19, 4, 2.

You can override a port’s cost to influence which path is chosen:

SW2(config)# interface gigabitethernet0/24
SW2(config-if)# spanning-tree vlan 10 cost 2

An EtherChannel’s cost is based on its aggregate bandwidth (a 2 x 1 Gbps bundle is treated as 2 Gbps, cost 3 on most platforms), which is another reason a channel is preferred over separate links.

2.5.a Root port, root bridge (primary/secondary), and other port names

Once the root is elected and costs are known, every port gets a role. Here is the algorithm, which you must be able to run by hand on an exam diagram.

Step 1: Root bridge. Lowest BID. All of the root’s ports become designated ports and forward.

Step 2: Root port (RP). Every non-root switch picks exactly one root port: the port with the lowest root path cost. Tiebreakers, in order:

1. Lowest root path cost.
2. Lowest neighbor BID (the BID of the switch sending the BPDU).
3. Lowest neighbor port priority (default 128).
4. Lowest neighbor port number (Gi0/1 beats Gi0/2).

Tiebreakers 3 and 4 only matter when two cables run between the same two switches, which is exactly the case a question will draw. Note that the tiebreak uses the sender’s port priority and number, not the local port’s, which surprises people. Root ports always forward.

Step 3: Designated port (DP). On every network segment (every cable or hub), exactly one port is designated: the port that will forward the segment’s traffic toward the root. It is the port on the switch with the lowest root path cost for that segment. Tiebreakers: lowest BID, then lowest port priority, then lowest port number. All ports on the root bridge are designated. A port at the far end of a segment from a root port is always designated.

Step 4: Everything else blocks. Any port that is neither root nor designated is a non-designated port (802.1D term) and is put in the blocking state. In RSTP it is called an alternate or backup port and is in the discarding state (2.5.b).

Worked example. Three switches in a triangle, all gigabit links (cost 4):

       SW1 (priority 4096, MAC 0000.0000.0001)  <- root
       Gi0/1                             Gi0/2
        |                                  |
       Gi0/1                             Gi0/1
       SW2 (32768, MAC 0000.0000.0002)   SW3 (32768, MAC 0000.0000.0003)
       Gi0/2 -------------------------- Gi0/2

• SW1 has the lowest priority, so SW1 is root. SW1 Gi0/1 and Gi0/2 are designated, forwarding.
• SW2: cost to root via Gi0/1 is 4; via Gi0/2 (through SW3) is 4 + 4 = 8. Root port is Gi0/1.
• SW3: same logic, root port is Gi0/1.
• Segment SW2 Gi0/2 to SW3 Gi0/2: both switches have root path cost 4. Tie. Lowest BID wins: SW2 (MAC …0002) beats SW3 (MAC …0003). SW2 Gi0/2 is designated and forwards.
• SW3 Gi0/2 is neither root nor designated. It blocks (alternate, discarding). The loop is broken.

If the SW1 to SW3 link fails, SW3 stops receiving BPDUs from the root on Gi0/1, and its Gi0/2 (which was still receiving BPDUs from SW2) becomes the new root port. In RSTP that transition takes a second or two; in 802.1D it takes 30 to 50 seconds.

You can also influence a port’s role with port priority, a per-port value from 0 to 240 in steps of 16 (default 128), set with spanning-tree vlan 10 port-priority 64. Remember that the neighbor’s port priority is what the downstream switch uses to pick its root port, so you configure this on the upstream switch (the one closer to the root).

2.5.b Port states and roles

802.1D (and PVST+) port states

Legacy STP moves a port through states slowly to make sure everyone agrees on the topology before any port forwards. The timers are set on the root bridge and copied by every other switch.

The three timers, with defaults:

• Hello (2 s): how often the root sends BPDUs.
• Max age (20 s): how long a switch keeps a stored BPDU before deciding the neighbor is gone (10 hellos missed).
• Forward delay (15 s): how long the port sits in each of listening and learning.

So when a blocked port needs to become forwarding after a failure, the worst case is 20 (max age) + 15 (listening) + 15 (learning) = 50 seconds with no traffic. When a brand-new port comes up it skips blocking and needs 30 seconds. Users notice both. This is the fundamental reason RSTP exists.

RSTP / Rapid PVST+ port states

RSTP collapsed the five states to three. Disabled, blocking, and listening all did the same thing (no learning, no forwarding), so they merged into discarding.

show spanning-tree abbreviates these as BLK (discarding shows as BLK on Cisco), LRN, and FWD. You may also see LIS on a PVST+ switch.

RSTP port roles

RSTP kept root and designated and split the old “blocking” concept in two, because knowing why a port is blocked lets the switch unblock the right one instantly.

An alternate port receives better BPDUs from another switch; it is a ready-to-go replacement for the root port. In the triangle example, SW3 Gi0/2 is an alternate port. If SW3’s root port dies, the alternate goes straight to forwarding with no timers.

A backup port exists only when a switch has two ports on the same shared segment (two cables into the same hub, or a self-loop). It backs up the designated port on that segment. You will rarely see one, but the exam may ask you to define it. show spanning-tree shows the roles as Root, Desg, Altn, and Back.

RSTP link types and how it converges fast

RSTP classifies each port by link type, which determines whether it can use the fast handshake:

On a point-to-point link, when a designated port comes up it sends a proposal BPDU. The neighbor temporarily discards on all its other non-edge designated ports (a “sync” step that guarantees no loop), then replies with an agreement, and both sides go forwarding immediately. This handshake then ripples outward hop by hop. Combined with the fact that every switch sends its own BPDUs every 2 seconds and declares a neighbor dead after three missed hellos (6 seconds, instead of 802.1D’s 20-second max age), most failures now heal in well under 10 seconds and often in under one. Cisco switches detect full duplex automatically and set the link type to point-to-point; you can force it with spanning-tree link-type point-to-point if a full-duplex link is somehow reported as shared.

2.5.c PortFast

When a PC boots and its switch port comes up, normal STP makes the port wait 30 seconds (listening plus learning) before forwarding. Even in RSTP a normal non-edge port waits two forward-delay periods (30 seconds) if nobody answers its proposal, and a PC will never answer. During that time the PC’s DHCP request times out and Windows logs “no network.” But a PC cannot create a loop; only a switch can. PortFast tells the switch “this port connects to an end host; skip the wait and go straight to forwarding.” In RSTP terms it marks the port as an edge port. PortFast ports still send BPDUs and still participate in STP; the only change is the immediate forwarding. If a BPDU is ever received on a PortFast port (someone plugged in a switch), the port instantly loses its PortFast status and behaves normally.

Configure it per port or globally:

! Per interface (access ports only)
SW1(config)# interface gigabitethernet0/1
SW1(config-if)# spanning-tree portfast
%Warning: portfast should only be enabled on ports connected to a single
 host. Connecting hubs, concentrators, switches, bridges, etc... to this
 interface  when portfast is enabled, can cause temporary bridging loops.
 Use with CAUTION
! Global: applies to every port that is in access mode
SW1(config)# spanning-tree portfast default
! Newer IOS-XE uses the "edge" keyword:
SW1(config)# spanning-tree portfast edge default
SW1(config)# interface gigabitethernet0/1
SW1(config-if)# spanning-tree portfast edge
! On a trunk port toward a server or virtualization host (rare):
SW1(config-if)# spanning-tree portfast trunk

The global spanning-tree portfast default form applies only to ports that are operationally access ports. spanning-tree portfast trunk is needed if you want PortFast on a trunk (for example, a VMware host with several VLANs); never use it toward another switch. Verify with show spanning-tree interface gigabitethernet0/1 portfast or look for P2p Edge in the Type column of show spanning-tree.

2.5.d Root guard, loop guard, BPDU filter, and BPDU guard

STP trusts every BPDU it hears. These four features add protection against BPDUs that should not exist, or that should exist but stop arriving.

BPDU Guard

BPDU Guard shuts a port down if any BPDU arrives on it. It is meant for PortFast ports: an end-host port should never receive a BPDU, so if one shows up, either a user plugged in a rogue switch or an attacker is trying to become root. The port goes into the err-disabled state (shown as err-disabled in show interfaces status), which is effectively shut down.

! Per interface
SW1(config)# interface gigabitethernet0/1
SW1(config-if)# spanning-tree portfast
SW1(config-if)# spanning-tree bpduguard enable
! Global: enables BPDU Guard on all PortFast-enabled ports
SW1(config)# spanning-tree portfast bpduguard default

When it fires you see:

%SPANTREE-2-BLOCK_BPDUGUARD: Received BPDU on port GigabitEthernet0/1 with
 BPDU Guard enabled. Disabling port.
%PM-4-ERR_DISABLE: bpduguard error detected on Gi0/1, putting Gi0/1 in
 err-disable state

Recovery has two forms. Manual: fix the problem, then shutdown followed by no shutdown on the interface. Automatic: configure err-disable recovery so the switch re-enables the port after an interval (default 300 seconds) and tries again:

SW1(config)# errdisable recovery cause bpduguard
SW1(config)# errdisable recovery interval 300
SW1# show errdisable recovery
ErrDisable Reason            Timer Status
-----------------            --------------
bpduguard                    Enabled
...
Timer interval: 300 seconds

If the rogue switch is still there, the port comes up, hears a BPDU, and is err-disabled again. show interfaces status err-disabled lists every disabled port and the reason.

BPDU Filter

BPDU Filter stops a port from sending BPDUs at all, and depending on how it is configured, ignores received ones. It is used when you connect to a device that must not see STP frames (a service provider’s network, or a security requirement), but it is dangerous because it removes loop protection on that port. Two configurations behave differently:

• Interface level spanning-tree bpdufilter enable: the port neither sends nor processes BPDUs. It is as if STP were turned off on that port. If a switch is connected, a loop can form silently. Use with great care.
• Global spanning-tree portfast bpdufilter default: applies to PortFast ports and is safer. The port sends a few BPDUs when it comes up and then stops. If a BPDU is ever received, the port loses PortFast and the filter and starts running normal STP.

SW1(config)# spanning-tree portfast bpdufilter default
SW1(config)# interface gigabitethernet0/2
SW1(config-if)# spanning-tree bpdufilter enable

Root Guard

Root Guard protects the position of the root bridge. You enable it on designated ports facing parts of the network that must never contain the root: access switches, other departments, customer equipment. If a superior BPDU (one advertising a better root BID than the current root) arrives on a Root Guard port, the switch refuses to accept it and puts the port into the root-inconsistent state (listed as *ROOT_Inc in show spanning-tree), which is a blocking state. As soon as the superior BPDUs stop, the port recovers automatically; no err-disable, no manual intervention.

SW1(config)# interface gigabitethernet0/10
SW1(config-if)# spanning-tree guard root
%SPANTREE-2-ROOTGUARD_CONFIG_CHANGE: Root guard enabled on port
 GigabitEthernet0/10.

Unlike BPDU Guard, Root Guard allows normal BPDUs; it only rejects BPDUs that would change the root. That makes it suitable for ports toward other switches.

Loop Guard

Loop Guard protects against the opposite problem: a port that stops receiving BPDUs when it should still be getting them. Consider a unidirectional link failure on fiber: SW3’s receive strand fails but its transmit strand still works. SW3 no longer hears BPDUs on its alternate (blocked) port, assumes the neighbor is gone, and after max age moves that port to forwarding. But the neighbor is still there and still forwarding, so now there is a loop.

With Loop Guard on a non-designated port (root or alternate), if BPDUs stop arriving, instead of transitioning to forwarding the port enters the loop-inconsistent state (*LOOP_Inc) and stays blocked. When BPDUs resume, it recovers automatically.

! Per interface
SW3(config)# interface gigabitethernet0/2
SW3(config-if)# spanning-tree guard loop
! Global: all point-to-point ports
SW3(config)# spanning-tree loopguard default

Loop Guard and Root Guard are mutually exclusive on the same port (guard root replaces guard loop). Loop Guard is meaningless on PortFast ports, which never expect BPDUs.

Summary of the four features

Putting STP together: a full configuration and verification

! Core switch: make it root for all user VLANs, backup on the other core
CORE1(config)# spanning-tree mode rapid-pvst
CORE1(config)# spanning-tree vlan 1,10,20,50,99 root primary
CORE1(config)# interface range gigabitethernet1/0/1 - 24
CORE1(config-if-range)# spanning-tree guard root
CORE2(config)# spanning-tree mode rapid-pvst
CORE2(config)# spanning-tree vlan 1,10,20,50,99 root secondary
! Access switch: protect host ports
ACC1(config)# spanning-tree mode rapid-pvst
ACC1(config)# spanning-tree portfast default
ACC1(config)# spanning-tree portfast bpduguard default
ACC1(config)# errdisable recovery cause bpduguard

ACC1# show spanning-tree vlan 10
VLAN0010
  Spanning tree enabled protocol rstp
  Root ID    Priority    24586
             Address     0011.2233.4455
             Cost        4
             Port        49 (GigabitEthernet1/0/49)
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec

  Bridge ID  Priority    32778  (priority 32768 sys-id-ext 10)
             Address     00aa.bbcc.dd01
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec
             Aging Time  300 sec

Interface           Role Sts Cost      Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------------------
Gi1/0/1             Desg FWD 4         128.1    P2p Edge
Gi1/0/2             Desg FWD 4         128.2    P2p Edge
Gi1/0/49            Root FWD 4         128.49   P2p
Gi1/0/50            Altn BLK 4         128.50   P2p
ACC1# show spanning-tree summary
Switch is in rapid-pvst mode
Root bridge for: none
Extended system ID           is enabled
Portfast Default             is enabled
PortFast BPDU Guard Default  is enabled
Portfast BPDU Filter Default is disabled
Loopguard Default            is disabled
...

Reading this: ACC1 is not root (Root ID differs from Bridge ID). Its root port is Gi1/0/49 with cost 4, meaning the root is one gigabit hop away. The uplink Gi1/0/50 is an alternate port, blocked, ready to take over. Host ports show P2p Edge because PortFast is on. show spanning-tree root gives a one-line-per-VLAN view of the root and root port, and show spanning-tree detail shows the number of topology changes and when the last one occurred, useful when hunting for a flapping link.