4 Spanning Tree Protocol

Why spanning tree is needed

Redundant Layer 2 links improve availability, but multiple active paths can create Ethernet loops. Because Ethernet frames have no Layer 2 hop limit, loops can cause broadcast storms, duplicate frames, and MAC-address table instability.

The Spanning Tree Protocol (STP) prevents these problems by maintaining a loop-free active path and placing redundant paths in standby. If an active link fails, STP can recalculate and activate a redundant path.

Per-VLAN topology and BPDUs

In common Cisco PVST+ and Rapid PVST+ deployments, STP calculates a separate tree for each VLAN. A trunk can therefore forward traffic for one VLAN while blocking traffic for another. Switches exchange Bridge Protocol Data Units (BPDUs) and use information including bridge IDs and path costs to compare paths and determine the active topology.

Root election, port roles, and states

For each spanning-tree instance, switches elect one root bridge. The switch with the lowest bridge ID wins: compare configured bridge priority first, with the lower priority preferred; if priorities tie, compare MAC addresses. With default priorities, the lowest MAC address wins. The root bridge is the reference point for path-cost calculations and has no root port.

Port roles describe what ports do in the topology, while port states describe whether they are forwarding or discarding traffic. In RSTP, forwarding ports carry traffic; discarding ports do not. Learning is an intermediate state: a port learns MAC addresses but does not yet forward user traffic.

How port roles shape the topology

Each non-root switch selects a root port, the port providing its best path toward the root. For each LAN segment, STP selects a designated port to forward and advertise that segment’s best path toward the root.

RSTP also defines standby roles. An alternate port offers another path toward the root and normally discards data frames until needed. A backup port provides a redundant connection to the same shared segment as a designated port; it is uncommon in switched Ethernet networks.

Example: a redundant triangle

Suppose switches A, B, and C form a triangle, and A is the root for VLAN 10. B and C each choose their best path toward A as a root port. On the remaining B–C link, STP selects one end as designated and the other as a standby path. That link does not forward for VLAN 10 in the stable topology, preventing the triangle from forming a forwarding loop. If a path toward A fails, STP can recalculate and use the standby connection.

When paths have equal cost, STP uses additional bridge and port identifiers to break the tie. Do not assume the physically shortest-looking path will win; check the VLAN’s actual STP state and cost.

Inspecting spanning tree

On Cisco IOS-style switches, use these commands to inspect a particular VLAN and the overall STP status:

In the VLAN output, check which switch is identified as root, the local switch’s root port, each interface’s role and state, and its path cost. Compare both ends of a link and confirm that the VLAN is present on the trunk. A trunk can carry several VLANs, each with its own spanning-tree result. Command options and output can vary by platform.

Choosing the intended root

Choose the intended root deliberately, typically on a reliable, well-connected distribution or core switch, rather than leaving the election to default priorities and MAC addresses. On a Cisco IOS-style switch, the following commands make it the preferred root and designate a likely backup for VLAN 10:

These commands adjust priorities; they do not guarantee the outcome if another switch has a more favorable bridge ID. Verify the actual root after configuration.

Influencing path selection

STP normally prefers the path with the lower total cost. To steer a VLAN toward a particular link, configure a cost on that interface and verify the resulting roles:

A lower cost makes the path more attractive. Use care because changing a cost can alter which redundant link blocks.

Protecting end-device ports

PortFast is for ports connected to end devices such as PCs and printers. It allows a port to enter forwarding quickly, but it is not a replacement for STP on switch-to-switch links.

BPDU Guard protects these edge ports. If a protected port receives a BPDU, it is disabled, typically entering an err-disabled state, rather than allowing an unexpected bridge to affect the topology. Use it only when the port is intended for an end device, not another switch. Follow local procedures to investigate and recover a port disabled by BPDU Guard.

Keeping an unexpected root from taking over

Root Guard belongs on a designated port where a superior BPDU must not be allowed to make the neighboring switch the root. If a superior BPDU arrives, the port enters a root-inconsistent state and stops forwarding until the condition clears. Root Guard is not a general-purpose feature for every port; apply it where the intended root’s position should be enforced.

Applying the checks to common problems

For an unexpected root on VLAN 10, check bridge IDs and priorities with show spanning-tree vlan 10, set the intended root and backup, and then verify the result.

If the wrong redundant link blocks, compare root-path costs and port roles on both switches. If needed, adjust the VLAN’s interface cost on the path STP should prefer, then verify the new topology.

If a port becomes err-disabled after a switch is connected, check for BPDU Guard. Confirm whether the port should be an edge port or a switch link before restoring it or changing its protection.

If a downstream switch sends a superior BPDU and must not become root, check whether Root Guard is appropriate on the designated port toward it.

• Bridge Protocol Data Unit (BPDU)