Spanning Tree Protocol: STP, RSTP, and MSTP on Cisco

Introduction

Spanning Tree Protocol prevents Layer 2 loops in switched networks. STP (802.1D), RSTP (802.1w), and MSTP (802.1s) are three generations of the same core idea. Modern networks use RSTP or MSTP — STP is too slow (30-50 second convergence) for production.

Why Loops Are Dangerous

Without STP, a Layer 2 loop causes a broadcast storm: frames circulate endlessly, consuming all bandwidth and crashing switches within seconds. STP blocks redundant paths while keeping them available for failover.

STP Port States

State	Forwards data?	Duration
Blocking	No	Until topology change
Listening	No	15 seconds
Learning	No (learns MACs)	15 seconds
Forwarding	Yes	Normal operation
Disabled	No	Manually disabled

RSTP reduces this to: Discarding, Learning, Forwarding — with convergence in 1-2 seconds.

Basic STP/RSTP on Cisco

CISCO

! Enable RSTP (Rapid Spanning Tree)
spanning-tree mode rapid-pvst

! Set root bridge for VLAN 10
spanning-tree vlan 10 priority 4096
! Or use macro:
spanning-tree vlan 10 root primary

! Set secondary root
spanning-tree vlan 10 root secondary

! Check STP status
show spanning-tree vlan 10
show spanning-tree summary

Understanding Port Roles and States

CISCO

show spanning-tree vlan 10

! Output shows:
! Root ID  Priority    4096
!          Address     aabb.cc00.0100
!          Cost        4
!          Port        Gi0/1 (Root Port)
!
! Bridge ID Priority    32778
!
! Interface   Role  Sts  Cost    Prio.Nbr Type
! Gi0/0       Desg  FWD  4       128.1    P2p
! Gi0/1       Root  FWD  4       128.2    P2p  ← connected to root
! Gi0/2       Altn  BLK  4       128.3    P2p  ← blocked redundant path

STP Tuning for Faster Convergence

CISCO

! PortFast: Skip listening/learning on access ports (for servers/PCs)
interface GigabitEthernet0/1
 spanning-tree portfast

! Or enable globally for all access ports
spanning-tree portfast default

! BPDU Guard: Shutdown port if BPDU received on portfast port
interface GigabitEthernet0/1
 spanning-tree bpduguard enable

! Or globally
spanning-tree portfast bpduguard default

! BPDU Filter: Don't send/receive BPDUs (use carefully!)
interface GigabitEthernet0/1
 spanning-tree bpdufilter enable

Root Guard and Loop Guard

CISCO

! Root Guard: Prevent inferior switch from becoming root
! Apply on ports facing access layer
interface GigabitEthernet0/1
 spanning-tree guard root

! Loop Guard: Detect unidirectional links (one-way fiber failure)
! Apply on non-designated ports
interface GigabitEthernet0/2
 spanning-tree guard loop

! Enable globally
spanning-tree loopguard default

MSTP (Multiple Spanning Tree)

MSTP allows multiple STP instances, each controlling multiple VLANs. This enables load balancing across redundant links.

CISCO

! Configure MSTP
spanning-tree mode mst

spanning-tree mst configuration
 name CompanyNet
 revision 1
 instance 1 vlan 1-100    ! Instance 1 handles VLANs 1-100
 instance 2 vlan 101-200  ! Instance 2 handles VLANs 101-200
 exit

! Set root for each instance on different switches
! Switch A: Root for Instance 1
spanning-tree mst 1 priority 4096

! Switch B: Root for Instance 2
spanning-tree mst 2 priority 4096

! Result: Switch A forwards VLANs 1-100, Switch B forwards VLANs 101-200
! Both redundant links are ACTIVE, just for different VLANs!

Troubleshooting STP Issues

CISCO

! Find current root bridge
show spanning-tree vlan 10 | include Root ID

! Find topology change history
show spanning-tree detail | include topology

! Monitor STP events
debug spanning-tree events

! Clear topology change counters
clear spanning-tree counters interface GigabitEthernet0/1

! Check BPDU counters
show spanning-tree interface GigabitEthernet0/1 detail

Common STP Problems and Fixes

Problem: Slow convergence after a link failure

Fix: Enable PortFast on access ports, verify RSTP is enabled

Problem: Unexpected root bridge election

Fix: Set explicit priorities on all switches, enable Root Guard on uplinks

Problem: Intermittent connectivity (STP reconverging frequently)

Check for unidirectional links using Loop Guard
Look for TCN (Topology Change Notification) storm: show spanning-tree detail | include TCN

Problem: Station can't communicate despite connected

Check if port is in BLK state: show spanning-tree vlan X
Verify BPDU Guard hasn't err-disabled the port: show interfaces status err-disabled