Questions? Call 1.800.716.8955

Chapter 16

Rapid STP and Spanning Tree Features

Exam topics covered

2.5 Interpret basic operations of Rapid PVST+ Spanning Tree Protocol

2.5.a Root port, root bridge (primary/secondary), and other port names 2.5.b Port states and roles

2.5.c PortFast

2.5.d Root guard, loop guard, BPDU filter, and BPDU guard

Foundation. Classic 802.1D STP builds a correct tree but can take 30 to 50 seconds to react to a change, which is an eternity for voice calls and applications. Rapid Spanning Tree Protocol (RSTP, IEEE 802.1w) keeps the same election rules you learned in Chapter 15 but converges in about a second on point-to-point links. Cisco's Rapid PVST+ runs RSTP per VLAN and is the default on modern Catalyst switches, so it is the version the CCNA blueprint names. This chapter explains what RSTP changes: port states, port roles, link types and the proposal/agreement handshake. It then covers the STP protection features every access-layer engineer configures: PortFast, BPDU Guard, BPDU Filter, Root Guard and Loop Guard.

16.1 RSTP Compared with 802.1D

RSTP is backward compatible with 802.1D: the root bridge election, root port and designated port selection, bridge IDs, port costs and tie-breakers are unchanged. What changes is how fast switches reach the same answer. Instead of waiting for timers to expire, RSTP switches actively negotiate with their neighbors and pre-compute backup paths.

Table 16-1 802.1D STP versus 802.1w RSTP

  • Characteristic 802.1D STP 802.1w RSTP
  • Port states Disabled, blocking, listening,
  • learning, forwarding
  • Discarding, learning, forwarding

Port roles Root, designated, (non-designated)Root, designated, alternate, backup (plus disabled)

  • Who originates
  • BPDUs
  • Only the root; others relay Every switch, every hello (2 s)

Failure detection Max age, 20 s 3 missed hellos, 6 s (or immediately on link loss)

Backup path Recomputed after a failure Alternate port pre-selected; moves to forwarding immediately

  • Topology change TCN sent to root, root notifies
  • all
  • Any switch floods TC BPDUs directly; MACs
  • flushed at once

RSTP builds in the ideas of Cisco's older PortFast, UplinkFast and BackboneFast enhancements. A port that hears 802.1D BPDUs falls back to 802.1D on that port, so mixed networks still work, just slowly at the boundary.

16.2 RSTP Port States and Roles

16.2.1 Port states

802.1D's blocking and listening states behave the same from a data point of view: neither forwards frames nor learns addresses. RSTP merges them, together with disabled, into one state called discarding. RSTP therefore has three states: discarding (no forwarding, no learning), learning (learns MACs, does not forward) and forwarding.

Exam alert

On Cisco IOS, show spanning-tree still prints BLK for a discarding port even in Rapid PVST+ mode. For the exam, the RSTP state names are discarding, learning, forwarding; the old names blocking and listening belong to 802.1D.

16.2.2 Port roles

RSTP keeps the root port and designated port roles and splits 802.1D's non-designated ports into two roles that describe what kind of backup they offer (Figure 16-1): Root port: the best path to the root bridge (one per non-root switch).

Designated port: the best port on a segment, forwarding toward the leaves. Alternate port: receives a superior BPDU from another switch. It is a pre-computed replacement for the root port; if the root port fails, the alternate port becomes root port and forwards immediately.

Backup port: receives a superior BPDU from another port on the same switch. This only happens when two ports of one switch connect to the same shared segment (a hub). It backs up the designated port on that segment.

Disabled: shut down or without link.

Alt

  • SW1
  • Root bridge
  • SW2

Rpc 4

SW3

Rpc 4

Bkp

Figure 16-1 RSTP port roles. SW3 Gi0/2 is an alternate port (backup path to the root through SW2). SW3 Gi0/4 is a backup

port: it hears SW3's own Gi0/3 on the same hub segment.

16.3 Link Types and Edge Ports

RSTP's fast handshake is only safe on links where exactly two switches talk to each other. RSTP therefore classifies each port by link type (Figure 16-2):

Point-to-point: a full-duplex link between two switches. Proposal/agreement works here, so convergence is rapid. Shown as P2p .

Shared: a half-duplex link, assumed to lead to a hub with possibly several switches attached. RSTP falls back to timer-based transitions. Shown as Shr .

Edge: a port connected to an end device, configured with PortFast. It goes straight to forwarding, and its state changes do not trigger topology changes. Shown as Edge (for example P2p Edge ).

Figure 16-2 RSTP link types. Duplex determines point-to-point or shared automatically; edge status comes from the PortFast configuration.

You can override the duplex-derived link type with spanning-tree link-type {point-to-point | shared} .

16.4 How RSTP Converges

16.4.1 Proposal and agreement

When a new point-to-point link comes up (or a better path appears), the upstream switch's designated port starts in discarding and sends a BPDU with the proposal flag set: "I want to be designated and forward on this link". The downstream switch must make sure that forwarding will not create a loop through itself. It performs a sync: it moves all of its own non-edge designated ports to discarding (edge ports and ports already discarding are untouched). Now it cannot form a loop, so it replies on its new root port with an agreement. The upstream port moves to forwarding immediately. The downstream switch then sends proposals on its own designated ports, and the handshake ripples outward toward the edge, one link at a time (Figure 16-3).

SW1 (upstream) SW2 SW3 (downstream)

  • 1. New link: Gi0/2 is

designated, discarding

  • 2. Proposal
  • 3. Sync: SW2 puts its non-edge

designated ports (to SW3)

into discarding

  • 4. Agreement
  • 5. Gi0/2 forwards at once;

SW2 root port forwards

  • 6. Proposal
  • 7. Agreement
  • 8. SW2 to SW3 forwards; the wave

continues toward the edge

Figure 16-3 Proposal/agreement sync. Each link transitions to forwarding as soon as the switch below it agrees, so the tree

converges in well under a second without waiting for timers.

16.4.2 Failure handling and topology changes

A neighbor silent for three hellos (6 seconds) is declared gone, and loss of link is detected immediately. If the root port fails, an alternate port becomes root port and forwards at once. When a non-edge port moves to forwarding, RSTP detects a topology change. The switch flushes MACs learned on its other non-edge ports and sends BPDUs with the TC flag out those ports; each receiver does the same. There is no TCN round trip to the root, and edge ports never cause topology changes.

16.5 Rapid PVST+ and MST

Rapid PVST+ is Cisco's per-VLAN RSTP: one RSTP instance per VLAN, with all of the per-VLAN load-balancing and configuration of PVST+ from Chapter 15. Enable it with one global command; every spanning-tree vlan command (priority, root primary/secondary, cost) continues to work.

AS1(config)# spanning-tree mode rapid-pvst

AS1 — console

AS1# show spanning-tree vlan 10

Vlan0010

  • Spanning tree enabled protocol rstp
  • Root ID Priority 24586
  • Address 5254.00a1.0001
  • Cost 4
  • Port 49 (GigabitEthernet1/1/1)
  • Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
  • Bridge ID Priority 32778 (priority 32768 sys-id-ext 10)
  • Address 5254.00a1.0003
  • Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
  • Aging Time 300 sec
  • Interface Role Sts Cost Prio.Nbr Type

------------------- ---- --- --------- -------- -------------------------------- Gi1/0/5 Desg FWD 4 128.5 P2p Edge

Figure 16-4 Rapid PVST+ output: protocol rstp, an edge port (P2p Edge), a shared half-duplex port (Shr), and an alternate port

that IOS still shows as BLK. Output in this chapter is illustrative of Cisco IOS XE. Multiple Spanning Tree (MST, IEEE 802.1s, now part of 802.1Q) maps many VLANs to a small number of spanning tree instances. If 200 VLANs only ever need two logical topologies, MST runs two instances (plus the internal instance 0) instead of 200, saving CPU and BPDUs. Switches form an MST region only when they share the same region name, revision number and VLAN-to-instance mapping. MST is the standards-based choice in multivendor networks; for the CCNA you need only to recognize it and its mode command, spanning-tree mode mst . In show spanning-tree , the protocol line reads ieee for PVST+, rstp for Rapid PVST+ and mstp for MST.

16.6 PortFast

A PC or IP phone cannot create a loop, yet without help its port waits through listening and learning (30 seconds in 802.1D) before forwarding, and DHCP may time out. PortFast declares the port an edge port: it moves to forwarding as soon as the link comes up, and it does not cause topology changes when it flaps.

AS1(config)# interface range gigabitethernet1/0/1 - 24
AS1(config-if-range)# switchport mode access
AS1(config-if-range)# spanning-tree portfast ! "spanning-tree portfast edge" on newer

Ios

AS1(config)# spanning-tree portfast default ! all access ports; "portfast edge
default" on newer IOS
AS1(config)# interface gigabitethernet1/0/40
AS1(config-if)# spanning-tree portfast trunk ! trunk to a server or hypervisor

The global portfast default applies only to access-mode ports (exclude one with spanning-tree portfast disable ); a trunk to a hypervisor can use spanning-tree portfast trunk . IOS warns you when you enable PortFast that it "should only be enabled on ports connected to a single host". Connecting a switch or hub to a PortFast port can create a temporary loop, which is why PortFast is almost always paired with BPDU Guard. A PortFast port still runs STP: if it receives a BPDU it loses edge status and behaves as a normal port.

16.7 BPDU Guard

End devices never send BPDUs, so a BPDU on an edge port means someone has plugged in a switch. BPDU Guard reacts to any received BPDU by putting the port into the err-disabled state, which shuts it down.

AS1(config)# spanning-tree portfast bpduguard default ! all PortFast ports
AS1(config)# interface gigabitethernet1/0/10
AS1(config-if)# spanning-tree bpduguard enable ! this port, PortFast or not
AS1(config-if)# spanning-tree bpduguard disable ! exempt from the global default

AS1 — console

AS1#

*Oct 4 09:12:41.337: %SPANTREE-2-BLOCK_BPDUGUARD: Received BPDU on port Gi1/0/10 with BPDU Guard enabled. Disabling port.

*Oct 4 09:12:41.338: %PM-4-ERR_DISABLE: bpduguard error detected on Gi1/0/10, putting Gi1/0/10 in err-disable state

*Oct 4 09:12:42.339: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/10, changed state to down

AS1# show interfaces status err-disabled

Port Name Status Reason Err-disabled Vlans

Gi1/0/10 Conference room err-disabled bpduguard

Figure 16-5 BPDU Guard err-disables Gi1/0/10 when a switch is connected to it.

16.7.1 Recovering from err-disabled

An err-disabled port stays down until it is recovered. First remove the cause (unplug the switch). Then either recover it manually with shutdown followed by no shutdown on the interface, or configure automatic recovery so that the switch retries after a timer (default 300 seconds):

AS1(config)# errdisable recovery cause bpduguard
AS1(config)# errdisable recovery interval 120 ! seconds, 30-86400

Exam alert

The global command spanning-tree portfast bpduguard default protects only ports on which PortFast is enabled. The interface command spanning-tree bpduguard enable works on any port. BPDU Guard err-disables the port; Root Guard and Loop Guard put the port in an inconsistent (blocking) state that clears automatically.

16.8 BPDU Filter

BPDU Filter suppresses BPDUs, and its behavior depends on how it is enabled: Globally ( spanning-tree portfast bpdufilter default ): applies to PortFast ports. The port sends a few BPDUs when the link comes up (about 10 to 12 at hello intervals), then stops sending. If it ever receives a BPDU, it loses PortFast and BPDU filter status and behaves as a normal STP port. This is a relatively safe way to keep BPDUs off host links. Per interface ( spanning-tree bpdufilter enable ): the port neither sends nor processes received BPDUs. STP is effectively disabled on that port, and a loop through it will not be detected.

Watch out

Interface-level BPDU Filter can cause exactly the broadcast storms STP exists to prevent. Use it only at deliberate boundaries, such as a link to a service provider or another administrative domain that must not exchange BPDUs. If BPDU Filter and BPDU Guard are both configured on a port, BPDU Filter wins, because Guard never sees a BPDU.

16.9 Root Guard

Nothing stops a newly connected switch with priority 0 from becoming root and dragging traffic through an access closet. Root Guard enforces where the root may be. On a port with Root Guard, if a superior BPDU arrives (one that would make the root reachable through that port), the port is placed in the root-inconsistent state, which is blocking. The port continues to listen; as soon as superior BPDUs stop arriving, it recovers on its own.

Figure 16-6 Root Guard. A rogue switch with priority 0 connected to AS1 would become root; Root Guard on that port blocks it instead and leaves DS1 as root.

Apply Root Guard on designated ports that should never lead to the root: distribution-layer downlinks to access switches, and access ports where other switches may be connected. Never apply it on a port that is, or could legitimately become, a root port.

DS1(config)# interface range gigabitethernet1/0/1 - 2
DS1(config-if-range)# spanning-tree guard root
AS1(config)# interface gigabitethernet1/0/24
AS1(config-if)# spanning-tree guard root

AS1 — console

AS1#

*Oct 4 10:02:17.921: %SPANTREE-2-ROOTGUARD_BLOCK: Root guard blocking port GigabitEthernet1/0/24 on VLAN0010.

AS1# show spanning-tree vlan 10 | begin Interface

Interface Role Sts Cost Prio.Nbr Type

------------------- ---- --- --------- -------- -------------------------------- Gi1/0/5 Desg FWD 4 128.5 P2p Edge

  • Gi1/0/24 Desg BKN*4 128.24 P2p *ROOT_Inc
  • Gi1/1/1 Root FWD 4 128.49 P2p
  • Gi1/1/2 Altn BLK 4 128.50 P2p

Figure 16-7 Root Guard in action: the port shows BKN* (broken) with the *ROOT_Inc flag. It is also listed by show spanning-tree inconsistentports.

16.10 Loop Guard

STP assumes that a port which stops receiving BPDUs has lost its neighbor. That assumption fails on a unidirectional link, for example a fiber pair whose transmit strand is broken in one direction. In Figure 16-8, SW3's alternate port stops receiving BPDUs from SW2 even though the link is still up and SW3's frames still reach SW2. After the BPDU information ages out, SW3 decides it is now designated on that link and starts forwarding, creating a loop. DP

  • RP
  • DP
  • RP
  • DP
  • Gi0/2

Alt

Figure 16-8 A unidirectional link. Without Loop Guard, SW3 Gi0/2 stops hearing BPDUs, becomes designated and forwards, creating a loop.

Loop Guard prevents this. On a root or alternate port with Loop Guard, if BPDUs stop arriving, the port moves to the loop-inconsistent (blocking) state instead of becoming designated. When BPDUs resume, the port recovers automatically. Apply it on non-designated ports, typically the uplinks of access switches and the inter-switch links between distribution switches; it does not work on edge ports and should not be combined with Root Guard on the same port.

AS1(config)# spanning-tree loopguard default ! all point-to-point ports
AS1(config)# interface gigabitethernet1/1/2
AS1(config-if)# spanning-tree guard loop ! one port

UDLD (UniDirectional Link Detection) complements Loop Guard by detecting one-way fiber links and err-disabling them.

16.11 Choosing the Right Feature

In a typical two-tier campus, PortFast and BPDU Guard go on every access port, Loop Guard on the access switches' uplinks, and Root Guard on the distribution switches' downlinks. Table 16-2 summarizes the features.

Table 16-2 STP protection features

Bpdu

Exam alert

Pairings to memorize: Root Guard reacts to superior BPDUs; BPDU Guard reacts to any BPDU; Loop Guard reacts to the absence of BPDUs. Only BPDU Guard err-disables the port.

LAB Rapid PVST+ with edge protection

Goal: Convert the network in Figure 16-9 to Rapid PVST+, make DS1 the root for VLAN 10 with DS2 as backup, configure PortFast and BPDU Guard on AS1's access ports, Root Guard on the distribution downlinks, and Loop Guard on AS1's uplinks. Then test BPDU Guard by connecting a switch to Gi1/0/10.

Figure 16-9 Lab topology. PC1 and a test switch connect to access ports on AS1.

  • 1. On DS1, DS2 and AS1: spanning-tree mode rapid-pvst .
  • 2. Configure the roots, edge protection, Loop Guard and Root Guard:
DS1(config)# spanning-tree vlan 10 root primary
DS1(config)# interface gigabitethernet1/0/1
DS1(config-if)# spanning-tree guard root
DS2(config)# spanning-tree vlan 10 root secondary
DS2(config)# interface gigabitethernet1/0/1
DS2(config-if)# spanning-tree guard root
AS1(config)# spanning-tree portfast default
AS1(config)# spanning-tree portfast bpduguard default
AS1(config)# errdisable recovery cause bpduguard
AS1(config)# interface range gigabitethernet1/1/1 - 2
AS1(config-if-range)# spanning-tree guard loop
  • 3. Connect the test switch to Gi1/0/10 and watch for %SPANTREE-2-BLOCK_BPDUGUARD ; confirm with show interfaces status err-disabled . Remove it and confirm the port recovers after the recovery interval.

Verify:

AS1, DS1 — console

AS1# show spanning-tree summary | include mode|Portfast|BPDU Guard
  • Switch is in rapid-pvst mode
  • Portfast Default is disabled
  • PortFast BPDU Guard Default is enabled
AS1# show spanning-tree interface gi1/1/2 detail | include guard|Loop

Loop guard is enabled on the port

DS1# show spanning-tree interface gi1/0/1 detail | include Root guard

Root guard is enabled on the port

Figure 16-10 Verification of the mode, PortFast, BPDU Guard default, Loop Guard and Root Guard.

Expected results: Gi1/0/5 shows P2p Edge and forwards as soon as PC1 connects. Shutting AS1's root port moves the alternate uplink to forwarding in about a second. Chapter review

  • 1. Which three are RSTP port states? (Choose three.)
  • A. Blocking
  • B. Discarding
  • C. Listening
  • D. Learning
  • E. Forwarding
  • 2. Which RSTP port role provides a pre-computed replacement for the root port through a different switch?
  • A. Designated
  • B. Backup
  • C. Alternate
  • D. Edge
  • 3. A switch has two ports connected to the same hub. One is designated. What is the role of the other?
  • A. Alternate
  • B. Backup
  • C. Root
  • D. Disabled
  • 4. Which link type allows RSTP to use the proposal/agreement handshake?
  • A. Shared
  • B. Point-to-point
  • C. Half duplex
  • D. Any link with PortFast
  • 5. During the RSTP sync process, what does the downstream switch do before sending an agreement?
  • A. Puts its non-edge designated ports into discarding
  • B. Waits for forward delay to expire
  • C. Sends a TCN BPDU to the root
  • D. Err-disables all edge ports
  • 6. Which command enables Cisco's per-VLAN implementation of RSTP?
  • A. spanning-tree mode rstp
  • B. spanning-tree mode rapid-pvst
  • C. spanning-tree mode mst
  • D. spanning-tree rapid enable
  • 7. An engineer configures spanning-tree portfast bpduguard default . Which ports are protected?
  • A. All ports
  • B. Only trunk ports
  • C. Only ports with PortFast enabled
  • D. Only ports with Root Guard enabled
  • 8. A port protected by BPDU Guard receives a BPDU. Which two methods restore it? (Choose two.)
  • A. shutdown then no shutdown after removing the device
  • B. It recovers automatically when BPDUs stop, with no configuration
  • C. errdisable recovery cause bpduguard
  • D. spanning-tree guard root
  • E. clear spanning-tree detected-protocols
  • 9. Which feature places a port in a blocking state when it receives a superior BPDU, and recovers automatically?
  • A. BPDU Guard
  • B. Loop Guard
  • C. Root Guard
  • D. PortFast
  • 10. What problem does Loop Guard address?
  • A. Rogue switches becoming root
  • B. Unidirectional links causing a blocked port to forward
  • C. Slow DHCP on access ports
  • D. Too many STP instances
  • 11. Which two statements about interface-level BPDU Filter ( spanning-tree bpdufilter enable ) are true? (Choose two.)
  • A. The port neither sends nor processes BPDUs.
  • B. It err-disables the port when a BPDU arrives.
  • C. It can allow a loop to form through the port.
  • D. It applies only to trunk ports.
  • E. It moves the port into root-inconsistent state.
  • 12. In Rapid PVST+, show spanning-tree lists a port as Desg FWD 4 128.5 P2p Edge . What does "Edge" indicate?
  • A. The port is an EtherChannel member
  • B. PortFast is enabled on the port
  • C. The port connects to the root bridge
  • D. The port is half duplex

Answers

  • 1. B, D, E. Discarding replaced disabled, blocking and listening.
  • 2. C. An alternate port hears a superior BPDU from another switch.
  • 3. B. Same switch, same shared segment: backup port.
  • 4. B. Proposal/agreement needs a point-to-point, non-edge link.
  • 5. A. Sync blocks non-edge designated ports so no loop can form.
  • 6. B. rapid-pvst ; mst selects MST.
  • 7. C. The global form covers PortFast ports only.
  • 8. A, C. Err-disabled ports need a manual bounce or errdisable recovery.
  • 9. C. Root Guard: superior BPDU, root-inconsistent, automatic recovery.
  • 10. B. Loop Guard keeps root/alternate ports blocked when BPDUs stop.
  • 11. A, C. Interface BPDU Filter effectively disables STP on the port.
  • 12. B. Edge = PortFast-enabled RSTP edge port.
Use ← → to move between sections