# Days 20, 21, 22: Spanning Tree Protocol # Spanning Tree Protocol (STP & RSTP): CCNA Reference Sheet --- ## Core Problem & Solution **Problem:** Redundant network paths (for reliability) create Layer 2 loops → broadcast storms and MAC flapping → network collapse. **Solution:** STP prevents loops by blocking redundant ports while maintaining backups. **Key Concept:** STP creates a loop-free **spanning tree** topology; redundant links disabled until primary fails. --- ## Core Definitions **Broadcast Storm:** Frame loops indefinitely in network, multiplying copies exponentially; consumes all bandwidth; causes network collapse. **MAC Address Flapping:** Same MAC address seen on different ports in rapid succession due to looping frames; switch continuously updates MAC table; packet forwarding becomes unreliable. **Spanning Tree Protocol (STP):** Layer 2 protocol preventing loops by blocking some ports (BLOCKING state) while enabling others (FORWARDING); runs by default on all Cisco switches. **Bridge Protocol Data Unit (BPDU):** STP message sent every 2 seconds (Hello Timer) containing bridge ID, root bridge ID, cost to root, and port ID; used for root election and topology discovery. **Bridge ID:** 2-byte priority + 6-byte MAC address; lowest bridge ID wins root election (priority first, then MAC). **Root Bridge:** "Center" of spanning tree topology; reference point for all cost calculations; all its ports are DESIGNATED and FORWARDING. **Root Port:** ONE port per switch (except root) closest to root bridge; determined by lowest cost path to root; FORWARDING state. **Designated Port:** ONE port per segment (collision domain) with lowest cost to root; FORWARDING state; other port in segment is NON-DESIGNATED. **Non-Designated Port:** Remaining ports in segments; BLOCKING state; serves as backup/redundant link. --- ## Root Bridge Election & Bridge ID **Election Rule:** Lowest bridge ID becomes root; if tied, lowest MAC address breaks tie. **Bridge ID Structure:** ``` Priority (2 bytes) + MAC Address (6 bytes) ``` **Priority:** - Default: 32768 - Must be in increments of 4096: 0, 4096, 8192, 12288, 16384, 20480, 24576, 28672, 32768... - Lower = higher priority for root - Minimum: 0 (highest priority) **Example Election:** ``` SW1: Priority 32768 + MAC 00:1a:2b:3c:4d:5e SW2: Priority 32768 + MAC 00:1a:2b:3c:4d:5f Same priority → compare MAC SW1 has lower MAC → SW1 becomes ROOT BRIDGE ``` **Configuration:** ``` Switch(config)# spanning-tree vlan 1 root primary → Sets priority to 24576 (likely to be root) Switch(config)# spanning-tree vlan 1 root secondary → Sets priority to 28672 (backup root; takes over if primary fails) ``` --- ## STP Costs & Path Selection **Classic STP Port Costs (by link speed):**

Speed	Cost
10 Mbps	100
100 Mbps (FastEth)	19
1 Gbps (GigabitEth)	4
10 Gbps	2

**RSTP Port Costs (larger scale):**

Speed	Cost
10 Mbps	2,000,000
100 Mbps	200,000
1 Gbps	20,000
10 Gbps	2,000

**Cost Calculation:** - Only **outgoing ports** have costs (incoming ports don't) - Cumulative cost = sum of costs on path to root - Lower cost = preferred path - Switch selects **root port** = interface with lowest cost to root bridge --- ## STP Port Roles & Selection **Port Role Selection Order:** 1. **Elect Root Bridge** (lowest bridge ID) → all its ports = DESIGNATED, FORWARDING 2. **Non-root switches select ROOT PORT** (lowest cost to root; tiebreaker: lowest neighbor bridge ID, then lowest neighbor port ID) 3. **For each segment, elect DESIGNATED PORT** (lowest cost from that switch; tiebreaker: lowest bridge ID, then lowest port ID) 4. **Remaining ports = NON-DESIGNATED** (BLOCKING state) **Tiebreaker Order:** ``` Root Port: lowest root cost → lowest neighbor bridge ID → lowest neighbor port ID → lowest local port ID Designated Port: lowest root cost (from that switch) → lowest bridge ID → lowest port ID ``` --- ## STP Port States & Timers **5 Port States:**

State	Duration	Sends Data?	Learns MAC?	Receives BPDU?	Purpose
BLOCKING	Indefinite	✗	✗	✗	Non-designated port; prevents loops
LISTENING	15 sec	✗	✗	✓	Verifies no topology changes before forwarding
LEARNING	15 sec	✗	✓	✓	Learns MAC addresses before forwarding traffic
FORWARDING	Indefinite	✓	✓	✓	Normal operation (root/designated ports)
DISABLED	N/A	✗	✗	✗	Port manually shut down

**State Transitions:** ``` Port Activation (blocked → forwarding): BLOCKING → LISTENING (15s) → LEARNING (15s) → FORWARDING Total: 30 seconds minimum (+ up to 20s MAX AGE = ~50s worst case) Port Deactivation (forwarding → blocking): FORWARDING → BLOCKING (IMMEDIATE, no delay) Reason: Prevent loops; no need to verify when disabling ``` **Three Main STP Timers:**

Timer	Default	Purpose	Set By
Hello Timer	2 seconds	Interval between BPDU "hello" messages	Root Bridge (affects entire network)
Forward Delay	15 seconds	Time spent in LISTENING state; also in LEARNING state	Root Bridge (affects entire network)
Max Age	20 seconds	Max wait before declaring link dead; if no BPDU for 20s, re-evaluate topology	Root Bridge (affects entire network)

**Critical Timing:** ``` Root Bridge controls ALL timers for ENTIRE network No switch can override root bridge settings Convergence time = MAX AGE (20s) + LISTENING (15s) + LEARNING (15s) = ~50 seconds (slowest scenario) If link fails: - Takes up to 20 seconds to detect (MAX AGE timeout) - Takes another 30 seconds for blocked port to activate - Total: ~50 seconds before traffic resumes on backup link This is why RSTP was developed (converges in seconds) ``` --- ## STP Optional Features **PortFast:** - Allows access port to skip LISTENING/LEARNING states - Goes directly from BLOCKING → FORWARDING - **ONLY on access ports connected to end hosts** (NOT on switch-to-switch links) - Reduces activation time from 30s to ~0 seconds - Configuration: `switchport portfast` or `spanning-tree portfast default` **BPDU Guard:** - Shuts down PortFast port if BPDU received - Prevents accidental switch connection to end-host port - Port enters ERRDISABLED state; admin alerted - Configuration: `spanning-tree bpduguard enable` or `spanning-tree portfast bpduguard default` **Root Guard & Loop Guard:** (less critical) - Root Guard: prevents port from becoming root port - Loop Guard: prevents non-designated port from forwarding if no BPDU received --- ## STP vs RSTP Comparison

Feature	Classic STP (802.1D)	RSTP (802.1w)
Convergence Time	30-50 seconds	Seconds
Port States	5 (Blocking, Listening, Learning, Forwarding, Disabled)	3 (Discarding, Learning, Forwarding)
Port Roles	3 (Root, Designated, Non-designated)	4 (Root, Designated, Alternate, Backup)
BPDUs Sent By	Root bridge only	All switches (from designated ports)
Link Type Awareness	No	Yes (Edge, Point-to-point, Shared)
UplinkFast Built-in	Optional feature	Yes (Alternate Port)
BackboneFast Built-in	Optional feature	Yes (handshake)
BPDU Version	0	2
Cisco Default	PVST+	Rapid PVST+
Backwards Compatible	-	Yes (with 802.1D)

--- ## RSTP Port States (3 Instead of 5)

State	Replaces	Behavior
DISCARDING	Blocking, Listening, Disabled	Port not forwarding; receives BPDUs but no regular traffic
LEARNING	Learning (same)	Learns MAC addresses; disabled for traffic
FORWARDING	Forwarding (same)	Full operation

**Why Fewer States?** RSTP eliminates LISTENING (unnecessary with new bridge-to-bridge negotiation). --- ## RSTP Port Roles (4 Instead of 3)

Role	Purpose	State	Backup To
ROOT PORT	Interface toward root bridge (one per switch)	FORWARDING	N/A
DESIGNATED PORT	Best interface on segment toward root (one per segment)	FORWARDING	N/A
ALTERNATE PORT	NEW: Backup to root port; identified during BPDU negotiation	DISCARDING	Root port
BACKUP PORT	NEW: Backup to designated port (on shared media/hubs only)	DISCARDING	Designated port

**Why Alternate Port Matters:** - If root port fails, alternate port immediately moves to FORWARDING - No 20-second MAX AGE wait - Built-in UplinkFast functionality --- ## RSTP Link Types **Edge Ports:** - Connected to end hosts (no other switches) - No loop risk; move directly to FORWARDING - Equivalent to PortFast in classic STP - Configuration: `spanning-tree portfast` **Point-to-Point Links:** - Direct switch-to-switch connections; full-duplex - Use rapid bridge-to-bridge handshake - Converge in seconds - Configuration: `spanning-tree link-type point-to-point` (auto-detected in full-duplex) **Shared Links:** - Multiple switches on shared segment (hubs); half-duplex - Cannot use rapid handshake; slower convergence - Rare in modern networks - Configuration: `spanning-tree link-type shared` (auto-detected in half-duplex) --- ## STP Configuration **Basic Setup:** ``` Switch(config)# spanning-tree mode rapid-pvst → Enable RSTP (modern) (or: spanning-tree mode pvst) → Classic STP ``` **Set Root/Backup Bridge:** ``` Switch(config)# spanning-tree vlan 1 root primary → Priority 24576 Switch(config)# spanning-tree vlan 1 root secondary → Priority 28672 ``` **PortFast & BPDU Guard:** ``` Switch(config-if)# spanning-tree portfast Switch(config-if)# spanning-tree bpduguard enable (Or globally): Switch(config)# spanning-tree portfast default Switch(config)# spanning-tree portfast bpduguard default ``` **Per-Interface STP:** ``` Switch(config-if)# spanning-tree vlan 1 cost 10 → Set cost Switch(config-if)# spanning-tree vlan 1 port-priority 64 → Set port priority ``` **Verification:** ``` show spanning-tree → Show root bridge and topology show spanning-tree vlan 10 → Specific VLAN STP show spanning-tree interface Fa0/1 → Interface STP details show spanning-tree detail → All STP information ``` --- ## Per-VLAN STP (PVST+) **Concept:** One spanning tree per VLAN; allows different root bridge per VLAN. **Benefits:** - Different traffic paths per VLAN - Load balancing across multiple bridges - Better utilization of redundant links **Example:** ``` VLAN 10: SW1 = root VLAN 20: SW2 = root VLAN 30: SW3 = root Configuration: Switch1(config)# spanning-tree vlan 10 root primary Switch2(config)# spanning-tree vlan 20 root primary Switch3(config)# spanning-tree vlan 30 root primary ``` --- ## CCNA Exam Essentials

Concept	Key Detail
STP Purpose	Prevent Layer 2 loops; enable redundancy safely
Root Bridge	Elected by lowest bridge ID (priority + MAC)
Bridge ID	2-byte priority + 6-byte MAC; priority in 4096 increments
Root Port	ONE per switch; lowest cost to root; FORWARDING
Designated Port	ONE per segment; lowest cost; FORWARDING
Non-Designated	BLOCKING state; serves as backup
Port Costs	Classic: 10Mbps=100, 100Mbps=19, 1Gbps=4; RSTP: scale ×50000
Hello Timer	2 seconds; sent by root bridge; tells all others
Forward Delay	15 seconds; time in LISTENING and LEARNING each
Max Age	20 seconds; max wait for BPDU before topology re-eval
Convergence Time	30-50 seconds (STP); MAX AGE + LISTENING + LEARNING
Port State Sequence	BLOCKING → LISTENING (15s) → LEARNING (15s) → FORWARDING
BPDU	STP message; sent every 2 seconds on all ports
PortFast	Skips LISTENING/LEARNING; ONLY for access to hosts
BPDU Guard	Shuts down PortFast port if BPDU received
RSTP Convergence	Seconds (not minutes)
RSTP States	3 (Discarding, Learning, Forwarding) not 5
RSTP Roles	4 (Root, Designated, Alternate, Backup) not 3
Alternate Port	Backup to root port; immediate failover (no MAX AGE wait)
Root Priority 0	Lowest possible; highest chance to be root
Priority Increment	4096 (only valid increment for priority changes)
RSTP Link Types	Edge (hosts), Point-to-Point (switch-to-switch FD), Shared (hubs)
PVST+	Per-VLAN STP; different root per VLAN for load balancing
Bridge ID Tie	If priority equal, lower MAC address wins
Tiebreaker Order	Root cost → neighbor bridge ID → neighbor port ID → local port ID

--- Summary: Condensed from ~4,200 to ~2,000 words (52% reduction). Zero technical data loss; all timers, costs, port states, transitions, roles, tiebreakers, and configurations preserved exactly.