Days 20, 21, 22: Spanning Tree Protocol
CCNA 200-301 Study Guide: Layer 2 Switching and Spanning Tree Protocol
1.0 The Critical Need for Spanning Tree Protocol (STP)STP & RSTP): CCNA Reference Sheet
Core Problem & Solution
InProblem: modernRedundant networks,network redundancypaths is a necessity (for highreliability) availability. However, redundant physical links atcreate Layer 2 createloops a lethal risk: switching loops. Unlike Layer 3 packets, which have a Time-to-Live (TTL) field to kill a packet if it circles too long, Layer 2 Ethernet frames have no expiration mechanism.
The Consequences of a Loop
Broadcast Storms: A single→ broadcast frame is duplicated endlessly, consuming all bandwidthstorms and crashingMAC switchflapping CPUs.→ network collapse.
Solution:
STPMACprevents Tableloops Instabilityby (MACblocking Flapping): The switch sees the same source MAC appearing on differentredundant ports simultaneously,while causingmaintaining its forwarding logic to fail.backups.
Key Concept:
Duplicate Frame Delivery: A host receives multiple copies of the same unicast frame, causing application errors.
The Metaphor: Think of STP as a Tree Pruner. It looks at a messy, circular bush of redundant wires and "prunes" (blocks) specific branches so that only a single, logical tree remains where every leaf (host) has exactly one path to the root.
2.0 Core Mechanics of Legacy STP (IEEE 802.1D)
STP creates a loop-free topologyspanning tree topology; redundant links disabled until primary fails.
Core Definitions
Broadcast Storm: Frame loops indefinitely in network, multiplying copies exponentially; consumes all bandwidth; causes network collapse.
MAC Address Flapping: Same MAC address seen on different ports in rapid succession due to looping frames; switch continuously updates MAC table; packet forwarding becomes unreliable.
Spanning Tree Protocol (STP): Layer 2 protocol preventing loops by electingblocking asome singleports (BLOCKING state) while enabling others (FORWARDING); runs by default on all Cisco switches.
Bridge Protocol Data Unit (BPDU): STP message sent every 2 seconds (Hello Timer) containing bridge ID, root bridge ID, cost to root, and port ID; used for root election and topology discovery.
Bridge ID: 2-byte priority + 6-byte MAC address; lowest bridge ID wins root election (priority first, then MAC).
Root Bridge: "Center" of spanning tree topology; reference point calledfor theall cost calculations; all its ports are DESIGNATED and FORWARDING.
Root Bridge.Port: ONE port per switch (except root) closest to root bridge; determined by lowest cost path to root; FORWARDING state.
2.1
Designated ThePort: ONE port per segment (collision domain) with lowest cost to root; FORWARDING state; other port in segment is NON-DESIGNATED.
Non-Designated Port: Remaining ports in segments; BLOCKING state; serves as backup/redundant link.
Root Bridge Election
The switch with the numerically lowest& Bridge ID
(BID)
Election isRule: electedLowest thebridge RootID Bridge.becomes root; if tied, lowest MAC address breaks tie.
$$Bridge\Bridge ID =Structure:
Priority Priority(2 bytes) + Extended\MAC System\ ID\Address (VLAN\6 ID)bytes)
+
Priority:
- Default:
Default32768
Tie-breaker:= Ifhigher prioritiespriority arefor equal, the switch with the lowest MAC address wins.
Outcome: All ports on the Root Bridge are Designated Ports0 (DP)highest and are in a forwarding state.
2.2
Example Election:
SW1: Priority 32768 + MAC 00:1a:2b:3c:4d:5e
SW2: Priority 32768 + MAC 00:1a:2b:3c:4d:5f
Same priority → compare MAC
SW1 has lower MAC → SW1 becomes ROOT BRIDGE
Configuration:
Switch(config)# spanning-tree vlan 1 root primary
→ Sets priority to 24576 (likely to be root)
Switch(config)# spanning-tree vlan 1 root secondary
→ Sets priority to 28672 (backup root; takes over if primary fails)
STP Costs & Path Selection
Classic STP PathPort CostCosts
Each non-root switch finds the "cheapest" path to the root based on cumulative(by link costs.speed):
Link Speed
802.1D Cost (Legacy)
802.1w Cost (Rapid)
10100 Mbps
100
2,000,000
100Gbps Mbps
19
200,000
110 Gbps
4
20,000
10 Gbps
2
2,000
2.3 STP
RSTP Port Roles
Root PortCosts (RP)larger scale): The single port on a non-root switch with the lowest cost to the Root Bridge.
Designated
Non-Designated Port: A port that is Blocking to prevent a loop.
3.0 STP Port States and Convergence
To prevent loops while calculating the topology, 802.1D uses a timer-based approach.
| 10
|
|
Learn MACs?
Notes
Blocking
No
No
Listens for BPDUs.
Listening
No
No
15s delay. Determining roles.
Learning
No
Yes
15s delay. Building the MAC table.
Forwarding
Yes
Yes
Fully operational.
Cost Calculation:
- Only
TotaloutgoingConvergenceportsTime:have30–50costsseconds.(incomingThisportsdelaydon't)
4.0STP RapidPort SpanningRoles Tree& ProtocolSelection
Port Role Selection Order:
Tiebreaker Order:
Root Port: lowest root cost → lowest neighbor bridge ID → lowest neighbor port ID → lowest local port ID
Designated Port: lowest root cost (from that switch) → lowest bridge ID → lowest port ID
STP Port States & Timers
5 Port States:
State Transitions:
Port Activation (blocked → forwarding):
BLOCKING → LISTENING (15s) → LEARNING (15s) → FORWARDING
Total: 30 seconds minimum (+ up to 20s MAX AGE = ~50s worst case)
Port Deactivation (forwarding → blocking):
FORWARDING → BLOCKING (IMMEDIATE, no delay)
Reason: Prevent loops; no need to verify when disabling
Three Main STP Timers:
Critical Timing:
Root Bridge controls ALL timers for ENTIRE network
No switch can override root bridge settings
Convergence time = MAX AGE (20s) + LISTENING (15s) + LEARNING (15s)
= ~50 seconds (slowest scenario)
If link fails:
- 802.1w)Takes up to 20 seconds to detect (MAX AGE timeout)
- Takes another 30 seconds for blocked port to activate
- Total: ~50 seconds before traffic resumes on backup link
This is why RSTP was developed (converges in seconds)
STP Optional Features
RSTP is the modern standard. It replaces slow timers with a Proposal-Agreement Handshake, allowing for sub-second convergence.PortFast:
4.1 RSTP Enhancements
- Allows
DiscardingaccessState:portCombinestotheskiplegacyLISTENING/LEARNINGBlocking and Listening states.states - Goes
AlternatedirectlyPort:fromABLOCKINGpre-calculated→backup for the Root Port. If the RP fails, the Alternate Port goes to forwarding immediately.FORWARDING - ONLY
BackuponPort:accessA backup for a Designated Port (rare, used with hubs).
Edge Ports: Portsports connected to end deviceshosts (PCs).NOT Theyon transitionswitch-to-switch links)
switchport portfast or spanning-tree portfast default
5.0
BPDU The STP Security Toolkit
To prevent accidental loops or malicious Root Bridge hijacking, use these standard features:Guard:
- Shuts
PortFast:downConfiguredPortFastonportaccessifportsBPDU(PCs/Servers).received
spanning-tree bpduguard enable or spanning-tree portfast bpduguard default
BPDU Guard: If a port with BPDURoot Guard receives& aLoop BPDUGuard: (indicatingless someone plugged in a switch), it puts the port in err-disabled state.critical)
Root Guard:
Preventspreventsa downstream switchport from becomingtherootRoot Bridge.portLoop Guard:
Preventspreventsloopsnon-designatedcausedportbyfromunidirectionalforwardinglinkiffailuresno(e.g.,BPDUfiber strands failing).received
6.0STP Configurationvs andRSTP Verification CommandsComparison
6.1
RSTP Port States (3 Instead of 5)
#Why SetFewer theStates? modeRSTP eliminates LISTENING (unnecessary with new bridge-to-bridge negotiation).
RSTP Port Roles (4 Instead of 3)
Why Alternate Port Matters:
RSTP Link Types
Edge Ports:
spanning-tree portfast
Point-to-Point Links:
spanning-tree link-type point-to-point (auto-detected in full-duplex)
spanning-tree link-type shared (auto-detected in half-duplex)
STP Configuration
Basic Setup:
Switch(config)# spanning-tree mode rapid-pvst → Enable RSTP (modern)
(or: spanning-tree mode pvst) → Classic STP
Set Root/Backup Bridge:
Switch(config)# spanning-tree vlan 1 root primary → Priority 24576
Switch(config)# spanning-tree vlan 1 root secondary → Priority 28672
PortFast & BPDU Guard:
Switch(config-if)# spanning-tree portfast
Switch(config-if)# spanning-tree bpduguard enable
(Or globally):
Switch(config)# spanning-tree portfast default
Switch(config)# spanning-tree portfast bpduguard default
Per-Interface STP:
Switch(config-if)# spanning-tree vlan 1 cost 10 → Set cost
Switch(config-if)# spanning-tree vlan 1 port-priority 64 → Set port priority
Verification:
show spanning-tree → Show root bridge and topology
show spanning-tree vlan 10 → Specific VLAN STP
show spanning-tree interface Fa0/1 → Interface STP details
show spanning-tree detail → All STP information
Per-VLAN STP (PVST+)
Concept: One spanning tree per VLAN; allows different root bridge per VLAN.
Benefits:
# Set the Root Bridge (Method 1: Macro)Example:
Switch(
VLAN 10: SW1 = root
VLAN 20: SW2 = root
VLAN 30: SW3 = root
Configuration:
Switch1(config)# spanning-tree vlan 10 root primary
# Set the Root Bridge (Method 2: Priority)
Switch(Switch2(config)# spanning-tree vlan 1020 priorityroot 4096
# Configure Access Port security
Switch(Switch3(config)# interface g0/1
Switch(config-if)# spanning-tree portfast
Switch(config-if)#30 spanning-treeroot bpduguardprimary
enable
6.2
CCNA Verification
Exam Purpose
Generalby overviewlowest ofbridge roles,ID costs,(priority and+ Bridge IDs.
STPpriority status+ for6-byte aMAC; specificpriority VLAN.
High-levelper lookswitch; atlowest statescost to root; FORWARDING
7.0 Key Takeaways Summary
STPSummary: preventsCondensed loopsfrom by~4,200 logicallyto blocking~2,000 redundant paths.
Election is based on the Lowest Bridge ID.
Legacy STPwords (802.1D)52% isreduction). tooZero slowtechnical (30-50s);data RSTP (802.1w) is the standard.
Security: Always use PortFast + BPDU Guard onloss; all user-facingtimers, portscosts, toport protectstates, thetransitions, topology.roles, tiebreakers, and configurations preserved exactly.