Stackvora.tech

Spanning Tree Quick Reference: RSTP, MST, PortFast

Spanning Tree Protocol (STP) remains a foundational element in preventing Layer 2 loops within Ethernet networks. While the original 802.1D STP is largely…

Spanning Tree Protocol (STP) remains a foundational element in preventing Layer 2 loops within Ethernet networks. While the original 802.1D STP is largely deprecated due to its slow convergence times, its successors, Rapid Spanning Tree Protocol (RSTP) and Multiple Spanning Tree Protocol (MSTP), provide significantly improved performance and scalability. This reference covers the essential configurations and best practices for RSTP and MSTP, along with critical features like PortFast and BPDU Guard, crucial for maintaining network stability and security.

RSTP (802.1w) Fundamentals and Configuration

Rapid Spanning Tree Protocol (RSTP), standardized as 802.1w, offers significantly faster convergence than traditional 802.1D STP by rapidly transitioning ports to forwarding states. It achieves this by introducing new port roles (Alternate, Backup) and proposing/agreeing mechanisms. On Cisco IOS switches, RSTP typically operates in a per-VLAN context, known as Rapid Per-VLAN Spanning Tree Plus (Rapid PVST+).

Enabling RSTP Globally

To enable RSTP (Rapid PVST+) globally on a Cisco Catalyst switch, use the following command. This sets the spanning tree mode for all VLANs.

Switch(config)# spanning-tree mode rapid-pvst

Verification can be done with show spanning-tree summary or show spanning-tree active. Look for "mode rapid-pvst" in the output.

RSTP Port States and Roles

RSTP simplifies port states to three: Discarding, Learning, and Forwarding. The Blocking, Listening, and Disabled states from 802.1D are consolidated into Discarding. Port roles include Root Port, Designated Port, Alternate Port, and Backup Port. Unlike 802.1D, RSTP allows for immediate transition to forwarding state under certain conditions (e.g., edge ports, point-to-point links) using negotiation.

RSTP Edge Ports (PortFast Equivalent)

Ports connected to end devices (workstations, servers, printers) do not create loops. Marking them as "edge ports" (the RSTP term for what 802.1D called PortFast) allows them to transition immediately to the forwarding state, bypassing the Listening and Learning states. This significantly speeds up client connectivity.

Switch(config-if)# spanning-tree portfast

The spanning-tree portfast default global command enables PortFast on all non-trunking interfaces. It's generally safer to apply it explicitly per-interface or use the default command and then disable it on uplinks.

MSTP (802.1s) for Scalability

Multiple Spanning Tree Protocol (MSTP), standardized as 802.1s, is an evolution of RSTP designed for large networks with many VLANs. Instead of running a separate STP instance for every VLAN (which can consume significant CPU and memory), MSTP groups VLANs into Multiple Spanning Tree Instances (MSTIs). This reduces the number of STP instances that need to be maintained and processed, offering better resource utilization.

MSTP Concepts

  • MST Region: A group of switches configured with the same MST configuration (name, revision number, VLAN-to-instance mappings). Switches within the same region can exchange MST BPDUs directly.
  • Common and Internal Spanning Tree (CIST): A single 802.1w (RSTP) instance that runs across all MST regions and legacy 802.1D/802.1w domains. It connects MST regions and non-MST devices.
  • Multiple Spanning Tree Instance (MSTI): A specific spanning tree instance to which one or more VLANs are mapped. Each MSTI calculates its own topology independently within its region.

Enabling and Configuring MSTP

First, enable MSTP mode globally:

Switch(config)# spanning-tree mode mst

Then, enter MST configuration mode to define regions and VLAN mappings:

Switch(config)# spanning-tree mst configuration
Switch(config-mst)# name MY_REGION_A
Switch(config-mst)# revision 1
Switch(config-mst)# instance 1 vlan 10-19,30
Switch(config-mst)# instance 2 vlan 20,40-49
Switch(config-mst)# exit
  • name MY_REGION_A: All switches in the same MST region must have the same region name.
  • revision 1: The revision number must match across all switches in the region. Incrementing this number forces a recalculation of the MST topology.
  • instance 1 vlan 10-19,30: Maps VLANs 10 through 19, and VLAN 30 to MSTI 1.
  • VLANs not explicitly mapped to an MSTI are automatically mapped to MSTI 0 (the Internal Spanning Tree, IST).

MSTP Priorities and Costs

Just like RSTP, you can influence the root bridge and path selection for each MSTI by adjusting priorities and costs.

Switch(config)# spanning-tree mst 1 priority 4096   // Make this switch the root for MSTI 1
Switch(config-if)# spanning-tree mst 1 cost 100    // Adjust port cost for MSTI 1

Verification: show spanning-tree mst configuration to see region details and VLAN mappings. show spanning-tree mst 1 to view the topology for MSTI 1.

BPDU Guard and BPDU Filter

These features are critical for protecting your STP domain from accidental loops or malicious attacks originating from edge ports.

BPDU Guard

BPDU Guard immediately puts a port into an err-disabled state if it receives a Spanning Tree BPDU. This is essential for access ports connected to end devices that should never originate BPDUs. It prevents rogue switches or misconfigured devices from injecting BPDUs into the network and potentially disrupting the STP topology.

Switch(config-if)# spanning-tree bpduguard enable

When a port is err-disabled by BPDU Guard, it must be manually reactivated (shutdown then no shutdown) or automatically recovered if errdisable recovery cause bpduguard is configured globally.

Global BPDU Guard on PortFast-enabled ports:

Switch(config)# spanning-tree portfast bpduguard default

This enables BPDU Guard on all ports configured with PortFast, simplifying configuration.

BPDU Filter

BPDU Filter prevents a port from sending and receiving BPDUs. This is generally used in very specific scenarios, such as connecting to a service provider network edge where you do not want to participate in their STP or vice versa. It should be used with extreme caution on access ports, as it defeats the purpose of STP loop prevention and BPDU Guard if a loop or rogue switch appears.

Switch(config-if)# spanning-tree bpdufilter enable

When BPDU Filter is enabled globally (spanning-tree portfast bpdufilter default), it applies only to PortFast-enabled ports. If BPDUs are received on a PortFast-enabled port with global BPDU Filter, the port loses its PortFast status, BPDU Filter is disabled on that port, and normal STP processing resumes.

Common Pitfalls and Troubleshooting

  • Mismatching MST Configuration: If MST region name or revision number doesn't match across switches, they won't form an MST region and will see each other as separate MST regions, potentially leading to sub-optimal or looped topologies. Always verify with show spanning-tree mst configuration.
  • Forgotten BPDU Guard: Forgetting to enable BPDU Guard on access ports can lead to network outages if a user connects a small, unmanaged switch or a device that generates BPDUs.
  • Using BPDU Filter on Internal Ports: Never enable BPDU Filter on inter-switch links or ports that should participate in STP. This creates an STP blind spot and can cause bridging loops.
  • RSTP/MSTP Interoperability: RSTP and MSTP are backward compatible with 802.1D. When a switch running RSTP/MSTP connects to an 802.1D switch, the RSTP/MSTP switch reverts to 802.1D mode on that specific port. While functional, this slows convergence on the affected segment. Strive for consistent STP modes across your core and distribution layers.
  • Root Bridge Placement: Ensure your root bridge (or root bridges for different MSTIs) is placed strategically, typically on your core switch. Verify with show spanning-tree active | include "Root ID|This bridge is the root". Manipulate priorities (spanning-tree mst <instance> priority <value>) or port costs to achieve the desired topology. A common practice is to set primary root priority to 4096 and secondary root priority to 8192 (assuming default 32768).
  • VLAN Mappings in MST: Double-check VLAN-to-MSTI mappings. Incorrect mappings can cause traffic for specific VLANs to follow an unexpected path or even create loops if not all switches agree on which VLANs are part of which instance.

Back to the knowledge base · Ask the AI assistant