Rapid PVST+: root bridge, port roles and states, PortFast and the STP guards

Why this matters

Switched networks are built with redundant links so that one failed cable does not cut off a floor. But Ethernet frames carry no time-to-live, so a loop between switches lets a single broadcast circle forever, multiplying until the links and the switch CPUs are saturated. That is a broadcast storm, and it can take down a whole campus in seconds. Spanning tree prevents it by blocking just enough ports to leave one loop-free path, and unblocking them when the active path fails.

A network technician meets spanning tree when a port that a user just plugged into will not pass traffic for half a minute, or when a port goes err-disabled because someone connected a small switch under a desk. A junior network engineer meets it when deciding which distribution switch should be the root, or why traffic takes a longer path than expected. Get the root wrong and traffic crosses the wrong links. Leave out the guards and one misconfigured switch can take over the topology.

The lesson

Electing the root bridge (primary and secondary) and naming the ports

Cisco switches run Rapid PVST+: the rapid spanning tree of IEEE 802.1w, run as a separate instance per VLAN. A switch with 12 active VLANs keeps 12 instances, each with its own root bridge and its own port roles. That lets two distribution switches share the load, one as root for some VLANs and the other for the rest. Turn it on with:

SW1(config)# spanning-tree mode rapid-pvst

The bridge ID. Each switch has a bridge ID made of a priority and its MAC address. The priority field adds the extended system ID, which is the VLAN number, to a configured value. The configured value runs from 0 to 61440 in steps of 4096, and the default is 32768. So the default switch shows priority 32769 in VLAN 1 and 32778 in VLAN 10. You cannot enter 32769 or 10000; you can enter 8192 or 61440.

The root bridge is the switch with the lowest bridge ID. Priority is compared first; if priorities tie, the lowest MAC address wins. A tie is always broken, so exactly one switch becomes root.

Worked example. SW1 (001a.2b3c.0040), SW2 (0011.2233.4455) and SW3 (00a0.c9d1.0002) all have the default priority in VLAN 20. Compare the MAC addresses from the left: all start with 00, then 11 is lower than 1a and a0. So SW2 is root for VLAN 20, chosen by MAC address, which is rarely the switch you would choose by design.

To choose the root yourself, set the priority:

DS1(config)# spanning-tree vlan 10 priority 4096
DS1(config)# spanning-tree vlan 10 root primary
DS1(config)# spanning-tree vlan 20 root secondary

• spanning-tree vlan 10 priority 4096 sets that exact value.
• root primary is a macro that calculates a value: 24576, or 4096 below the current root's priority if that is already lower.
• root secondary sets 28672, below the default 32768, so this switch takes over if the primary fails.

For load sharing, give DS1 root primary for VLAN 10 and root secondary for VLAN 20, and DS2 the reverse. Each switch then backs up the other.

The root port. Every non-root switch picks one root port, its best path toward the root. It compares, in order:

1. The lowest root path cost, the sum of the port costs along the path to the root.
2. The lowest bridge ID of the neighbour sending the BPDU.
3. The lowest port priority of the neighbour's port.
4. The lowest port number of the neighbour's port.

With the short cost method, the default costs are 100 for 10 Mbps, 19 for 100 Mbps, 4 for 1 Gbps and 2 for 10 Gbps.

Worked example. SW3 has two uplinks. Gi1/0/1 goes over 1 Gbps to SW2, and SW2 reaches the root over 10 Gbps. Gi1/0/2 goes straight to the root over a 100 Mbps link.

1. Through SW2: the root advertises cost 0. SW2 adds its 10 Gbps root port, 2, and advertises 2. SW3 adds the 1 Gbps link it receives on, 4. Root path cost: 2 + 4 = 6.
2. Direct: 0 + 19 = 19.
3. The lower cost wins, so Gi1/0/1 is SW3's root port, even though the other link is the shorter path in hops.

Designated ports. On every segment, one port is the designated port: the port with the best path to the root, which forwards onto that segment. The root bridge has the best path to itself everywhere, so every active port on the root bridge is designated. A root port exists only on a non-root switch.

Port states and roles

Rapid PVST+ gives each port a role, decided by the election above:

• Root port: the best path to the root. Forwards.
• Designated port: the best port onto its segment. Forwards.
• Alternate port: receives a better BPDU from a different switch, and so offers a second path to the root. It discards, ready to replace the root port at once if it fails.
• Backup port: receives a better BPDU from another port on the same switch. This happens only when two ports of one switch connect to the same shared segment, such as a hub. It discards.
• Disabled: administratively down.

802.1D, the original standard, had five states: disabled, blocking, listening, learning and forwarding. Rapid PVST+ merges disabled, blocking and listening into one, leaving three:

• Discarding: no frames forwarded, no MAC addresses learned.
• Learning: learning MAC addresses, not yet forwarding.
• Forwarding: normal operation.

Rapid convergence comes from a proposal and agreement handshake between neighbours, which moves a designated port straight to forwarding without waiting for timers. It runs only on point-to-point links. Cisco treats full-duplex ports as point-to-point by default. A shared, half-duplex link falls back to the slow timer-based transition.

A topology change is raised only when a non-edge port moves to forwarding. The switch then flushes the MAC addresses learned on its other ports so that frames follow the new path. An edge port going up or down is deliberately ignored, which is one reason to enable PortFast on host ports.

show spanning-tree vlan 10 shows all of this:

SW2# show spanning-tree vlan 10

VLAN0010
  Spanning tree enabled protocol rstp
  Root ID    Priority    24586
             Address     001a.2b3c.0040
             Cost        4
             Port        1 (GigabitEthernet1/0/1)
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec

  Bridge ID  Priority    32778  (priority 32768 sys-id-ext 10)
             Address     0011.2233.4455
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec
             Aging Time  300 sec

Interface           Role Sts Cost      Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------------------
Gi1/0/1             Root FWD 4         128.1    P2p
Gi1/0/2             Altn BLK 4         128.2    P2p
Gi1/0/10            Desg FWD 19        128.10   P2p Edge

Read it in order:

• SW2 is not the root. The Root ID address differs from SW2's own Bridge ID address. A root bridge says "This bridge is the root" instead.
• The root's configured priority is 24586 − 10 = 24576: the display adds the VLAN number. 24586 itself could never be entered, since it is not a multiple of 4096.
• Gi1/0/1 is the root port, forwarding, with cost 4 (1 Gbps).
• Gi1/0/2 is an alternate port. IOS shows its discarding state as BLK.
• Gi1/0/10 is designated, forwarding, cost 19 (100 Mbps), and its type is P2p Edge: a PortFast port.

PortFast

A port facing a PC, a printer or a phone can never create a loop, so waiting before it forwards is pointless. PortFast makes a port an edge port that moves to forwarding as soon as it comes up, without the listening and learning delays that would otherwise make a desktop wait about 30 seconds before DHCP works.

SW1(config)# interface GigabitEthernet1/0/10
SW1(config-if)# spanning-tree portfast
SW1(config-if)# exit
SW1(config)# spanning-tree portfast default

The interface command enables it on one access port. spanning-tree portfast default enables it on every access port. For a trunk to a host, such as a hypervisor, use spanning-tree portfast trunk.

PortFast does not stop BPDUs, and it does not shut a port down. If a PortFast port receives a BPDU, it loses its edge status and runs normal spanning tree. That is a safety net, but a weak one: the port has already been forwarding. PortFast is never for links between switches, such as core trunks.

Root guard, loop guard, and BPDU guard

Three guards protect the topology. Each acts on a different event.

BPDU guard protects edge ports. If any BPDU arrives, it puts the port into the err-disabled state, stopping an unauthorised switch from joining the topology.

SW1(config)# interface GigabitEthernet1/0/5
SW1(config-if)# spanning-tree bpduguard enable
SW1(config-if)# exit
SW1(config)# spanning-tree portfast bpduguard default

The global form, spanning-tree portfast bpduguard default, enables BPDU guard on every port operating as a PortFast edge port. Do not confuse it with BPDU filter (bpdufilter), which stops BPDUs being sent instead of err-disabling a port that receives one.

An err-disabled port does not recover on its own. Remove the cause, then enter shutdown and no shutdown on the port. Waiting does nothing, and neither does clearing counters. The alternative is automatic recovery with errdisable recovery cause bpduguard, which retries after a timer.

Root guard protects the root's position. Enable it with spanning-tree guard root on designated ports that face downstream, such as a distribution switch's downlinks to access switches. If a superior BPDU arrives, as when an access switch is wrongly set to priority 0, the port is placed in a root-inconsistent state and blocks. The downlink can never become a root port. When the superior BPDUs stop, the port recovers by itself.

DS1(config)# interface range GigabitEthernet1/0/1 - 24
DS1(config-if-range)# spanning-tree guard root

Loop guard protects against BPDUs that disappear. A unidirectional link, for example a fibre pair where one strand fails while the link stays up, can stop an alternate port receiving BPDUs. Without protection, that port would decide it is now designated and start forwarding, creating a loop. Loop guard instead puts a root or alternate port that stops receiving BPDUs into a loop-inconsistent state. It belongs on root and alternate ports on non-root switches, the ports that expect to keep receiving BPDUs. When BPDUs arrive again, it recovers by itself.

SW2(config)# interface GigabitEthernet1/0/2
SW2(config-if)# spanning-tree guard loop
SW2(config-if)# exit
SW2(config)# spanning-tree loopguard default

What the exam is really asking

• Lowest wins. Lowest bridge ID for root, then lowest MAC on a tie; lowest root path cost for the root port.
• Displayed vs configured priority. Subtract the VLAN number. Valid values are multiples of 4096 from 0 to 61440.
• priority vs root primary vs root secondary. A fixed value, a calculated value (24576 or lower), and 28672.
• Path cost is a sum. Add every link cost back to the root, including the link the BPDU arrived on.
• Alternate vs backup. Alternate hears the better BPDU from another switch; backup from its own switch.
• Every root bridge port is designated.
• Three rapid states: discarding, learning, forwarding. Blocking and listening are 802.1D.
• One instance per VLAN.
• PortFast vs BPDU guard vs BPDU filter. PortFast forwards at once and loses edge status on a BPDU; BPDU guard err-disables; BPDU filter stops BPDUs.
• Root guard vs loop guard. Root guard reacts to superior BPDUs on downlinks; loop guard reacts to missing BPDUs on root and alternate ports. Both recover automatically; BPDU guard does not.