Understanding STP, RSTP and MSTP

# Understanding STP, RSTP and MSTP

Introduction

Spanning Tree Protocol (STP) prevents loops in Layer 2 switched networks by blocking redundant paths while maintaining loop-free topology. Without STP, redundant links between switches create broadcast storms, MAC table instability, and multiple frame copies that can paralyze a network.

This tutorial covers the three spanning tree protocol variants: original STP (IEEE 802.1D), Rapid Spanning Tree Protocol (IEEE 802.1w), and Multiple Spanning Tree Protocol (IEEE 802.1s). You will learn how each protocol works, how to configure them, how they converge, and how to troubleshoot spanning tree issues.

By the end of this guide, you will understand when to use each STP variant, how to design loop-free Layer 2 topologies, and how to verify and troubleshoot spanning tree operation.

Technical Background

Why STP Is Needed

Ethernet switches flood unknown unicast, broadcast, and multicast frames out all ports in a VLAN except the ingress port. With redundant links, frames can circulate indefinitely, causing:

• **Broadcast storms**: Frames loop forever, consuming all bandwidth
• **MAC database instability**: MAC addresses appear to move between ports
• **Multiple frame copies**: Same frame arrives at destination multiple times

STP elects a root bridge, calculates the shortest path to root from each switch, and blocks redundant ports to create a loop-free tree topology.

STP (802.1D) - Original

STP uses Bridge Protocol Data Units (BPDUs) to exchange topology information. Key characteristics:

• **BPDU interval**: Hello every 2 seconds
• **Convergence time**: 30-50 seconds (listening 15s + learning 15s + forwarding)
• **Port states**: Blocking, Listening, Learning, Forwarding, Disabled
• **Single instance**: One STP instance for all VLANs (unless PVST+/PVST+)

Port roles:

• **Root port**: Best path to root bridge
• **Designated port**: Best path on a segment
• **Blocking port**: Redundant path, blocked to prevent loops

RSTP (802.1w) - Rapid

RSTP improves convergence significantly:

• **Convergence time**: Typically < 10 seconds, often 1-3 seconds
• **Port states**: Discarding, Learning, Forwarding (Blocking and Listening merged)
• **Port types**: Edge (PortFast), Point-to-Point, Shared
• **Proposal/Agreement**: Rapid negotiation between directly connected switches
• **Backward compatible**: Falls back to 802.1D when detecting legacy STP

RSTP edge ports (connected to end devices) forward immediately without waiting for topology convergence.

MSTP (802.1s) - Multiple

MSTP maps multiple VLANs to spanning tree instances:

• **MST instances**: Multiple independent spanning trees (e.g., instance 1 for VLANs 10-20, instance 2 for VLANs 30-40)
• **IST (Internal Spanning Tree)**: Instance 0, carries all unassigned VLANs
• **CST (Common Spanning Tree)**: Single spanning tree for interconnecting MST regions
• **Regions**: Group of switches with same MST configuration (name, revision, VLAN mapping)
• **Per-VLAN load balancing**: Different VLANs can use different paths

Prerequisites

• Managed switches supporting STP/RSTP/MSTP
• Console or SSH access to switches
• Network topology documentation
• Understanding of Layer 2 forwarding and VLANs

Architecture

Redundant Switched Topology

                    Distribution A (Root)
                    Priority 4096
                    ┌─────────────┐
                    │             │
                ┌───▼───┐     ┌───▼───┐
                │ Access│     │ Access│
                │ Switch│     │ Switch│
                │   B   │     │   C   │
                └───┬───┘     └───┬───┘
                    │             │
                    └─────────────┘
                 (redundant link)

Without STP, the link between Access B and Access C creates a loop. STP blocks one port to break the loop.

MST Region Example

Region 1 (VLANs 10,20 -> Instance 1; VLANs 30,40 -> Instance 2)
┌─────────┐    ┌─────────┐    ┌─────────┐
│  Switch │    │  Switch │    │  Switch │
│    A    │    │    B    │    │    C    │
└────┬────┘    └────┬────┘    └────┬────┘
     │              │              │
     └──────────────┴──────────────┘

Step-by-Step Implementation

Step 1: Configure PVST+ (Per-VLAN STP)

**Purpose**: Run separate STP instance per VLAN for optimal load balancing.

**Commands** (Cisco IOS):

configure terminal
!
spanning-tree mode rapid-pvst
!
spanning-tree vlan 10 priority 4096
spanning-tree vlan 20 priority 4096
spanning-tree vlan 30 priority 8192
spanning-tree vlan 40 priority 8192
!
interface range GigabitEthernet1/0/1-24
 spanning-tree portfast
 spanning-tree bpduguard enable
!
interface GigabitEthernet1/0/24
 spanning-tree portfast trunk
!
end

**Explanation**: `rapid-pvst` enables RSTP per VLAN. Lower priority values make a switch more likely to become root for that VLAN. `spanning-tree vlan 10 priority 4096` makes this switch root for VLANs 10 and 20.

**Expected output**: Separate STP topology per VLAN with different root bridges.

**Verification**:

show spanning-tree vlan 10
show spanning-tree vlan 20
show spanning-tree summary

Step 2: Configure MSTP

**Purpose**: Group VLANs into MST instances for efficient spanning tree.

**Commands**:

configure terminal
!
spanning-tree mode mst
!
spanning-tree mst configuration
 name MY-REGION
 revision 1
 instance 1 vlan 10,20,30
 instance 2 vlan 40,50,60
 exit
!
spanning-tree mst 0 priority 4096  # IST root for region
spanning-tree mst 1 priority 8192
spanning-tree mst 2 priority 8192
!
end

**Explanation**: All switches in the region must have matching `name`, `revision`, and VLAN-to-instance mapping to form the same MST region.

**Expected output**: Single IST plus additional MST instances per VLAN group.

**Verification**:

show spanning-tree mst configuration
show spanning-tree mst 0
show spanning-tree mst 1

Configuration Examples

Complete RSTP Configuration

!
spanning-tree mode rapid-pvst
spanning-tree vlan 1-4094 priority 32768
spanning-tree vlan 10 priority 4096
spanning-tree vlan 20 priority 8192
!
interface range GigabitEthernet1/0/1-48
 description Edge-Ports
 switchport mode access
 spanning-tree portfast
 spanning-tree bpduguard enable
 no shutdown
!
interface range GigabitEthernet1/0/49-52
 description Uplink-Ports
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30,40
 spanning-tree portfast trunk
 no shutdown

MSTP with Multiple Regions

Switch A (Region 1):
spanning-tree mode mst
spanning-tree mst configuration
 name REGION-1
 revision 1
 instance 1 vlan 10,20
 instance 2 vlan 30,40
 exit
spanning-tree mst 0 priority 4096

Switch B (Region 2):
spanning-tree mode mst
spanning-tree mst configuration
 name REGION-2
 revision 1
 instance 1 vlan 10,20
 instance 2 vlan 30,40
 exit
spanning-tree mst 0 priority 8192

Root Guard and BPDU Guard

interface GigabitEthernet1/0/1
 description Access-Port
 switchport mode access
 spanning-tree portfast
 spanning-tree bpduguard enable
!
interface GigabitEthernet1/0/24
 description Uplink-to-Distribution
 switchport mode trunk
 spanning-tree guard root

**Explanation**: BPDU guard shuts down edge ports receiving BPDUs (prevents rogue switches). Root guard prevents a port from becoming root port (protects root bridge placement).

Verification

STP Status Commands

show spanning-tree              -- Active STP summary
show spanning-tree vlan 10      -- Per-VLAN STP details
show spanning-tree mst          -- MST instances
show spanning-tree mst configuration  -- MST region config
show spanning-tree interface Gi1/0/1  -- Per-port STP state
show spanning-tree detail       -- Detailed timers and roles

Expected Output

VLAN10
  Spanning tree enabled protocol rstp
  Root ID    Priority    4096
             Address     0011.2233.4455
             This bridge is the root
  Bridge ID  Priority    4096   (priority 4096 sys-id 10)
             Address     0011.2233.4455
  Interface        Role Sts Cost      Prio.Nbr Type
  ---------------- ---- --- --------- -------- --------------------------------
  Gi1/0/1          Desg FWD 4         128.1    P2p Edge
  Gi1/0/24         Back BLK 4         128.24   P2p

**Role meanings**: Desg = Designated, Root = Root port, Alt = Alternate, Back = Backup.

**Stp states**: BLK = Blocking, FWD = Forwarding, LRN = Learning.

Troubleshooting

| Symptom | Possible Cause | Diagnostic Command | Corrective Action | Verification | |---------|---------------|-------------------|-------------------|--------------| | 30-50s convergence | Running 802.1D STP, not RSTP | `show spanning-tree` | Change to `spanning-tree mode rapid-pvst` | Fast convergence | | Port stuck in blocking | Higher cost path to root | `show spanning-tree interface` | Lower port priority or cost on preferred path | Port forwards | | BPDU guard err-disable | Rogue switch or BPDU on edge port | `show interfaces status` | Remove rogue device; `shutdown`/`no shutdown` | Port recovers | | Root bridge in wrong location | Priority not configured | `show spanning-tree vlan 10` | Set priority 4096 on desired root | Root ID matches | | VLAN load balancing not working | All VLANs use same root | `show spanning-tree vlan 10,20` | Set different root per VLAN group | Different roots per VLAN | | TCN (Topology Change Notification) storms | Flapping link | `show spanning-tree detail` | Fix flapping link; enable portfast on stable edges | TCN count stabilizes | | MST region not forming | Mismatched name/revision/VLAN map | `show spanning-tree mst configuration` | Align MST configuration across region | Region forms correctly | | Loop detected | STP disabled on a switch | `show spanning-tree` | Enable STP on all switches | Loop eliminated | | High CPU during TCN | Frequent topology changes | `show processes cpu` | Enable BPDU filter on edge ports or fix flapping | CPU normalizes | | Root port flapping | Marginal link quality | `show spanning-tree interface` | Replace cable or SFP; adjust cost | Stable root port | | VLAN traffic blackholed | Blocking port carries active VLAN | `show spanning-tree vlan <vlan>` | Reconfigure topology or unblock port | Traffic flows |

Best Practices

1. **Use RSTP or MSTP, not legacy 802.1D**: Faster convergence reduces outage impact. 2. **Enable BPDU guard on all edge ports**: Prevents unauthorized switches from affecting STP. 3. **Determine root bridge location**: Don't let STP elect root by default; configure priority on core/distribution switches. 4. **Use PortFast on end-device ports**: Edge ports forward immediately; no 30-second delay for workstations. 5. **Prune VLANs on trunks**: Only allow VLANs that need to traverse each trunk. 6. **Use root guard on uplink ports**: Prevents downstream switches from becoming root unexpectedly. 7. **Keep all switches in same STP mode**: Mixed 802.1D and RSTP domains fall back to slow 802.1D behavior. 8. **Document spanning tree topology**: Record root bridge per VLAN or MST instance. 9. **Monitor topology changes**: Frequent TCNs indicate unstable links or misconfigured edge ports. 10. **Test STP failover**: Disconnect a root port and verify convergence time meets requirements.

Conclusion

Spanning Tree Protocol is essential for loop-free Layer 2 networks. Original STP (802.1D) provides basic loop prevention with slow convergence. RSTP (802.1w) dramatically improves convergence for modern networks. MSTP (802.1s) adds per-VLAN or per-VLAN-group load balancing across multiple spanning tree instances. Understanding STP port states, roles, and configuration is fundamental for network engineers designing resilient switched networks.

References

• IEEE 802.1D - MAC Bridges (https://ieeexplore.ieee.org/)
• IEEE 802.1w - Rapid Spanning Tree Protocol (https://ieeexplore.ieee.org/)
• IEEE 802.1s - Multiple Spanning Tree Protocol (https://ieeexplore.ieee.org/)
• Cisco Spanning Tree Protocol Configuration Guide (https://www.cisco.com/c/en/us/support/docs/switches/catalyst-6500-series-switches/)
• Juniper Spanning Tree Protocols (https://www.juniper.net/documentation/)
• Arista STP Configuration (https://www.arista.com/)