Spanning-Tree
Course Description
Spanning Tree Protocol (STP) prevents loops in switched networks. We want redundant links between our switches, but without STP, those links cause broadcast storms that can take down the entire network. STP blocks redundant links so there is only one active path, and unblocks them when a link fails. In this course, we start with how classic spanning tree elects a root bridge and selects port roles, then look at the different versions: PVST, Rapid Spanning Tree (RSTP), and Multiple Spanning Tree (MST). We finish with the features that protect your STP topology and how to troubleshoot it.
Course Highlights
In this course you will learn:
- Why switched networks need spanning tree, and what happens when there is a loop.
- How STP elects the root bridge and selects root, designated, and alternate ports.
- How STP calculates the path cost to the root bridge.
- How the STP port states, timers, and topology change notifications work.
- How to configure PVST and select a different root bridge for each VLAN.
- How Rapid Spanning Tree converges in seconds with its proposal and agreement mechanism.
- How MST maps VLANs to instances, and how it works together with PVST+.
- How to protect your topology with portfast, BPDU guard, BPDU filter, root guard, loop guard, and UDLD.
- How to troubleshoot spanning tree, and what its limitations are.
Presented to you by instructor Rene Molenaar, CCIE #41726
Course at a glance
- 23 lessons in 6 units.
- Format: self-paced lessons with Cisco IOS switch configurations, debugs, packet captures, and video.
- Last updated: October 2026.
Requirements
- Basic knowledge of switching: how a switch learns MAC addresses and forwards frames.
- Familiarity with VLANs and trunks.
Course Schedule
What is Spanning Tree Protocol?
Spanning Tree Protocol (STP) is a layer 2 protocol that creates a loop-free topology in a switched network. Switches exchange BPDUs (Bridge Protocol Data Units) and elect one switch as the root bridge: the switch with the lowest bridge ID, a combination of priority and MAC address. Every other switch selects the port with the lowest cost to the root bridge as its root port, each link gets one designated port, and all remaining ports are blocked.
Why do we need this? Ethernet frames don’t have a TTL (Time to Live) field like IP packets. When there is a loop, broadcast frames are forwarded over and over again until the switches are so busy that the network goes down. STP lets you keep redundant links: they stay blocked while the network is stable, and when an active link fails, a blocked port moves to forwarding. Classic STP (802.1D) is slow and takes 30 to 50 seconds to converge. Rapid Spanning Tree (802.1w) uses a proposal and agreement handshake instead of timers and converges much faster.
STP is enabled by default on Cisco switches, so it runs in every campus network, even if nobody configured it. Cisco switches run a separate spanning tree for each VLAN with PVST+, or Rapid PVST+ on newer IOS versions. Large networks with many VLANs often use MST, which maps groups of VLANs to a few instances.
Spanning Tree Learning Roadmap
This roadmap follows the course units. Each topic has a short explanation and links to the lessons where we cover it in detail.
Spanning Tree Fundamentals
Classic spanning tree elects a root bridge, then each non-root switch picks the port with the lowest total path cost to the root as its root port. The cost depends on the interface speed: 100 for 10 Mbit, 19 for 100 Mbit, and 4 for 1000 Mbit. A port goes through the listening and learning port states, 15 seconds each, before it forwards frames. When the topology changes, switches send a TCN (Topology Change Notification) so all switches age out their MAC address tables in 15 seconds instead of 300. You’ll also see what happens during reconvergence when a link fails.
Per VLAN Spanning Tree (PVST)
The original 802.1D standard calculates a single spanning tree for all VLANs. Cisco’s PVST calculates a separate spanning tree for each VLAN instead, so you can make a different switch the root bridge for different VLANs. This lets you use your redundant links for some VLANs while they are blocked for others. You select the root bridge with the root primary and secondary commands, or by setting the priority yourself in increments of 4096.
Rapid Spanning Tree (RSTP)
Rapid Spanning Tree (802.1w) replaces the timers of classic STP with a proposal and agreement handshake between switches. It has only three port states: discarding, learning, and forwarding. Every switch sends BPDUs every 2 seconds, and a neighbor is considered gone after three missed BPDUs. Edge ports and point-to-point links are the key to fast convergence. On Cisco switches, Rapid PVST+ runs a rapid spanning tree for each VLAN, and you enable it with a single command.
Multiple Spanning Tree (MST)
With PVST, 200 VLANs means 200 spanning tree calculations, even when most of them end up with the same topology. MST (802.1s) maps multiple VLANs to a single instance, which saves CPU and memory. Switches in the same MST region need the same region name, revision number, and VLAN to instance mapping. Instance 0, the IST, uses rapid spanning tree and is what MST shows to PVST+ switches outside the region, which makes MST and PVST+ interoperability possible.
Spanning Tree Toolkit
Out of the box, spanning tree trusts every BPDU it receives and treats every port the same. Portfast lets ports that connect to hosts skip the listening and learning states, though it doesn’t disable spanning tree. BPDU guard shuts these ports down when a BPDU arrives, and BPDU filter stops them from sending BPDUs at all. Root guard stops other switches from becoming the root bridge, while loop guard and UDLD, STP dispute, and bridge assurance protect against unidirectional link failures.
Classic STP Convergence: UplinkFast and BackboneFast
When the root port of a classic STP switch fails, the alternate port has to go through listening and learning, which means 30 seconds of downtime. UplinkFast moves the alternate port to forwarding right away. BackboneFast deals with indirect link failures: instead of waiting 20 seconds for the max age timer to expire, the switch skips it. Rapid spanning tree has these improvements built in.
Troubleshooting and STP Limitations
When spanning tree doesn’t select the root bridge or root port you expect, the cause is usually a priority, cost, or port priority that is different from what you think. When you troubleshoot spanning tree, it’s best to draw the topology and write down the port role of each interface. Spanning tree also has its limitations: blocked links waste bandwidth, a poorly placed root bridge causes suboptimal paths, and convergence is slow compared to routing protocols. That’s why data centers use other solutions.
Frequently Asked Questions
Spanning Tree Protocol is a layer 2 protocol that prevents loops in switched networks with redundant links. Switches elect a root bridge, select the shortest path to it, and block all other redundant ports. When an active link fails, a blocked port can take over. Read our introduction to spanning tree.
Redundant links between switches create layer 2 loops. Ethernet frames have no TTL, so broadcast frames loop around forever and cause a broadcast storm that can bring down the network. Spanning tree keeps only one active path, so you get redundancy without the loops.
The switch with the lowest bridge ID becomes the root bridge. The bridge ID is a combination of the priority and the MAC address. The default priority is 32768, so if you don’t change anything, the switch with the lowest MAC address wins, which is often an old switch. Learn how to configure the root bridge.
Classic spanning tree has four port states: blocking, listening, learning, and forwarding. Listening and learning each take 15 seconds, so a port needs 30 seconds before it forwards frames, or 50 seconds when it first has to wait for the max age timer in the blocking state. Rapid spanning tree only has discarding, learning, and forwarding. Learn about the spanning tree port states.
Classic STP (802.1D) relies on timers and takes 30 to 50 seconds to converge. RSTP (802.1w) uses a proposal and agreement handshake between switches, so ports move to forwarding without waiting for timers. RSTP also has fewer port states and is backward compatible with classic STP. Learn how rapid spanning tree works.
PVST+ runs a separate spanning tree for each VLAN. MST maps multiple VLANs to a single instance, so you only need a few spanning tree calculations, even when you have hundreds of VLANs. Both let you use a different root bridge for different VLANs to share the load over your links. Learn how MST works.
No. Portfast makes a port skip the listening and learning states and go to forwarding right away, but the port still sends BPDUs. When a portfast port receives a BPDU, it loses its edge status and becomes a normal spanning tree port. See portfast in action.
BPDU guard puts an interface in err-disabled state when it receives a BPDU. BPDU filter stops the interface from sending BPDUs and, when configured on the interface, ignores the BPDUs it receives, which is the same as disabling spanning tree. BPDU guard is the safer choice on ports that connect to hosts. Learn how to configure BPDU guard.
Ready to master spanning tree?
Get access to all 23 spanning tree lessons and every other course on NetworkLessons.com.