2.3STP and RSTP

Connecting switches with redundant links for availability creates an L2 loop as-is: Ethernet frames, which have no TTL, multiply endlessly and a broadcast storm halts the whole network. Spanning tree logically blocks some ports to build a loop-free tree, reconciling redundancy with loop prevention. CCNA assumes Cisco's default Rapid PVST+ and tests how the root bridge is elected, what role/state each port takes, and how to speed up and protect end-host ports (PortFast/BPDU Guard) via configuration and verification.

2.3.1Root bridge election and Rapid PVST+

• The root bridge is the single reference switch of the spanning tree. The switch with the smallest bridge ID = bridge priority (16-bit) + MAC address wins; when priorities tie, the smallest MAC address wins. The default priority is 32768, changeable only in multiples of 4096.
• To make a specific switch the root, explicitly lower its priority: spanning-tree vlan 10 root primary (a macro that sets a sufficiently low value) or spanning-tree vlan 10 priority 4096 (direct). Leaving it to chance lets an old switch (smaller MAC) become root, yielding an inefficient tree.
• Rapid PVST+ is Cisco's default mode, running an independent RSTP (IEEE 802.1w) instance per VLAN. It can elect a different root bridge per VLAN for load balancing, and being RSTP-based it converges in seconds (versus up to ~50 s for classic PVST+ / 802.1D).

2.3.2Port roles and states

• Port roles: the root port is the lowest-cost (upstream) port toward the root bridge on each non-root switch (one per switch); the designated port is the lowest-cost (downstream) port on each segment; the alternate port is a backup for the root port, normally discarding to break the loop.
• RSTP has three port states: discarding (no data, no MAC learning), learning (learns MACs but does not forward), and forwarding (learns and forwards). RSTP simplifies classic STP's five states (disabled/blocking/listening/learning/forwarding) into three—folding blocking + listening into discarding—which is part of what speeds convergence.
• Verify the current roles, states, and root with show spanning-tree (or show spanning-tree vlan 10). If Root ID equals Bridge ID, this switch is the root; each port's Role (Root/Desg/Altn) and Sts (FWD/BLK, etc.) reveal the tree's shape.

2.3.3PortFast and BPDU Guard

• PortFast moves an access port connected to an end host straight to forwarding, skipping the usual listening/learning, eliminating delays such as DHCP not arriving right after a PC boots. Do not use it on ports connecting other switches (loop risk). Configure with spanning-tree portfast (interface).
• BPDU Guard immediately puts a PortFast port into err-disabled state if it receives a BPDU. If a switch is accidentally (or maliciously) connected to an end-host port, its BPDUs would disturb the topology; BPDU Guard detects that and shuts the port down. Configure with spanning-tree bpduguard enable (per-port) or spanning-tree portfast bpduguard default (global, applied to all PortFast ports).

In a company network, a core switch (Core) and two access switches (AccessA, AccessB) are redundantly connected in a triangle. The administrator wanted Core to be the root bridge for certain, but left every switch at the default priority of 32768, so AccessA—whose MAC address happened to be smallest—was elected root, producing an inefficient tree rooted at an access switch. Confirming with show spanning-tree vlan 1 that Root ID belongs to AccessA, the admin sets spanning-tree vlan 1 priority 4096 (or root primary) on Core to make Core the root for certain. Next, users reported that PC ports took tens of seconds to reach forwarding after link-up (classic-STP-like delay), so DHCP failed at boot; configuring PortFast moves those ports straight to forwarding. But PortFast alone is dangerous: if a small switch or hub is accidentally plugged into such a port, its BPDUs enter the topology calculation and can trigger root re-election or a loop. So the design pairs it with BPDU Guard, which err-disables a PortFast port the instant it receives a BPDU. This completes the classic pattern of using PortFast and BPDU Guard together: bring end-host ports up fast, while automatically defending against a switch being plugged in—by accident or maliciously. The single most important point of this design is that configuring PortFast without BPDU Guard, then plugging a switch into that port, could let STP miss a loop it should have blocked and cause a broadcast storm.

2.3.4Section summary

• The root bridge is the switch with the smallest bridge ID (priority, then MAC). Default priority 32768, changed in multiples of 4096; lower it (root primary/priority) to designate a switch
• Cisco's default is Rapid PVST+ (per-VLAN RSTP, seconds to converge). Roles are root/designated/alternate; states are the three: discarding/learning/forwarding
• PortFast moves end-host access ports straight to forwarding; BPDU Guard err-disables such a port on receiving a BPDU. Always operate the two together