3.3Spanning tree (RSTP, MST, and guard features)

Spanning tree is not merely a loop-prevention mechanism—who becomes the root bridge determines how traffic actually flows, making it a de facto path-selection mechanism. ENCOR tests RSTP's fast-converging behavior, MST designs that do not collapse as VLAN counts grow, and the guard features that protect topology when an unintended switch is plugged in. This section organizes what each feature detects and does, anchored on real incidents such as "someone plugged a personal switch into an access port" and "a newly installed switch accidentally stole the root role."

3.3.1RSTP roles and states

• RSTP (802.1w) consolidates legacy STP's listening/learning/forwarding/blocking into three states: discarding, learning, forwarding, and instead of waiting on timers it reaches agreement with the neighbor through a proposal/agreement handshake and begins forwarding immediately. Convergence drops from legacy STP's 30-50 seconds to a few seconds.
• There are four port roles: root port (the single best path toward the root bridge), designated port (the side closest to the root on that segment, which forwards), alternate port (holds an alternate path to the root and discards; it is promoted immediately if the root port fails), and backup port (a redundant link to the same segment, e.g. via a hub, standing by for the designated port).
• Ports facing end hosts should be spanning-tree portfast (edge ports) so they forward immediately. Conversely, an edge port that receives a BPDU automatically reverts to a normal port—an important sign that a switch was plugged in where only end hosts belong. Root election is won by the lowest bridge ID = priority (default 32768, in steps of 4096) plus MAC address.

3.3.2Scalability with MST

• Cisco's PVST+ runs an independent tree per VLAN, so at several hundred VLANs the BPDU generation and CPU load grow linearly and become unsustainable. MST (Multiple Spanning Tree, 802.1s) maps many VLANs onto a single instance, holding the number of trees to the minimum needed (say two to four), which cuts load dramatically while still allowing paths to be split per instance rather than per VLAN.
• The crux of MST is the region: switches form one region only when the region name, revision number, and VLAN-to-instance mapping match exactly. A single character of difference makes them separate regions, and at a region boundary the whole region appears externally as a single virtual bridge. Configure it under spanning-tree mst configuration with name, revision, and instance 1 vlan 10-20.
• A typical design assigns odd VLANs to instance 1 and even VLANs to instance 2, roots them on different switches, and thereby uses both uplinks (load sharing). Verify the region settings with show spanning-tree mst configuration and the per-instance roles and states with show spanning-tree mst 1.

3.3.3Root guard and BPDU guard

• Root guard (spanning-tree guard root) is enabled per port; when that port receives a superior BPDU (one with a better bridge ID than the current root), it puts the port into root-inconsistent and stops forwarding. Its purpose is to enforce a design boundary—"the root bridge must never come from here"—and it recovers automatically once the superior BPDUs stop.
• BPDU guard (spanning-tree bpduguard enable, or globally spanning-tree portfast bpduguard default) shuts the port to err-disabled the moment a PortFast (edge) port receives any BPDU, regardless of whether it is superior. Its purpose is to physically cut off a switch plugged in where only end hosts belong, and recovery requires manual shutdown/no shutdown or the errdisable recovery cause bpduguard automatic setting.
• In one line: root guard reacts only to superior BPDUs with root-inconsistent (auto-recovering, port stays alive), while BPDU guard reacts to any BPDU at all with err-disabled (manual recovery, port goes down). Relatedly, loop guard puts a port that stops receiving BPDUs it used to receive into loop-inconsistent, preventing erroneous forwarding caused by a unidirectional failure.

One morning two fault reports arrive. First: "every host on a sales-floor cluster suddenly lost the network." Second: "one uplink on a data-center distribution switch stopped forwarding." Both are spanning-tree related, yet a different resulting state means a different cause and a different fix. For the first, the access-switch port is err-disabled and the log records %SPANTREE-2-BLOCK_BPDUGUARD. That port is a host-only PortFast port, so a BPDU arriving there means a user plugged in a personal switch (or a device with hub functionality). BPDU guard shuts the port on any BPDU regardless of superiority, so this is the feature working exactly as intended; the fix is not to remove BPDU guard but to remove the attached device and restore the port with shutdown/no shutdown (or automatic recovery via errdisable recovery cause bpduguard). Casually disabling BPDU guard here means that next time a real loop takes down the entire floor. For the second, the distribution-switch port is not err-disabled; it shows BKN* and appears under show spanning-tree inconsistentports as Root Inconsistent. That is root guard, not BPDU guard, indicating that a BPDU with a bridge ID superior to the current root arrived from beyond that port. Tracing it reveals a lab switch brought in for testing, still configured with priority 4096, attempting to take over as root. Without root guard, the campus root would have moved to the test switch and all traffic would have detoured over a slow path, degrading performance broadly. The fix is to remove the source of the superior BPDUs, and once they stop, root-inconsistent clears automatically—no manual recovery needed. The contrast teaches a diagnostic pattern that runs straight from state name to cause: err-disabled means BPDU guard (a BPDU arrived where none should) and root-inconsistent means root guard (a superior BPDU arrived from a direction the root must never come from).

3.3.4Section summary

• RSTP converges in seconds via three states plus proposal/agreement, and the alternate port is promoted immediately when the root port fails
• MST maps many VLANs onto few instances to cut load; identical region name, revision, and VLAN mapping are required to share a region
• Root guard yields root-inconsistent on a superior BPDU (auto-recovery) while BPDU guard yields err-disabled on any BPDU at a PortFast port (manual recovery); the state name names the cause