Skip to content
Log in Sign up My account

3.1.c Multiple Spanning Tree (MST)

Blueprint 3.1.c: Configure and verify common Spanning Tree Protocols (RSTP, MST) and Spanning Tree enhancements such as root guard and BPDU guard

This page covers MST:

  • Why MST exists and how it maps many VLANs to a few instances
  • MST regions: name, revision number and VLAN-to-instance mapping
  • IST (instance 0), MSTIs, the CIST, the CIST root and the CIST regional root
  • Region boundaries and interaction with Rapid PVST+
  • Configuring, verifying and troubleshooting MST on IOS XE

MST uses the same RSTP mechanics (roles, proposal/agreement, edge ports) described on the RSTP page.

Why MST

Rapid PVST+ runs one spanning tree per VLAN. A campus with 500 VLANs runs 500 instances, each sending its own BPDU every 2 seconds on every trunk. Yet a typical design only needs two logical topologies: "odd VLANs forward via DIST1, even VLANs forward via DIST2".

Multiple Spanning Tree (originally IEEE 802.1s, now part of 802.1Q) lets you map any number of VLANs to a small number of instances. Each instance has its own root and its own port roles, and all VLANs mapped to it share that topology. MST is also the IEEE standard, so it is the natural choice in multivendor networks.

Rapid PVST+ MST
Standard Cisco IEEE 802.1s / 802.1Q
Instances One per VLAN As many as you configure (a handful is typical)
BPDUs One per VLAN per hello One BPDU per hello carrying all instances
Convergence RSTP RSTP
Load sharing Per VLAN Per instance
Planning effort Low Higher: regions must be designed and kept consistent
Path cost method Short or long Always long

Regions

An MST region is a group of interconnected switches that share an identical MST configuration. Three values make up that configuration:

Value Range Notes
Region name Up to 32 characters Case sensitive
Revision number 0 to 65535 Just a number you choose; it is not incremented automatically
VLAN-to-instance mapping VLANs 1 to 4094 to instances Unmapped VLANs belong to instance 0

Each BPDU carries the name, the revision and a digest (a hash) of the mapping table. Two neighbouring switches are in the same region only if all three match exactly. The configuration is never propagated between switches: you must enter the same configuration on every switch in the region (or push it with automation).

graph LR
  subgraph RA ["Region CAMPUS rev 1"]
    A["DIST1"] --- B["DIST2"]
    A --- C["ACC1"]
    B --- C
  end
  subgraph RB ["Region DC rev 4"]
    D["DC-SW1"] --- E["DC-SW2"]
  end
  B -- "boundary: only the CIST crosses" --- D
  C -- "boundary" --- P["Legacy switch<br/>Rapid PVST+"]

Instances and the CIST

Term Meaning
MSTI Multiple spanning tree instance (1 and up). Exists only inside a region. Each has its own root, priority, costs and port roles.
IST Internal spanning tree, instance 0. Present in every region. Carries every VLAN you did not map elsewhere, and carries the BPDUs for the whole region.
CST Common spanning tree. The tree that connects regions (and non-MST switches) to each other. Each region looks like one big virtual bridge in the CST.
CIST Common and internal spanning tree. The IST of every region plus the CST joining them: one tree across the entire network.
CIST root The bridge with the lowest instance 0 bridge ID in the whole network.
CIST regional root In each region, the switch closest to the CIST root (lowest external path cost). If the CIST root is inside the region, it is also that region's regional root.

Key behaviours:

  • One BPDU. An MST switch sends one BPDU for the IST, with an M-record for each MSTI appended. Timers (hello, forward delay, max age) are set for the IST only and apply to all instances.
  • Hop count. Inside a region, BPDU information is aged by a hop count that starts at max-hops (default 20) at the regional root and decreases by one per switch, instead of by message age.
  • Bridge ID. The extended system ID is the instance number, not a VLAN. A switch with priority 24576 shows 24577 in MST1.
  • Boundary ports. A port that connects to another region or to a non-MST switch is a boundary port. On a boundary port, every MSTI takes the same role and state as the CIST. You cannot load share across a region boundary.

Exam trap

The region name is case sensitive and the revision number is not incremented for you. name Campus on one switch and name CAMPUS on the other, or revision 1 against revision 2, splits the region even though the VLAN mapping looks identical. The switches still form a loop-free tree (the CIST), so nothing goes down, but your per-instance load sharing silently stops working.

Interaction with Rapid PVST+

A boundary port facing a Rapid PVST+ (or PVST+) switch uses PVST simulation. MST sends its CIST BPDU replicated on every VLAN so the PVST+ neighbour sees a consistent tree, and it checks the per-VLAN BPDUs it receives.

The consistency rule: either the MST region holds the root for every VLAN, or the PVST+ side holds the root for every VLAN. In practice:

  • If the CIST root is inside the MST region, every PVST+ VLAN root priority on the legacy side must be worse than the CIST root.
  • If the root is on the PVST+ side, the PVST+ root for VLAN 1 becomes the CIST root, and the roots for all other VLANs must also be on the PVST+ side, with priorities better than any switch in the MST region.

When the rule is broken, the boundary port is blocked as PVST simulation inconsistent and you will see *PVST_Inc next to the port. Fix the priorities; do not disable PVST simulation unless you understand the loop risk. During a migration the cleanest approach is to make the MST core (usually distribution) the root for everything.

Configuring MST

spanning-tree mst configuration
 name CAMPUS
 revision 1
 instance 1 vlan 10,30
 instance 2 vlan 20,40
 show pending                    ! review before leaving the submode
 exit                            ! changes apply on exit; "abort" discards them
!
spanning-tree mode mst
!
spanning-tree mst 0-1 priority 24576
spanning-tree mst 2 priority 28672
!
interface GigabitEthernet0/2
 spanning-tree mst 2 cost 10000
 spanning-tree mst 1 port-priority 64
Command Purpose
spanning-tree mode mst Turns on MST for the whole switch
spanning-tree mst configuration Enters the region submode (name, revision, instance)
instance N vlan LIST Maps VLANs; no instance N vlan LIST removes them back to instance 0
spanning-tree mst N priority P Priority per instance, multiples of 4096
spanning-tree mst N root primary or secondary Same one-time macros as Rapid PVST+, per instance
spanning-tree mst N cost C Per-instance port cost (long method)
spanning-tree mst N port-priority P Per-instance port priority
spanning-tree mst hello-time, forward-time, max-age, max-hops Region-wide timers, set on the IST

Practical advice:

  • Configure the region first, then change the mode. That way the switch joins the right region the moment MST starts.
  • Map VLANs before you create them. You can map VLANs that do not exist yet. Changing the mapping later changes the digest and causes a reconvergence, so plan the ranges once (for example odd and even, or 100 to 199 and 200 to 299).
  • Keep instance 0 sensible. Set its root to the same switch as your main MSTI or the switch you want as CIST root. Leaving it at defaults lets the lowest MAC address win.

Exam trap

MST blocks per instance, not per VLAN. If VLANs 10 and 20 are both in MST1, and trunk A allows only VLAN 10 while trunk B allows only VLAN 20, MST may block trunk B for MST1. VLAN 20 then has no forwarding path at all. When you use MST, keep the allowed VLAN lists consistent on redundant links, or at least consistent with the instance mapping.

Verifying MST

DIST1# show spanning-tree mst configuration
Name      [CAMPUS]
Revision  1     Instances configured 3

Instance  Vlans mapped
--------  ---------------------------------------------------------------------
0         1-9,11-19,21-29,31-39,41-4094
1         10,30
2         20,40
-------------------------------------------------------------------------------

Compare this block on every switch. It is the fastest way to find a region mismatch.

ACC1# show spanning-tree mst 1

##### MST1    vlans mapped:   10,30
Bridge        address 5254.0003.0000  priority      32769 (32768 sysid 1)
Root          address 5254.0001.0000  priority      24577 (24576 sysid 1)
              port    Gi0/1            cost          20000     rem hops 19

Interface        Role Sts Cost      Prio.Nbr Type
---------------- ---- --- --------- -------- --------------------------------
Gi0/1            Root FWD 20000     128.2    P2p
Gi0/2            Altn BLK 20000     128.3    P2p
Gi1/0            Desg FWD 20000     128.5    P2p Edge

How to read it:

  • VLANs 10 and 30 use this topology.
  • Priority 24577 for the root is 24576 plus the instance number 1.
  • rem hops 19: DIST1 is the MST1 root and one hop away.
  • Costs are long-method values: 20000 for a 1 Gbps port.
Command Use
show spanning-tree mst configuration Name, revision and mapping (the region identity)
show spanning-tree mst Every instance with roles and states
show spanning-tree mst N One instance
show spanning-tree mst interface Gi0/2 Per-instance role, state and cost of one port, plus boundary and edge status
show spanning-tree mst N detail BPDU counters and designated bridge per port
show spanning-tree summary Confirms Switch is in mst mode

A port in the Type column showing Bound(PVST) or Bound(RSTP) is a boundary port facing a Rapid PVST+ or RSTP neighbour. On such ports every instance follows the CIST.

Troubleshooting checklist

Symptom Likely cause Check
Per-instance load sharing does not happen; one switch is root for MST1 and MST2 by itself Region mismatch, so it is a one-switch region show spanning-tree mst configuration on both ends
A VLAN has no connectivity across a redundant pair of trunks Allowed VLANs differ from the instance topology show interfaces trunk and show spanning-tree mst N
Boundary port shows BKN* with PVST_Inc PVST simulation consistency rule broken Root priorities on both sides
Root for MST0 is an unexpected access switch Priorities set only for MSTIs spanning-tree mst 0 priority
Region changes take effect unexpectedly Changes in the submode apply on exit Use show pending before exiting

Lab: MST with two instances, then break the region

Topology: the module base block, all switches IOSvL2, trunks and Po1 from the earlier labs. VLANs 10, 20, 30 and 40 exist on all three switches.

graph TB
  D1["DIST1<br/>MST0 and MST1 root"] -- "Po1" --- D2["DIST2<br/>MST2 root"]
  D1 -- "Gi0/2 to Gi0/1" --- A1["ACC1"]
  D2 -- "Gi0/2 to Gi0/2" --- A1

Steps

  1. On all three switches enter the region configuration below, review it with show pending, and exit. Then set spanning-tree mode mst.
  2. On DIST1 set MST0 and MST1 priority 24576 and MST2 priority 28672. On DIST2 set MST2 priority 24576 and MST0 and MST1 priority 28672.
  3. On ACC1 confirm with show spanning-tree mst that MST1 forwards on Gi0/1 and MST2 forwards on Gi0/2.
  4. On ACC1 change the revision to 2. Compare show spanning-tree mst 1 before and after: ACC1 becomes root of its own MST1 and MST2 (it is now a region of one), and both uplinks become boundary ports that follow the CIST, so MST2 now forwards on Gi0/1 like everything else.
  5. Restore revision 1. Then change the name on ACC1 to campus (lower case) and observe the same result. Restore it.
  6. On ACC1 remove VLAN 30 from Gi0/1's allowed list only. Explain why VLAN 30 hosts on ACC1 lose connectivity to DIST1 while VLAN 10 does not. Restore it.

Configuration (all three switches)

spanning-tree mst configuration
 name CAMPUS
 revision 1
 instance 1 vlan 10,30
 instance 2 vlan 20,40
 exit
spanning-tree mode mst

spanning-tree mst 0-1 priority 24576
spanning-tree mst 2 priority 28672

spanning-tree mst 2 priority 24576
spanning-tree mst 0-1 priority 28672

Expected verification after step 3

ACC1# show spanning-tree mst 2 | begin Interface
Interface        Role Sts Cost      Prio.Nbr Type
---------------- ---- --- --------- -------- --------------------------------
Gi0/1            Altn BLK 20000     128.2    P2p
Gi0/2            Root FWD 20000     128.3    P2p
Gi1/0            Desg FWD 20000     128.5    P2p Edge

Expected after step 4 (ACC1)

ACC1# show spanning-tree mst 2 | include Root
Root          this switch for MST2

Gi0/1 is now root port for every instance (it follows the CIST toward DIST1) and Gi0/2 is alternate for every instance.

Answer to step 6: VLAN 30 is in MST1, which forwards only on Gi0/1. With VLAN 30 removed from that trunk, MST1's forwarding path no longer carries it, and the MST1 alternate port Gi0/2 stays blocking because spanning tree does not know about allowed lists.

The timed version of this lab is Sim 02: MST regions and instances. Diagram E22 summarises region boundaries.

Quick check

Two switches have the same MST name and revision but SW2 maps VLAN 50 to instance 1 while SW1 leaves it in instance 0. Are they in the same region?

No. The mapping digest differs, so they are in different regions. The link becomes a boundary and only the CIST runs across it.

What priority value does show spanning-tree mst 3 display for a switch configured with spanning-tree mst 3 priority 8192?

8195 (8192 plus the instance number 3).

On a boundary port between two MST regions, can MST1 forward while MST2 blocks?

No. On a boundary port every MSTI inherits the CIST role and state, so all instances forward or all block together.

References

  • Catalyst 9300 Series Layer 2 Configuration Guide, chapter "Configuring Multiple Spanning-Tree Protocol" (search on cisco.com for your release)
  • IEEE 802.1Q (incorporates 802.1s Multiple Spanning Trees)
  • Cisco tech note "Understanding Multiple Spanning Tree Protocol (802.1s)" (search on cisco.com)
  • Cisco Live On-Demand Library: search "spanning tree" and "MST migration"