Skip to content
Log in Sign up My account

3.1.c Rapid Spanning Tree (RSTP and Rapid PVST+)

Blueprint 3.1.c: Configure and verify common Spanning Tree Protocols (RSTP, MST) and Spanning Tree enhancements such as root guard and BPDU guard

This page covers the RSTP half:

  • Bridge ID, root bridge election, port costs and the role selection tie-breakers
  • RSTP port states (discarding, learning, forwarding) and roles (root, designated, alternate, backup)
  • Link types (point-to-point, shared, edge) and the proposal/agreement handshake
  • RSTP topology change handling
  • Configuring and verifying Rapid PVST+ on IOS XE

MST is on the MST page. PortFast, BPDU Guard, BPDU Filter, Root Guard and Loop Guard are on the STP protection page.

Spanning tree in one paragraph

Ethernet frames have no TTL, so a Layer 2 loop carries broadcasts around forever and melts the network in seconds. Spanning tree elects one root bridge, finds the best path from every switch to it, and blocks every other redundant port. RSTP (IEEE 802.1w, now part of 802.1D-2004 and 802.1Q) keeps the same election logic as classic 802.1D STP but converges in about a second or less on point-to-point links instead of 30 to 50 seconds. Cisco's Rapid PVST+ runs a separate RSTP instance for every VLAN.

Bridge ID and root election

Every switch has a bridge ID (BID) per VLAN:

Part Bits Value
Priority 4 0 to 61440 in steps of 4096. Default 32768.
Extended system ID 12 The VLAN number (or MST instance number)
MAC address 48 The switch's base MAC

So the default BID priority shown for VLAN 10 is 32778 (32768 + 10). You can only configure the 4-bit part, which is why IOS rejects a priority that is not a multiple of 4096.

The switch with the lowest BID becomes root. Priority is compared first, then MAC. All ports on the root are designated.

Port costs

Link speed Short (802.1D-1998) Long (802.1t)
10 Mbps 100 2,000,000
100 Mbps 19 200,000
1 Gbps 4 20,000
10 Gbps 2 2,000
100 Gbps not distinct 200

Set the method with spanning-tree pathcost method long|short. The default for Rapid PVST+ varies by platform and release, so check show spanning-tree summary (it prints the path cost method in use). MST always uses long costs. Every switch in a network should use the same method, or root path costs become meaningless.

Root path cost is the sum of the inbound port costs along the path to the root. A switch adds the cost of the port on which it receives the root's BPDU.

Port role selection

Each non-root switch picks exactly one root port: the port with the best path to the root. On each segment, one port is the designated port: the one that offers the best path from that segment to the root. Everything else is alternate or backup.

Tie-breakers, applied in order until one port wins:

Step Root port selection Designated port selection on a segment
1 Lowest root path cost Lowest root path cost advertised
2 Lowest sender bridge ID Lowest bridge ID
3 Lowest sender port priority Lowest port priority
4 Lowest sender port number Lowest port number

The word sender matters. When a switch has two links to the same upstream neighbour, steps 3 and 4 use the neighbour's port priority and port number, not its own. To influence which local port becomes root port, change port priority on the upstream switch, or change cost on the local switch.

Exam trap

Changing spanning-tree port-priority on a switch does not change that switch's root port. Port priority is advertised in BPDUs and used by the downstream neighbour. To make the local switch prefer a different uplink, change spanning-tree cost on the local port instead.

RSTP port states and roles

802.1D state RSTP state Learns MACs Forwards
Disabled Discarding No No
Blocking Discarding No No
Listening Discarding No No
Learning Learning Yes No
Forwarding Forwarding Yes Yes

Cisco output still shows a discarding port as BLK.

Role Meaning State in a stable topology
Root Best path toward the root bridge Forwarding
Designated Best port on a segment toward the root Forwarding
Alternate Another path to the root through a different bridge; a ready backup for the root port Discarding
Backup Another port to a segment where this bridge is already designated (only possible with a shared medium, such as a hub) Discarding
Disabled Administratively down n/a

An alternate port is what makes RSTP fast after a root port failure: the switch promotes it to root port and moves it to forwarding immediately, without waiting for timers, because the alternate path cannot create a loop.

Type How it is detected Rapid transition?
Point-to-point Full duplex port Yes, through proposal/agreement
Shared Half duplex port No, falls back to timer-based transitions
Edge Configured with PortFast Goes to forwarding immediately, generates no topology change

Override detection with spanning-tree link-type point-to-point (for example on a full-duplex link that negotiated half duplex by mistake, after you fix the duplex). An edge port that receives a BPDU loses its edge status and becomes a normal spanning tree port.

Proposal and agreement

On a point-to-point link, RSTP does not wait for the forward delay timer. The upstream switch proposes to make its port designated and forwarding, and the downstream switch agrees after making sure that doing so cannot create a loop.

graph LR
  R["Upstream switch<br/>designated port, discarding"] -- "1 BPDU with proposal flag" --> D["Downstream switch"]
  D -- "2 sync: block all non-edge<br/>designated ports" --> D2["Downstream<br/>ports below"]
  D -- "3 BPDU with agreement flag<br/>root port forwarding" --> R
  R -- "4 designated port<br/>forwarding at once" --> R
  D2 -- "5 downstream proposes<br/>on its own designated ports" --> N["Next switch"]
  1. When a link comes up, the upstream port is designated but discarding, and it sends BPDUs with the proposal flag set.
  2. The downstream switch sees a superior BPDU and selects that port as its root port. It then performs a sync: every non-edge designated port goes to discarding. Edge ports and ports already discarding are left alone.
  3. With nothing left that could form a loop, it sends a BPDU with the agreement flag back on the root port and moves that root port to forwarding.
  4. The upstream switch receives the agreement and moves its designated port straight to forwarding.
  5. The downstream switch now proposes on each of its own designated ports. The handshake ripples outward from the root, one hop at a time, each step taking only as long as a BPDU exchange.

If the downstream port is on a shared link, or the neighbour runs legacy 802.1D and never sends an agreement, the port falls back to the timer-based path: 15 seconds discarding (listening equivalent), 15 seconds learning, then forwarding.

Timers and BPDUs

Timer Default Role in RSTP
Hello 2 s Every switch sends its own BPDU on designated ports every hello, not only when relaying the root's
Neighbour timeout 3 x hello (6 s) If no BPDU arrives for three hellos, the information is aged out
Max age 20 s Used for 802.1D compatibility and as a path length limit
Forward delay 15 s Used only when falling back to timer-based transitions

Because every switch originates BPDUs, a switch can detect a dead neighbour in 6 seconds without waiting for max age, and immediately if the physical link goes down.

Topology changes

In RSTP only a non-edge port moving to forwarding is a topology change. A port going down or to discarding is not (the remaining tree is still loop free). When a switch detects a topology change it:

  1. Starts the TC While timer (twice the hello time) on its non-edge designated ports and root port.
  2. Sends BPDUs with the TC flag set on those ports while the timer runs.
  3. Flushes the MAC addresses learned on those ports.

A switch that receives a TC BPDU flushes MAC addresses on all its ports except the one it received the BPDU on, and propagates the TC. This is faster and cleaner than 802.1D, where the change had to travel to the root first. Edge ports never trigger a topology change, which is another reason to configure PortFast on every host port.

Compatibility with 802.1D

RSTP is backward compatible per port. If a port receives a legacy 802.1D BPDU, it starts sending 802.1D BPDUs and loses the rapid features on that port. If the legacy switch is later removed, the port does not automatically return to RSTP BPDUs. Use clear spanning-tree detected-protocols to restart protocol migration.

Configuring Rapid PVST+

spanning-tree mode rapid-pvst
!
! Option 1: macros
spanning-tree vlan 10 root primary
spanning-tree vlan 20 root secondary
!
! Option 2: explicit priority (multiples of 4096)
spanning-tree vlan 10 priority 24576
spanning-tree vlan 20 priority 28672
!
interface GigabitEthernet0/2
 spanning-tree vlan 20 cost 10          ! per-VLAN cost on this port
 spanning-tree vlan 10 port-priority 64 ! advertised to the neighbour
 spanning-tree link-type point-to-point
Command Effect
spanning-tree vlan X root primary One-time macro: sets priority to 24576, or to 4096 below the current root if that is already lower
spanning-tree vlan X root secondary One-time macro: sets priority to 28672
spanning-tree vlan X priority P Sets the 4-bit priority directly
spanning-tree [vlan X] cost C Overrides the port cost (all VLANs or one VLAN)
spanning-tree [vlan X] port-priority P 0 to 240 in steps of 16, default 128

Exam trap

root primary is a macro, not a role. It writes a priority value into the configuration once. If someone later adds a switch with priority 0, that switch becomes root and the macro does nothing about it. Use explicit priorities (and Root Guard) to make the design deterministic.

Load sharing with Rapid PVST+

The usual design makes one distribution switch the root (and HSRP active) for odd VLANs and the other for even VLANs. Each access switch then forwards odd VLANs on one uplink and even VLANs on the other, so both uplinks carry traffic. Align STP root and FHRP active router per VLAN, or traffic will cross the inter-distribution link unnecessarily.

Verifying

ACC1# show spanning-tree vlan 10

VLAN0010
  Spanning tree enabled protocol rstp
  Root ID    Priority    24586
             Address     5254.0001.0000
             Cost        4
             Port        2 (GigabitEthernet0/1)
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec

  Bridge ID  Priority    32778  (priority 32768 sys-id-ext 10)
             Address     5254.0003.0000
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec
             Aging Time  300 sec

Interface           Role Sts Cost      Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------------------
Gi0/1               Root FWD 4         128.2    P2p
Gi0/2               Altn BLK 4         128.3    P2p
Gi1/0               Desg FWD 4         128.5    P2p Edge

How to read it:

  • protocol rstp confirms Rapid PVST+ is running for this VLAN. ieee would mean legacy PVST+.
  • Root ID priority 24586 = 24576 + 10. The root is DIST1 (MAC 5254.0001.0000), reachable at cost 4 through Gi0/1.
  • This switch has default priority 32778, so it is not root.
  • Gi0/2 is the alternate, discarding. If Gi0/1 fails it becomes root port immediately.
  • Gi1/0 is an edge (PortFast) port to a host.
Command Use
show spanning-tree vlan X Root, local BID, port roles, states, costs, link types
show spanning-tree root Root BID, cost and root port for every VLAN in one table
show spanning-tree summary Mode, path cost method, global features, per-VLAN port counts by state
show spanning-tree interface Gi0/2 detail BPDUs sent and received, designated bridge, transitions
show spanning-tree vlan X detail Topology change count, time since last change and the port it came from
debug spanning-tree events Role and state transitions in real time (lab only)

show spanning-tree vlan 10 detail includes a line such as Number of topology changes 14 last change occurred 00:02:11 ago from GigabitEthernet0/2. A topology change count that keeps rising points at a flapping port, often a host port missing PortFast.

Exam trap

In RSTP the Altn role and the Back role are both discarding, but they are not interchangeable. Alternate means "another way to the root through a different switch". Backup means "a second port on a segment this switch already serves", which needs a shared medium such as a hub. On a modern switched point-to-point network you will see alternates, almost never backups.

Lab: Rapid PVST+ load sharing and rapid failover

Topology: the module base block (IOSvL2). Po1 is the LACP bundle from the EtherChannel lab. All links are 1 Gbps; costs below assume the short method.

graph TB
  D1["DIST1<br/>root VLAN 10"] -- "Po1 cost 3" --- D2["DIST2<br/>root VLAN 20"]
  D1 -- "Gi0/2 to Gi0/1" --- A1["ACC1"]
  D2 -- "Gi0/2 to Gi0/2" --- A1
  A1 -- "Gi1/0 edge" --- H1["Host1 VLAN 10"]

Steps

  1. Set spanning-tree mode rapid-pvst on all three switches.
  2. On DIST1 set VLAN 10 priority 24576 and VLAN 20 priority 28672. On DIST2 do the reverse.
  3. On ACC1 Gi1/0 configure spanning-tree portfast.
  4. Verify ACC1 forwards VLAN 10 on Gi0/1 and VLAN 20 on Gi0/2, with the other uplink alternate in each VLAN.
  5. Start a continuous ping from Host1 to the VLAN 10 gateway (or to DIST1's VLAN 99 SVI from ACC1). Shut ACC1 Gi0/1. Count lost pings; expect zero or one.
  6. Check show spanning-tree vlan 10 detail on ACC1 for the topology change and the new root port.
  7. Bring Gi0/1 back and watch the proposal/agreement with debug spanning-tree events (turn it off afterwards with undebug all).

Configuration

spanning-tree mode rapid-pvst
spanning-tree vlan 10,99 priority 24576
spanning-tree vlan 20 priority 28672

spanning-tree mode rapid-pvst
spanning-tree vlan 20 priority 24576
spanning-tree vlan 10,99 priority 28672

spanning-tree mode rapid-pvst
interface GigabitEthernet1/0
 spanning-tree portfast

Expected verification after step 4

ACC1# show spanning-tree root

                                        Root    Hello Max Fwd
Vlan                   Root ID          Cost    Time  Age Dly  Root Port
---------------- -------------------- --------- ----- --- ---  ------------
VLAN0010         24586 5254.0001.0000         4    2   20  15  Gi0/1
VLAN0020         24596 5254.0002.0000         4    2   20  15  Gi0/2
VLAN0099         24675 5254.0001.0000         4    2   20  15  Gi0/1
VLAN0999         33767 5254.0001.0000         4    2   20  15  Gi0/1

VLAN 999 has no configured priority anywhere, so the lowest MAC (DIST1 in this example) wins with default priority 32768 + 999 = 33767. In a real design you would set it explicitly.

Expected after step 5

ACC1# show spanning-tree vlan 10 | begin Interface
Interface           Role Sts Cost      Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------------------
Gi0/2               Root FWD 4         128.3    P2p
Gi1/0               Desg FWD 4         128.5    P2p Edge

ACC1's new root path cost for VLAN 10 is 7 (4 to DIST2, plus 3 across Po1).

If your image uses the long path cost method, the 1 Gbps costs are 20000 and the two-member bundle is 10000, so the failover cost is 30000.

See diagram E21 for a role selection exercise.

Quick check

Two switches, SW1 and SW2, are joined by two parallel links. SW1 is root. SW2 shows equal cost on both ports. Which SW2 port becomes root port?

The port that receives the BPDU with the lower sender port priority, and if those are equal, the lower sender port number. Both are SW1's values, not SW2's.

A host port without PortFast goes up and down every few minutes. What does RSTP do each time it comes up, and why does it matter?

The port is not an edge port, so moving to forwarding is a topology change. The switch sends TC BPDUs, and switches across the VLAN flush MAC addresses, causing unicast flooding until the tables relearn. PortFast stops this.

What is the default bridge priority shown for VLAN 30, and what values can you configure?

32798 (32768 + 30). You can set 0 to 61440 in multiples of 4096; the extended system ID is added automatically.

References

  • Catalyst 9300 Series Layer 2 Configuration Guide, chapter "Configuring Spanning Tree Protocol" (search on cisco.com for your release)
  • IEEE 802.1D-2004 (incorporates 802.1w RSTP) and IEEE 802.1Q
  • Cisco tech note "Understanding Rapid Spanning Tree Protocol (802.1w)" (search on cisco.com)
  • Cisco Live On-Demand Library: search "spanning tree" and "campus Layer 2 design"