RSTP / Rapid Spanning Tree Configuration
Classic 802.1D Spanning Tree Protocol was designed in an era when a 30–50 second convergence delay was acceptable. In modern networks, that delay causes application sessions to time out and VoIP calls to drop whenever a link fails or a switch reboots. RSTP (Rapid Spanning Tree Protocol, IEEE 802.1w) replaces the passive timer-based convergence of 802.1D with an active proposal/agreement handshake that allows ports to transition to Forwarding in as little as one or two hello intervals — typically under one second. On Cisco switches, RSTP runs as Rapid PVST+, maintaining a separate spanning tree instance per VLAN (just like PVST+) while delivering 802.1w rapid convergence on every point-to-point link.
RSTP achieves speed through three mechanisms: ports directly
connected to end devices transition immediately to Forwarding as
edge ports; upstream links use the
proposal/agreement synchronisation to transition without waiting
for timers; and only two port roles (Root Port and Designated Port)
have forwarding paths, while the Alternate Port provides an
instantly activated backup. This lab configures Rapid PVST+ from
scratch, sets correct edge and link-type parameters, applies
protective features like BPDU Guard, and uses
show spanning-tree detail to confirm that rapid
transitions are occurring rather than classic timer-based ones.
RSTP interacts closely with VLAN design — for VLAN creation and trunk configuration that RSTP operates over see VLAN Creation and Management, Trunk Port Configuration, and VLANs. For the root bridge election and PVST+ load balancing concepts see Spanning Tree Root Bridge Configuration and STP Overview. For PortFast and BPDU Guard configuration see PortFast and BPDU Guard. For port security features applied to edge ports see Port Security and Port Security — Sticky MAC.
1. RSTP — Core Concepts
802.1D vs 802.1w Comparison
| Feature | Classic 802.1D | RSTP 802.1w / Rapid PVST+ |
|---|---|---|
| Convergence time | 30–50 seconds (2× Forward Delay = 30 s default) | 1–2 seconds on point-to-point links; immediate on edge ports |
| Port states | 5 states: Disabled, Blocking, Listening, Learning, Forwarding | 3 states: Discarding (combines Disabled/Blocking/Listening), Learning, Forwarding |
| Port roles | Root, Designated, Blocked (non-designated) | Root, Designated, Alternate, Backup |
| Convergence mechanism | Passive timer expiry — waits for Max Age (20 s) + Listening (15 s) + Learning (15 s) | Active proposal/agreement handshake — switch-to-switch negotiation without waiting for timers |
| Topology Change | TCN BPDUs propagate to Root Bridge; Root floods TC for Max Age | Each switch independently flushes its MAC table and propagates TC for 2× Hello Time only |
| BPDU handling | Only Root Bridge originates BPDUs; non-root switches relay | Every switch originates BPDUs every Hello Time; missing 3× Hello Times declares link failure |
| Edge port (end device) | PortFast — Cisco proprietary feature; still sends BPDUs | Edge port — standard 802.1w concept; moves immediately to Forwarding; loses edge status if BPDU received |
| Cisco implementation | PVST+ (per-VLAN STP) | Rapid PVST+ — one RSTP instance per VLAN |
RSTP Port Roles
| Role | State | Description |
|---|---|---|
| Root Port | Forwarding | The single best path toward the Root Bridge on each non-root switch. Determined by lowest path cost to Root. One Root Port per switch (none on the Root Bridge itself) |
| Designated Port | Forwarding | The best port on each network segment (link) toward the Root Bridge. Forwards BPDUs and data onto the segment. One Designated Port per segment |
| Alternate Port | Discarding | Provides a backup path to the Root Bridge — a better BPDU is received from another switch on the same segment. Instantly transitions to Root Port if the current Root Port fails (sub-second failover) |
| Backup Port | Discarding | Provides a backup to a Designated Port on the same shared segment — rare in modern full-duplex switched networks. Only seen when two ports on the same switch connect to a hub |
| Disabled | Discarding | Administratively shut down or not connected |
Link Types
| Link Type | How Determined | RSTP Behaviour |
|---|---|---|
| Point-to-point | Automatically detected on full-duplex links (the default for all modern switch ports). Can be manually forced with spanning-tree link-type point-to-point |
Eligible for rapid transition via proposal/agreement handshake. Achieves sub-second convergence |
| Shared | Automatically detected on half-duplex links (legacy hubs). Can be forced with spanning-tree link-type shared |
Falls back to 802.1D timer-based convergence — rapid transitions disabled on this link |
| Edge | Configured with spanning-tree portfast (Cisco CLI) or globally via spanning-tree portfast default |
Immediately transitions to Forwarding on link-up — no proposal/agreement needed. Loses edge status and sends Topology Change if a BPDU is received |
Proposal / Agreement Handshake
Root Bridge (SW1) Non-Root (SW2)
Gi0/1 — Designated Gi0/1 — electing Root Port
──────────────────────────────────────────────────────────────
1. SW1 sends BPDU with Proposal bit set
"I want to be Designated — agree?" ──────────────────►
2. SW2 receives Proposal
SW2 puts ALL non-edge
ports into Discarding
(sync step — prevents
temporary loops)
3. SW2 sends Agreement
◄────────────────── "Agreed — you are Designated"
4. SW1 Gi0/1 transitions immediately
to FORWARDING (no timer wait)
5. SW2 Gi0/1 transitions to FORWARDING
as Root Port
Total time: 1–2 Hello intervals (~2–4 seconds worst case;
often sub-second on direct links)
2. Lab Topology
┌───────────────────────────────────┐
│ NetsTuts-SW1 │
│ (Root Bridge — VLAN 10, 20) │
│ Priority: 4096 (VLAN 10) │
│ Priority: 8192 (VLAN 20) │
└──────────┬──────────┬─────────────┘
Gi0/1 │ │ Gi0/2
(trunk) │ │ (trunk)
│ │
┌──────────┘ └─────────────┐
│ NetsTuts-SW2 │ NetsTuts-SW3
│ Priority: 8192 (VLAN 10) │ Priority: 8192 (VLAN 10)
│ Priority: 4096 (VLAN 20) │ Priority: 12288 (VLAN 20)
└──────────────┬────────────────────┘
Gi0/3│ (trunk — cross-link)
│
Access ports (edge ports / PortFast):
SW2: Fa0/1–Fa0/10 → VLAN 10 (workstations)
SW3: Fa0/1–Fa0/10 → VLAN 20 (servers)
SW1: Gi0/3 → VLAN 10 (management host)
VLANs: 10 (Users), 20 (Servers)
STP mode: Rapid PVST+
3. Step 1 — Enable Rapid PVST+
Rapid PVST+ is the default on modern Cisco IOS switches (IOS 12.2+ and all Catalyst switches). Verify and explicitly configure it to ensure consistency across the environment:
! ════════════════════════════════════════════════════ ! Configure on ALL switches: SW1, SW2, SW3 ! ════════════════════════════════════════════════════ NetsTuts-SW1>en NetsTuts-SW1#conf t ! ── Set STP mode to Rapid PVST+ ───────────────────── spanning-tree mode rapid-pvst ! ! ── Verify the mode change ─────────────────────────── NetsTuts-SW1#show spanning-tree summary Switch is in rapid-pvst mode Root bridge for: VLAN0010, VLAN0020 PortFast BPDU Guard Default is disabled Portfast BPDU Filter Default is disabled Logging BPDU Guard Default is disabled UplinkFast is disabled BackboneFast is disabled Configured Pathcost method used is short Name Blocking Listening Learning Forwarding STP Active ---------------------- -------- --------- -------- ---------- ---------- VLAN0010 0 0 0 3 3 VLAN0020 0 0 0 3 3
The Switch is in rapid-pvst mode line confirms
the mode change. In Rapid PVST+, the Listening
and Blocking state columns should always show
zero for a stable topology — all ports should be either
Forwarding or in the RSTP Discarding state (which maps to
Blocking in the summary). If Listening shows non-zero values
after the topology has converged, a port is behaving like
classic 802.1D — typically caused by a shared-type link or
an incompatible switch running legacy 802.1D.
4. Step 2 — Configure Root Bridge and Bridge Priority
Never let the Root Bridge election happen by chance — the switch
with the lowest MAC address wins by default, which is often the
oldest switch. Explicitly set the Root Bridge with
spanning-tree vlan [id] priority [value] or use the
macro spanning-tree vlan [id] root primary:
! ════════════════════════════════════════════════════ ! SW1 — Primary Root for VLAN 10; Secondary for VLAN 20 ! ════════════════════════════════════════════════════ NetsTuts-SW1#conf t ! ── Method 1: explicit priority ────────────────────── spanning-tree vlan 10 priority 4096 spanning-tree vlan 20 priority 8192 ! ! ── Method 2: macro (sets priority to 24576 or lower) ─ ! spanning-tree vlan 10 root primary ! spanning-tree vlan 20 root secondary ! ! ════════════════════════════════════════════════════ ! SW2 — Secondary Root for VLAN 10; Primary for VLAN 20 ! (per-VLAN load balancing between uplinks) ! ════════════════════════════════════════════════════ NetsTuts-SW2#conf t spanning-tree vlan 10 priority 8192 spanning-tree vlan 20 priority 4096 ! ! ════════════════════════════════════════════════════ ! SW3 — Non-root for both VLANs ! ════════════════════════════════════════════════════ NetsTuts-SW3#conf t spanning-tree vlan 10 priority 8192 spanning-tree vlan 20 priority 12288 !
Bridge priority must be a multiple of 4096 —
IOS enforces this because the lower 12 bits of the Bridge ID
are reserved for the System ID Extension (the VLAN number).
Valid values are: 0, 4096, 8192, 12288, 16384, 20480, 24576,
28672, 32768 (default), 36864, 40960, 45056, 49152, 53248,
57344, 61440. The lowest Bridge Priority + Bridge MAC address
wins the Root Bridge election. Configuring SW1 with priority
4096 for VLAN 10 ensures it is always preferred over SW2
(priority 8192) and SW3. The per-VLAN priority assignments
implement load balancing: VLAN 10 traffic uses SW1 as Root
(flowing via SW1-SW2 uplink) while VLAN 20 traffic uses SW2
as Root (flowing via SW2-SW3 uplink), distributing traffic
across both trunks. After completing configuration save with
write memory.
Verify Root Bridge Election
NetsTuts-SW1#show spanning-tree vlan 10
VLAN0010
Spanning tree enabled protocol rstp
Root ID Priority 4106
Address 0023.04FA.1234
This bridge is the root
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
Bridge ID Priority 4106 (priority 4096 sys-id-ext 10)
Address 0023.04FA.1234
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
Aging Time 300 sec
Interface Role Sts Cost Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------------------
Gi0/1 Desg FWD 4 128.1 P2p
Gi0/2 Desg FWD 4 128.2 P2p
Gi0/3 Desg FWD 4 128.3 P2p Edge
The This bridge is the root line confirms SW1
has won the VLAN 10 Root Bridge election. The Bridge ID Priority
shows 4106 — this is the configured priority
(4096) plus the VLAN System ID Extension (10), giving
4096 + 10 = 4106. All three interfaces show Desg FWD
(Designated, Forwarding) — correct for the Root Bridge, which
has all ports as Designated. The Type: P2p
confirms full-duplex point-to-point links eligible for rapid
transitions. Gi0/3 shows Edge in addition to
P2p — this is the PortFast-configured access port to the
management host.
5. Step 3 — Configure Edge Ports (PortFast)
Access ports connected to end devices (PCs, servers, printers, IP phones) must be configured as edge ports. This allows them to transition immediately to Forwarding on link-up without waiting for the proposal/agreement process — a PC should never wait for STP before it can DHCP and boot:
Individual Port PortFast
! ════════════════════════════════════════════════════ ! SW2 — configure access ports as edge ports ! ════════════════════════════════════════════════════ NetsTuts-SW2#conf t ! ── Apply PortFast to individual access ports ───────── interface range FastEthernet0/1 - 10 switchport mode access switchport access vlan 10 spanning-tree portfast ! ! ── BPDU Guard: shutdown port if BPDU received ──────── spanning-tree bpduguard enable !
Global PortFast Default (All Access Ports)
! ── Enable PortFast on all access ports globally ───── ! ── (does not affect trunk ports) ──────────────────── spanning-tree portfast default ! ! ── Enable BPDU Guard globally for all PortFast ports ─ spanning-tree portfast bpduguard default !
spanning-tree portfast default enables PortFast
on all access-mode ports automatically — any interface configured
with switchport mode access becomes an edge port.
Trunk ports are not affected, which is the correct behaviour
since switch-to-switch links must never be edge ports.
spanning-tree portfast bpduguard default globally
enables BPDU Guard on every PortFast port. BPDU Guard is the
critical protection mechanism: if any BPDU arrives on an edge
port (indicating a switch has been plugged in instead of a PC),
the port is immediately placed into err-disabled
state, preventing a loop. Without BPDU Guard, a user plugging
in an unmanaged switch on an edge port could disrupt the entire
STP topology. For additional edge port protection see
DHCP Snooping
& Dynamic ARP Inspection and
PortFast and BPDU Guard.
SW3 Access Ports — VLAN 20 Servers
NetsTuts-SW3#conf t interface range FastEthernet0/1 - 10 switchport mode access switchport access vlan 20 spanning-tree portfast spanning-tree bpduguard enable !
6. Step 4 — Verify and Set Link Types on Trunk Ports
RSTP rapid transitions only work on point-to-point links. Point-to-point is automatically detected on full-duplex ports (all modern switch-to-switch links). Verify and explicitly configure if auto-detection produces incorrect results:
! ════════════════════════════════════════════════════ ! SW1 — trunk ports to SW2 and SW3 ! ════════════════════════════════════════════════════ NetsTuts-SW1#conf t interface GigabitEthernet0/1 description Trunk-to-SW2 switchport mode trunk switchport trunk allowed vlan 10,20 ! ── Explicitly set point-to-point for RSTP rapid transitions ─ spanning-tree link-type point-to-point no shutdown ! interface GigabitEthernet0/2 description Trunk-to-SW3 switchport mode trunk switchport trunk allowed vlan 10,20 spanning-tree link-type point-to-point no shutdown ! ! ════════════════════════════════════════════════════ ! SW2 — trunk to SW1 and SW3 ! ════════════════════════════════════════════════════ NetsTuts-SW2#conf t interface GigabitEthernet0/1 description Trunk-to-SW1 switchport mode trunk switchport trunk allowed vlan 10,20 spanning-tree link-type point-to-point no shutdown ! interface GigabitEthernet0/3 description Trunk-to-SW3-crosslink switchport mode trunk switchport trunk allowed vlan 10,20 spanning-tree link-type point-to-point no shutdown ! ! ════════════════════════════════════════════════════ ! SW3 — trunk to SW1 and SW2 ! ════════════════════════════════════════════════════ NetsTuts-SW3#conf t interface GigabitEthernet0/2 description Trunk-to-SW1 switchport mode trunk switchport trunk allowed vlan 10,20 spanning-tree link-type point-to-point no shutdown ! interface GigabitEthernet0/3 description Trunk-to-SW2-crosslink switchport mode trunk switchport trunk allowed vlan 10,20 spanning-tree link-type point-to-point no shutdown !
Explicitly configuring
spanning-tree link-type
point-to-point on trunk ports ensures RSTP rapid
transitions are always available, even if the duplex setting
is later changed or auto-negotiated incorrectly. A port
operating at half-duplex (detected as shared link type)
will silently fall back to 802.1D convergence — the network
continues to function but convergence after a failure takes
30–50 seconds instead of under 1 second. The link type can
be verified with show spanning-tree detail under
each interface's entry — look for "link type is point-to-point
by default" or "link type is point-to-point (configured)."
Configure STP Port Cost (Optional — Path Tuning)
! ── Set long path cost method (802.1t — values for Gbps links) ─ spanning-tree pathcost method long ! ! ── Path cost reference table (long method): ! ── 10 Mbps = 2,000,000 ! ── 100 Mbps = 200,000 ! ── 1 Gbps = 20,000 ! ── 10 Gbps = 2,000 ! ! ── Override specific port cost to influence Root Port selection ─ interface GigabitEthernet0/1 spanning-tree vlan 10 cost 10 !
7. Step 5 — Protective STP Features
BPDU Guard — Protect Edge Ports
! ── Per-port BPDU Guard (overrides global setting) ─── interface FastEthernet0/1 spanning-tree bpduguard enable ! ! ── Verify BPDU Guard err-disabled recovery ────────── NetsTuts-SW2#show spanning-tree summary ... Name Blocking Listening Learning Forwarding STP Active VLAN0010 1 0 0 9 10 ! ── 1 port in Blocking/err-disabled ───────────────── NetsTuts-SW2#show interfaces FastEthernet0/1 status Port Name Status Vlan Duplex Speed Type Fa0/1 err-disabled 10 full 100 10/100BaseTX ! ── To recover manually: ───────────────────────────── NetsTuts-SW2#conf t interface FastEthernet0/1 shutdown no shutdown ! ! ── Or configure automatic err-disable recovery ────── errdisable recovery cause bpduguard errdisable recovery interval 300 !
When BPDU Guard triggers, the port moves to err-disabled
— administratively down and requiring manual intervention to
recover (or automatic via
errdisable recovery).
The err-disabled state is intentional: it forces human review
before the port is re-enabled. Log messages appear on the
console: %SPANTREE-2-BLOCK_BPDUGUARD: Received BPDU on port
FastEthernet0/1 with BPDU Guard enabled. Disabling port.
The errdisable recovery cause bpduguard command
enables automatic recovery after the configured interval (300
seconds by default) — useful in lab environments but should be
evaluated carefully in production where an automatically
re-enabled port may loop again.
Root Guard — Prevent Unauthorised Root Bridge
! ── Root Guard: applied on Designated ports facing ! ── downstream switches that should NEVER become Root ── ! ── Applied on SW1 ports facing SW2 and SW3 ─────────── NetsTuts-SW1#conf t interface GigabitEthernet0/1 ! ── Prevent SW2 from becoming Root Bridge ──────────── spanning-tree guard root ! interface GigabitEthernet0/2 spanning-tree guard root !
Root Guard is applied on ports where the switch is the
Designated switch and should always remain so. If a superior
BPDU is received on a Root Guard port (indicating a switch
with a better Bridge Priority has appeared — perhaps an
attacker or a misconfigured switch), the port moves to
root-inconsistent state and stops forwarding.
Unlike err-disabled, root-inconsistent is self-healing — when
the superior BPDUs stop arriving, the port automatically
transitions back to Forwarding. The key placement rule:
Root Guard on ports leading toward access layer switches;
BPDU Guard on edge ports connecting to end devices.
Never configure both on the same port.
BPDU Filter — Suppress BPDUs on Edge Ports
! ── BPDU Filter: stop sending BPDUs on edge ports ──── ! ── WARNING: use with extreme caution — disabling BPDUs ! ── on a port that connects to a switch creates a loop ─ spanning-tree portfast bpdufilter default ! ── Effect: stops BPDU transmission on PortFast ports ! ── BUT still processes received BPDUs and disables ! ── PortFast if a BPDU is received (global mode) ! ! ── Per-port BPDU Filter (DANGEROUS — disables ALL BPDUs) ─ ! interface FastEthernet0/1 ! spanning-tree bpdufilter enable ! ── Per-port mode ignores received BPDUs entirely — loop risk!
BPDU Filter has two behaviours depending on whether it is
configured globally or per-port. The global
form (via
spanning-tree portfast bpdufilter default)
stops sending BPDUs on PortFast ports but still processes
received BPDUs — if a BPDU arrives, PortFast is disabled and
normal STP runs. The per-port form
(spanning-tree bpdufilter enable on an interface)
both stops sending AND stops processing received BPDUs — the
port effectively becomes invisible to STP. This is dangerous:
a loop can form silently because STP never detects it. Use
per-port BPDU Filter only on provider-facing ports where BPDU
leakage must be prevented by SLA requirement, never on
internal access ports.
8. Step 6 — Verification
show spanning-tree detail — The Primary RSTP Diagnostic
NetsTuts-SW1#show spanning-tree vlan 10 detail
VLAN0010 is executing the rstp compatible Spanning Tree protocol
Bridge Identifier has priority 4096, sysid 10, address 0023.04FA.1234
Configured hello time 2, max age 20, forward delay 15, transmit hold-count 6
We are the root of the spanning tree
Topology change flag not set, detected flag not set
Number of topology changes 3, last change occurred 00:04:21 ago
from GigabitEthernet0/1
Times: hold 1, topology change 35, notification 2
hello 2, max age 20, forward delay 15
Timers: hello 0, topology change 0, notification 0, aging 300
Port 1 (GigabitEthernet0/1) of VLAN0010 is designated forwarding
Port path cost 4, Port priority 128, Port Identifier 128.1.
Designated root has priority 4106, address 0023.04FA.1234
Designated bridge has priority 4106, address 0023.04FA.1234
Designated port id is 128.1, designated path cost 0
Timers: message age 0, forward delay 0, hold 0
Number of transitions to forwarding state: 2
Link type is point-to-point by default
BPDU: sent 1284, rcvd 1268
*** Rapid Transition to forwarding ***
Port 2 (GigabitEthernet0/2) of VLAN0010 is designated forwarding
Port path cost 4, Port priority 128, Port Identifier 128.2.
Designated root has priority 4106, address 0023.04FA.1234
Designated bridge has priority 4106, address 0023.04FA.1234
Designated port id is 128.2, designated path cost 0
Timers: message age 0, forward delay 0, hold 0
Number of transitions to forwarding state: 1
Link type is point-to-point by default
BPDU: sent 1198, rcvd 1142
*** Rapid Transition to forwarding ***
Port 3 (GigabitEthernet0/3) of VLAN0010 is designated forwarding
Port path cost 4, Port priority 128, Port Identifier 128.3.
Designated root has priority 4106, address 0023.04FA.1234
Designated bridge has priority 4106, address 0023.04FA.1234
Designated port id is 128.3, designated path cost 0
Timers: message age 0, forward delay 0, hold 0
Number of transitions to forwarding state: 1
Link type is point-to-point by default
BPDU: sent 987, rcvd 0
The port is in the portfast condition
*** Rapid Transition to forwarding ***
The phrase "Rapid Transition to forwarding"
at the bottom of each port entry is the definitive confirmation
that RSTP rapid convergence is functioning. If this line is absent
and replaced with forward delay timer counts, the port is
converging using 802.1D timer-based mechanisms — typically
because the link type is shared (half-duplex) or the remote
switch is running legacy 802.1D. Key fields to check: Link
type is point-to-point — mandatory for rapid transition;
Number of transitions to forwarding state — low
numbers confirm the topology is stable (excessive transitions
indicate a flapping link or topology instability); BPDU:
sent [N], rcvd [N] — both counters incrementing confirms
active bidirectional BPDU exchange; Gi0/3 showing rcvd 0
BPDUs and portfast condition confirms
the edge port is not receiving BPDUs from any switch.
show spanning-tree vlan — Port Role and State Summary
NetsTuts-SW2#show spanning-tree vlan 10
VLAN0010
Spanning tree enabled protocol rstp
Root ID Priority 4106
Address 0023.04FA.1234
Cost 4
Port 1 (GigabitEthernet0/1)
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
Bridge ID Priority 8202 (priority 8192 sys-id-ext 10)
Address 0030.A3BB.5678
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
Aging Time 300 sec
Interface Role Sts Cost Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------------------
Gi0/1 Root FWD 4 128.1 P2p
Gi0/3 Desg FWD 4 128.3 P2p
Fa0/1 Desg FWD 100 128.4 P2p Edge
Fa0/2 Desg FWD 100 128.5 P2p Edge
Fa0/3 Desg FWD 100 128.6 P2p Edge
SW2's VLAN 10 topology: Gi0/1 is the Root Port
(role: Root) forwarding toward SW1. Gi0/3 is a Designated
Port forwarding on the cross-link to SW3. The access
ports (Fa0/1–Fa0/3) show P2p Edge — confirming
both point-to-point link type and edge (PortFast) status. For
VLAN 20, run the same command — SW2 should appear as Root Bridge
with all ports as Designated, and SW3's uplink to SW2 should be
its Root Port (because SW2 has priority 4096 for VLAN 20).
show spanning-tree vlan — SW3 Alternate Port (Backup Path)
NetsTuts-SW3#show spanning-tree vlan 10
VLAN0010
Spanning tree enabled protocol rstp
Root ID Priority 4106
Address 0023.04FA.1234
Cost 4
Port 2 (GigabitEthernet0/2)
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
Bridge ID Priority 8202 (priority 8192 sys-id-ext 10)
Address 0041.2C11.9ABC
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
Aging Time 300 sec
Interface Role Sts Cost Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------------------
Gi0/2 Root FWD 4 128.2 P2p
Gi0/3 Altn BLK 4 128.3 P2p
Fa0/1 Desg FWD 100 128.4 P2p Edge
SW3's Gi0/3 (the cross-link to SW2) shows role Altn BLK
— Alternate Port in Blocking/Discarding state. This is the RSTP
Alternate Port providing an instant failover path. If SW3's Root
Port (Gi0/2 to SW1) fails, Gi0/3 transitions from Alternate to
Root Port immediately without any proposal/agreement
handshake — the Alternate Port already knows it has a
valid path to the Root Bridge (it was receiving superior BPDUs on
Gi0/3 from SW2). This sub-second failover is the key advantage
over 802.1D where the backup port would wait through Max Age (20 s)
+ Listening (15 s) + Learning (15 s) = 50 seconds before forwarding.
Simulate Failover — Observe Rapid Transition
! ── Simulate SW1-SW3 link failure (on SW1) ─────────── NetsTuts-SW1#conf t interface GigabitEthernet0/2 shutdown ! ! ── Immediately check SW3 topology ─────────────────── NetsTuts-SW3#show spanning-tree vlan 10 Interface Role Sts Cost Prio.Nbr Type ------------------- ---- --- --------- -------- -------------------------------- Gi0/2 Desg BLK 4 128.2 P2p Gi0/3 Root FWD 4 128.3 P2p Fa0/1 Desg FWD 100 128.4 P2p Edge ! ── Gi0/3 is now Root Port — instant failover! ─────── ! ── Gi0/2 is Designated (link-down side shows BLK) ─── ! ── Restore the link ───────────────────────────────── NetsTuts-SW1#conf t interface GigabitEthernet0/2 no shutdown !
The failover output demonstrates RSTP's rapid recovery. When
SW1's Gi0/2 is shut down, SW3 detects the topology change
within 3 × Hello Time (6 seconds) — actually faster in practice
as the physical link-down event is immediate. SW3's Alternate
Port (Gi0/3) transitions to Root Port essentially instantaneously,
without any proposal/agreement needed, because it was already
receiving valid BPDUs from SW2 with a path to the Root Bridge.
Compare this to classic 802.1D: the backup port would remain
blocked for 50 seconds after the failure, causing all VLAN 10
traffic through SW3 to be interrupted for nearly a minute.
Verification Command Summary
| Command | What It Shows | Key Fields to Check |
|---|---|---|
show spanning-tree summary |
STP mode, Root Bridge status, per-VLAN port state counts | "Switch is in rapid-pvst mode"; Listening and Blocking columns = 0 in stable topology |
show spanning-tree vlan [id] |
Root Bridge identity, Bridge ID, per-port role/state/cost/type for the VLAN | Root Port (Root FWD), Designated (Desg FWD), Alternate (Altn BLK); Type P2p or P2p Edge |
show spanning-tree vlan [id] detail |
Full per-port detail including link type, BPDU counters, transition count, and rapid transition confirmation | "Rapid Transition to forwarding" — must be present on all point-to-point ports; link type is point-to-point |
show spanning-tree interface [intf] detail |
Single interface STP detail across all VLANs — role, state, cost, link type, transition history | Useful for isolating a specific port's STP behaviour; checks edge status and transition count |
show spanning-tree summary totals |
Aggregate port state counts across all VLANs | Large Listening count indicates STP reconverging; large Blocking count is normal (redundant links) |
show mac address-table |
MAC address table — useful during TC events to see if entries are flushing | Low MAC count after topology change confirms MAC flush occurred as expected |
show spanning-tree inconsistentports |
Ports in root-inconsistent or loop-inconsistent state — STP protection features have triggered | Any port listed here requires investigation — either a superior BPDU was received (Root Guard) or a BPDU was received on an edge port (BPDU Guard triggered err-disabled, shown separately) |
show errdisable recovery |
Causes of err-disabled ports and recovery timers configured | Confirms bpduguard recovery is enabled/disabled and the current interval setting |
9. Troubleshooting Rapid PVST+
| Problem | Symptom | Cause | Fix |
|---|---|---|---|
| Convergence still takes 30+ seconds | show spanning-tree vlan [id] detail does not show "Rapid Transition to forwarding"; convergence after link failure takes 30–50 seconds |
Link type is shared (half-duplex) — RSTP falls back to 802.1D convergence on shared links; or one switch in the path is running legacy 802.1D (different spanning-tree mode) | Check show spanning-tree vlan [id] detail for "link type is shared" on the affected port. Fix with spanning-tree link-type point-to-point on both ends. Verify duplex with show interfaces [intf] | include Duplex — half-duplex triggers shared link type. Check remote switch with show spanning-tree summary — mode must be rapid-pvst on all switches |
| Port flapping in and out of Forwarding | show spanning-tree vlan [id] detail shows high "Number of transitions to forwarding state"; syslog shows repeated STP topology change messages |
Physical link instability (cable, SFP, or NIC issue); unidirectional link (STP receives but cannot send BPDUs in one direction); or a loop creating a BPDU storm | Check physical layer: show interfaces [intf] for input/output errors and CRC errors. Verify both ends of the link are up. Check show spanning-tree vlan [id] detail | include BPDU — if sent is high but rcvd is 0 on both ends, unidirectional link failure. Enable Loop Guard with spanning-tree guard loop on uplink ports to detect unidirectional failures. See Troubleshooting Layer 2 VLANs & Trunks |
| BPDU Guard not triggering on edge port with switch connected | An unmanaged switch is connected to a PortFast port; BPDU Guard expected to err-disable but port remains up | BPDU Guard not enabled on the specific port — global spanning-tree portfast bpduguard default only applies to ports in PortFast mode; if PortFast was configured per-port but BPDU Guard was configured globally without also enabling PortFast globally, the port may not have BPDU Guard active |
Verify: show spanning-tree interface [intf] portfast — shows whether BPDU Guard is active on that port. Apply BPDU Guard per-port with spanning-tree bpduguard enable directly on the interface for certainty |
| Unintended Root Bridge elected | show spanning-tree vlan [id] shows an unexpected switch as Root Bridge — often the switch with the oldest (lowest) MAC address |
Bridge priority not configured — all switches default to 32768 and the switch with the lowest MAC address wins. A new switch added with default priority can become Root Bridge if its MAC is lower | Configure explicit priorities on all switches: spanning-tree vlan [id] priority [value]. Set Root Guard on distribution/core switch ports facing access layer to prevent any new switch from claiming Root. Apply spanning-tree vlan [id] root primary on the intended Root Bridge for immediate correction |
| Root Guard triggers root-inconsistent on wrong port | A legitimate upstream switch port enters root-inconsistent state; traffic stops forwarding on that port; show spanning-tree inconsistentports lists the port |
Root Guard applied on the wrong port — Root Guard should only be on ports facing switches that should never become Root. If applied on an uplink toward the actual Root Bridge, the superior BPDUs from the Root Bridge trigger Root Guard, blocking the uplink | Remove Root Guard from the affected port: no spanning-tree guard root on the interface. Root Guard belongs on distribution-to-access downlinks, not on core-to-distribution uplinks. The port auto-recovers once Root Guard is removed and BPDUs stop triggering the inconsistent state |
| Topology changes flooding MAC table excessively | show mac address-table count shows low MAC counts despite active hosts; periodic traffic flooding observed on all ports; syslog shows repeated "%SPANTREE-5-TOPOTRAP" messages |
Frequent STP topology changes are flushing the MAC address table. In RSTP, each topology change flushes MACs on all non-edge ports. A flapping access port (physical layer issue) triggers repeated TCs, causing continuous MAC table flushing and broadcast flooding | Identify the source of topology changes: show spanning-tree detail | include topology shows the last port that triggered a TC. Fix the physical layer issue on that port. Ensure access ports are configured with PortFast — edge ports do not generate topology changes when they transition, which eliminates TC flooding from host port flaps |
| STP mode mismatch — one switch running 802.1D | Some ports on switches running Rapid PVST+ show "link type is shared" or do not show "Rapid Transition to forwarding" despite full-duplex links; convergence on affected paths is slow | An 802.1D switch in the topology causes RSTP switches to fall back to 802.1D behaviour on the affected ports. RSTP is backward compatible — when a switch receives a legacy 802.1D BPDU, it migrates that port to 802.1D operation. The migration is sticky until a protocol migration check is performed | Upgrade the legacy 802.1D switch to Rapid PVST+. If it cannot be upgraded, isolate it. On RSTP switches connected to it, run clear spanning-tree detected-protocols interface [intf] to force the port to re-probe for RSTP capability after the legacy switch is replaced |
Key Points & Exam Tips
- RSTP (802.1w) replaces 802.1D's timer-based convergence with a proposal/agreement handshake that transitions ports to Forwarding in one to two Hello intervals — typically under one second on point-to-point links.
- RSTP has 3 port states: Discarding (covers Disabled/Blocking/Listening), Learning, Forwarding. Classic 802.1D has 5. The Listening state is eliminated in RSTP — ports go directly from Discarding to Learning during rapid transition.
- RSTP has 4 port roles: Root Port (best path to Root), Designated Port (best port on a segment), Alternate Port (backup Root Port — instant failover), Backup Port (backup on same segment — rare). The Alternate Port is the key to RSTP's fast failover: it already knows a valid path to Root and transitions without any handshake.
- Rapid transitions only work on point-to-point links (full-duplex). Shared links (half-duplex) fall back to 802.1D convergence. Modern switch-to-switch links are always full-duplex — verify with
show interfaces | include Duplex. - Edge ports (PortFast) transition immediately to Forwarding on link-up — no handshake required. An edge port that receives a BPDU immediately loses its edge status and participates in normal RSTP.
- BPDU Guard protects edge ports by err-disabling any port that receives a BPDU. Always enable BPDU Guard on access ports — it prevents users from connecting unauthorised switches.
- Root Guard prevents downstream switches from becoming Root Bridge. Apply on designated ports facing the access layer. Root-inconsistent state is self-healing (unlike err-disabled from BPDU Guard).
- Bridge priority must be a multiple of 4096. Default is 32768. Always configure explicit priorities — never let the Root Bridge be elected by lowest MAC address.
- Cisco's implementation is Rapid PVST+ — a separate RSTP instance per VLAN. Use per-VLAN priority configuration to achieve load balancing across trunk links.
- The key verification command is
show spanning-tree vlan [id] detail— look for "Rapid Transition to forwarding" on all point-to-point ports. Its absence means timer-based convergence is occurring on that port.
Next Steps: With Rapid PVST+ converging quickly,
the next step is optimising which switch is Root for each VLAN
to achieve per-VLAN load balancing across redundant trunk links.
See Spanning Tree Root
Bridge Configuration. For the trunk ports that carry multiple
VLAN spanning tree instances see
Trunk Port Configuration.
For protecting edge ports with PortFast and BPDU Guard see
PortFast and BPDU Guard
and DHCP
Snooping & Dynamic ARP Inspection.
For redundant uplinks using EtherChannel see
EtherChannel LACP.
For Layer 2 troubleshooting see
Troubleshooting
Layer 2 VLANs & Trunks.