Spanning Tree Protocol (STP)

Step 1 — Why STP Exists

# Without STP, redundant switch links cause broadcast storms
SW1 ─── SW2
 │         │
 └─── SW3 ─┘

PC sends a broadcast:
→ SW1 floods to SW2 and SW3
→ SW2 floods it back to SW3
→ SW3 floods back to SW1 and SW2
→ LOOP: infinite broadcast storm → network crash!

# STP fixes this by:
# 1. Electing a ROOT BRIDGE (central switch)
# 2. Finding the BEST PATH to root from every switch
# 3. BLOCKING redundant paths (ports in blocking state)

# STP versions:
802.1D  → Original STP (30-50 second convergence — very slow)
802.1w  → RSTP - Rapid STP (1-2 second convergence — modern standard)
802.1s  → MSTP - Multiple STP (different trees per VLAN group)
PVST+   → Cisco's STP per VLAN (runs separate STP instance per VLAN)

Step 2 — Root Bridge Election

# Root Bridge = switch with LOWEST Bridge ID (BID)
# BID = Priority (4 bits) + VLAN ID (12 bits) + MAC Address (48 bits)

# Default priority: 32768 (+ VLAN ID)
SW1: Priority 32769 (32768 + VLAN1), MAC: AA:AA:AA:AA:AA:01
SW2: Priority 32769 (32768 + VLAN1), MAC: BB:BB:BB:BB:BB:02
SW3: Priority 32769 (32768 + VLAN1), MAC: CC:CC:CC:CC:CC:03

# All same priority → lowest MAC wins root bridge
# SW1 wins (AA < BB < CC)

# Switches send BPDUs (Bridge Protocol Data Units) every 2 seconds
# to exchange BID information and agree on root bridge

# Show which switch is root bridge:
show spanning-tree vlan 1
Root ID    Priority    32769
           Address     aabb.cc01.0000
           This bridge is the root    ← You are root!

Bridge ID  Priority    32769
           Address     aabb.cc01.0000

Step 3 — Port Roles

# Every switch port has a ROLE in STP:

Root Port (RP):
  → One per non-root switch
  → The port with the BEST (lowest cost) path to the root bridge
  → FORWARDING state

Designated Port (DP):
  → Best port on each network segment for traffic to/from root
  → Root bridge: ALL ports are designated
  → FORWARDING state

Non-Designated Port (NDP) / Alternate Port:
  → Redundant paths — BLOCKED to prevent loops
  → BLOCKING state (still receives BPDUs, just doesn't forward data)

# Port cost (bandwidth → cost):
10 Mbps   → 100
100 Mbps  → 19
1 Gbps    → 4
10 Gbps   → 2

# Root path cost = sum of port costs from root to this switch

Step 4 — Port States (802.1D STP)

# STP port state machine (this is why convergence is slow):

Blocking   (15 sec) → Listening (15 sec) → Learning (15 sec) → Forwarding
                                                                    │
                                                     Total: ~30-50 seconds

# State descriptions:
Blocking   → receives BPDUs only, no data forwarding
Listening  → processes BPDUs, no data, no MAC learning
Learning   → processes BPDUs, no data, LEARNS MAC addresses
Forwarding → normal operation — forwards data AND learns MACs
Disabled   → administratively shut down

# Timers:
Hello Time    = 2 sec  (how often BPDUs are sent)
Max Age       = 20 sec (how long to wait before reconverging)
Forward Delay = 15 sec (time in Listening and Learning states each)

Step 5 — Configure Root Bridge

# Method 1: Set priority manually (multiples of 4096)
spanning-tree vlan 1 priority 4096    # lower than default 32768 → becomes root
spanning-tree vlan 1 priority 0       # absolute lowest priority

# Method 2: Use the macro (sets to 24576 or adjusts automatically)
spanning-tree vlan 1 root primary     # make this the root
spanning-tree vlan 1 root secondary   # make this the backup root

# Verify
show spanning-tree vlan 1
Root ID    Priority    4097
           Address     aabb.cc00.0100
           This bridge is the root

# Change port cost (influence root port selection)
interface GigabitEthernet0/1
 spanning-tree vlan 1 cost 10   # lower cost = preferred path

# Change port priority (0-240, default 128, lower = preferred)
interface GigabitEthernet0/1
 spanning-tree vlan 1 port-priority 64

Step 6 — RSTP (802.1w)

# RSTP = Rapid STP — same algorithm but MUCH faster (1-2 seconds)

# Enable RSTP (modern Cisco switches run PVST+ by default)
spanning-tree mode rapid-pvst    # recommended for modern networks

# RSTP improvements over STP:
Only 3 port states (not 5): Discarding, Learning, Forwarding
New port roles: Alternate (backup to root port), Backup
Edge ports (formerly PortFast) transition immediately to Forwarding
Faster convergence via Proposal/Agreement handshake

# PortFast: skip Listening/Learning on access ports (hosts, printers)
interface GigabitEthernet0/1
 spanning-tree portfast          # immediate forwarding for access ports

# BPDU Guard: if a PortFast port receives a BPDU → shut it down
# Protects against someone plugging in an unauthorized switch
interface GigabitEthernet0/1
 spanning-tree bpduguard enable

Step 7 — STP Security Features

# Enable PortFast + BPDU Guard globally on all access ports
spanning-tree portfast default           # PortFast on all access ports
spanning-tree portfast bpduguard default # BPDU Guard on all portfast ports

# Root Guard: prevent downstream switches from becoming root bridge
interface GigabitEthernet0/2
 spanning-tree guard root        # if superior BPDU received → port blocked

# BPDU Filter: suppress BPDUs on a port (use carefully)
interface GigabitEthernet0/1
 spanning-tree bpdufilter enable

# Verification commands:
show spanning-tree                    # all VLANs STP info
show spanning-tree vlan 1             # VLAN 1 only
show spanning-tree interface Gi0/1    # per-interface detail
show spanning-tree summary            # counts per VLAN

# Debug (use in lab only — noisy!)
debug spanning-tree events