Introduction Spanning Tree Protocol (STP) is a Layer 2 protocol that runs on bridges and switches. The specification for STP is IEEE 802.1D. The main purpose of STP is to ensure that you do not create loops when you have redundant paths in your network. Loops are deadly to a network. Network Diagram This document uses this network setup: Concepts STP runs on bridges and switches that support 802.1D. You implement STP on bridges and switches in order to prevent loops in the network. Use STP in situations where you want redundant links, but not loops. Redundant links are as important as backups in the case of a failover in a network. A failure of your primary activates the backup links so that users can continue to use the network. Without STP on the bridges and switches, such a failure can result in a loop. Consider this network: In this network, a redundant link is planned between Switch A and Switch B. However, this setup creates the possibility of a bridging loop. For example, a broadcast or multicast packet that transmits from Station M and is destined for Station N simply continues to circulate between both switches. 1
However, when STP runs on both switches, the network logically looks like this: The Network Diagram defines these VLANs: 1,200,201,202,203,204. In order to provide this desired path redundancy, as well as to avoid a loop condition, STP defines a tree that spans all the switches in an extended network. STP forces certain redundant data paths into a standby (blocked) state and leaves other paths in a forwarding state. If a link in the forwarding state becomes unavailable, STP reconfigures the network and reroutes data paths through the activation of the appropriate standby path. Description of the Technology With STP, the key is for all the switches in the network to elect a root bridge that becomes the reference point in the network. All other decisions in the network, such as which port to block and which port to put in forwarding mode, are made from the perspective of this root bridge. A switched environment, which is different from a bridge environment, most likely deals with multiple VLANs. When you implement a root bridge in a switching network, you usually refer to the root bridge as the root switch. Each VLAN must have its own root bridge because each VLAN is a separate broadcast domain. The roots for the different VLANs can all reside in a single switch or in various switches. Note: The selection of the root switch for a particular VLAN is very important. You can choose the root switch, or you can let the switches decide, which is risky. If you do not control the root selection process, there can be suboptimal paths in your network. All the switches exchange information for use in the root switch selection and for subsequent configuration of the network. Bridge protocol data units (BPDUs) carry this information. Each switch compares the parameters in the BPDU that the switch sends to a neighbor with the parameters in the BPDU that the switch receives from the neighbor. In the STP root selection process, less is better. If Switch A advertises a root ID that is a lower number than the root ID that Switch B advertises, the information from Switch A is better. Switch B stops the advertisement of its root ID, and accepts the root ID of Switch A. STP Operation 2
Prerequisites Before you configure STP, select a switch to be the root of the spanning tree. This switch needs to be the most powerful switch and the most centralized switch on the network. All data flow across the network is from the perspective of this switch. Also, choose the least disturbed switch in the network. The backbone switches often serve as the spanning tree root because these switches typically do not connect to end stations. Also, moves and changes within the network are less likely to affect these switches. The only variable that you must set is the bridge priority. If the switch has a bridge priority that is lower than all the other switches, the other switches automatically select the switch as the root switch. Bridge protocol data units (BPDU) The messages the devices send to one another. Each bridge or switch determines which of its own ports offers the best path to the root bridge The BPDU messages are sent between the root bridge and the best ports on the other devices. If BPDUs are not received for a certain period of time The non-root-bridge devices will assume that the root bridge has failed, and a new root bridge will be elected.once the root bridge is determined and the switches and bridges have calculated their paths to the root bridge. The logical loop is removed by one of the switches or bridges Port states. STP will cause the ports on a switch or bridge to settle into a stable state STP Port State Overview Propagation delays can occur when protocol information passes through a switched LAN. As a result, topology changes can take place at different times and at different places in a switched network. When a Layer 2 LAN port transitions directly from nonparticipation in the spanning tree topology to the forwarding state, it can create temporary data loops. Ports must wait for new topology information to propagate through the switched LAN before starting to forward frames. They must allow the frame lifetime to expire for frames that have been forwarded using the old topology. Each Layer 2 LAN port using STP exists in one of the following five states: Blocking: The Layer 2 LAN port does not participate in frame forwarding. Listening: First transitional state after the blocking state when STP determines that the Layer 2 LAN port should participate in frame forwarding. Learning: The Layer 2 LAN port prepares to participate in frame forwarding. Forwarding: The Layer 2 LAN port forwards frames. Disabled: The Layer 2 LAN port does not participate in STP and is not forwarding frames. A Layer 2 LAN port moves through these five states as follows: From initialization to blocking From blocking to listening or to disabled 3
From listening to learning or to disabled From learning to forwarding or to disabled From forwarding to disabled When you enable STP, every port, VLAN, and network goes through the blocking state and the transitory states of listening and learning at power up. If properly configured, each Layer 2 LAN port stabilizes to the forwarding or blocking state. When the STP algorithm places a Layer 2 LAN port in the forwarding state, the following process occurs: 1. The Layer 2 LAN port is put into the listening state while it waits for protocol information that suggests it should go to the blocking state. 2. The Layer 2 LAN port waits for the forward delay timer to expire, moves the Layer 2 LAN port to the learning state, and resets the forward delay timer. 3. In the learning state, the Layer 2 LAN port continues to block frame forwarding as it learns end station location information for the forwarding database. 4. The Layer 2 LAN port waits for the forward delay timer to expire and then moves the Layer 2 LAN port to the forwarding state, where both learning and frame forwarding are enabled. Blocking State A Layer 2 LAN port in the blocking state does not participate in frame forwarding. After initialization, a BPDU is sent out to each Layer 2 LAN port. A network device initially assumes it is the root until it exchanges BPDUs with other network devices. This exchange establishes which network device in the network is the root or root bridge. If only one network device is in the network, no exchange occurs, the forward delay timer expires, and the ports move to the listening state. A port always enters the blocking state following initialization. A Layer 2 LAN port in the blocking state performs as follows: Discards frames received from the attached segment. Discards frames switched from another port for forwarding. Does not incorporate end station location into its address database. (There is no learning on a blocking Layer 2 LAN port, so there is no address database update.) Receives BPDUs and directs them to the system module. Does not transmit BPDUs received from the system module. Receives and responds to network management messages. 4
Listening State The listening state is the first transitional state a Layer 2 LAN port enters after the blocking state. The Layer 2 LAN port enters this state when STP determines that the Layer 2 LAN port should participate in frame forwarding A Layer 2 LAN port in the listening state performs as follows: Discards frames received from the attached segment. Discards frames switched from another LAN port for forwarding. Does not incorporate end station location into its address database. (There is no learning at this point, so there is no address database update.) Receives BPDUs and directs them to the system module. Receives, processes, and transmits BPDUs received from the system module. Receives and responds to network management messages. Learning State A Layer 2 LAN port in the learning state prepares to participate in frame forwarding. The Layer 2 LAN port enters the learning state from the listening state. 5
Layer 2 LAN port in the learning state performs as follows: Discards frames received from the attached segment. Discards frames switched from another port for forwarding. Incorporates end station location into its address database. Receives BPDUs and directs them to the system module. Receives, processes, and transmits BPDUs received from the system module. Receives and responds to network management messages. Forwarding State A Layer 2 LAN port in the forwarding state forwards frames. Layer 2 LAN port enters the forwarding state from the learning state. A Layer 2 LAN port in the forwarding state performs as follows: Forwards frames received from the attached segment. Forwards frames switched from another port for forwarding. Incorporates end station location information into its address database. Receives BPDUs and directs them to the system module. Processes BPDUs received from the system module. Receives and responds to network management messages. Disabled State Layer 2 LAN port in the disabled state does not participate in frame forwarding or STP, Layer 2 LAN port in the disabled state is virtually nonoperational. A disabled Layer 2 LAN port performs as follows: Discards frames received from the attached segment. Discards frames switched from another port for forwarding. Does not incorporate end station location into its address database. Does not receive BPDUs. Does not receive BPDUs for transmission from the system module. 6
Creating the Spanning Tree Topology Switch A is elected as the root bridge because the bridge priority of all the network devices is set to the default (32768) and Switch A has the lowest MAC address. However, due to traffic patterns, number of forwarding ports, or link types, Switch A might not be the ideal root bridge. By increasing the priority (lowering the numerical value) of the ideal network device so that it becomes the root bridge, you force an STP recalculation to form a new spanning tree topology with the ideal network device as the root. When the spanning tree topology is calculated based on default parameters, the path between source and destination end stations in a switched network might not be ideal. For instance, connecting higher-speed links to a port that has a higher number than the current root port can cause a root-port change. The goal is to make the fastest link the root port. Assume that one port on Switch B is a fiber-optic link, and another port on Switch B (an unshielded twisted-pair [UTP] link) is the root port. Network traffic might be more efficient over the high-speed fiber-optic link. By changing the STP port priority on the fiber-optic port to a higher priority (lower numerical value) than the root port, the fiber-optic port becomes the new root port. 7
Rules of Operation When the switches first come up, they start the root switch selection process. Each switch transmits a BPDU to the directly connected switch on a per-vlan basis. As the BPDU goes out through the network, each switch compares the BPDU that the switch sends to the BPDU that the switch receives from the neighbors. The switches then agree on which switch the root switch is. The switch with the lowest bridge ID in the network wins this election process. Note: Remember that one root switch is identified per-vlan. After the root switch identification, the switches adhere to these rules: STP Rule 1: All ports of the root switch must be in forwarding mode. Note: In some corner cases, which involve self-looped ports, there is an exception to this rule. Next, each switch determines the best path to get to the root. The switches determine this path by a comparison of the information in all the BPDUs that the switches receive on all ports. The switch uses the port with the least amount of information in the BPDU in order to get to the root switch; the port with the least amount of information in the BPDU is the root port. After a switch determines the root port, the switch proceeds to rule 2. STP Rule 2: The root port must be set to forwarding mode. In addition, the switches on each LAN segment communicate with each other to determine which switch is best to use in order to move data from that segment to the root bridge. This switch is called the designated switch. STP Rule 3: In a single LAN segment, the port of the designated switch that connects to that LAN segment must be placed in forwarding mode. STP Rule 4: All the other ports in all the switches (VLAN-specific) must be placed in blocking mode. The rule only applies to ports that connect to other bridges or switches. STP does not affect ports that connect to workstations or PCs. These ports remain forwarded. Note: By default, spanning tree runs on every port. The spanning tree feature cannot be turned off in switches on a per-port basis. Although it is not recommended, you can turn off STP on a per-vlan basis, or globally on the switch. Extreme care should be taken whenever you disable spanning tree because this creates Layer 2 loops within the network. STP and IEEE 802.1Q Trunks 802.1Q trunks impose some limitations on the STP strategy for a network. In a network of Cisco network devices connected through 802.1Q trunks, the network devices maintain one instance of STP for each VLAN allowed on the trunks. However, non-cisco 802.1Q network devices maintain only one instance of STP for all VLANs allowed on the trunks. 8
When you connect a Cisco network device to a non-cisco device through an 802.1Q trunk, the Cisco network device combines the STP instance of the 802.1Q VLAN of the trunk with the STP instance of the non-cisco 802.1Q network device. However, all per-vlan STP information is maintained by Cisco network devices separated by a cloud of non-cisco 802.1Q network devices. The non-cisco 802.1Q cloud separating the Cisco network devices is treated as a single trunk link between the network devices. Interoperability with non-cisco 802.1Q network devices is an extension of PVST known as PVST+. Understanding IEEE 802.1w RSTP The RSTP takes advantage of point-to-point wiring and provides rapid convergence of the spanning tree. Port Roles and the Active Topology The RSTP provides rapid convergence of the spanning tree by assigning port roles and by learning the active topology. The RSTP builds upon the 802.1D STP to select the switch with the highest switch priority (lowest numerical priority value) as the root bridge. The RSTP then assigns one of these port roles to individual ports: A port with the root or a designated port role is included in the active topology. A port with the alternate or backup port role is excluded from the active topology. In a stable topology with consistent port roles throughout the network, the RSTP ensures that every root port and designated port immediately transition to the forwarding state while all alternate and backup ports are always in the discarding state (equivalent to blocking in 802.1D). The port state controls the operation of the forwarding and learning processes. Rapid Convergence The RSTP provides for rapid recovery of connectivity following the failure of a switch, a switch port, or a LAN. It provides rapid convergence for edge ports, new root ports, and ports connected through point-to-point links as follows: Edge ports If you configure a port as an edge port on an RSTP switch by using the spanning-tree portfast interface configuration command, the edge port immediately transitions to the forwarding state. An edge port is the same as a Port Fastenabled port, and you should enable it only on ports that connect to a single end station. Root ports If the RSTP selects a new root port, it blocks the old root port and immediately transitions the new root port to the forwarding state. Point-to-point links If you connect a port to another port through a point-to-point link and the local port becomes a designated port, it negotiates a rapid transition with the other port by using the proposal-agreement handshake to ensure a loop-free topology. 9
Configure STP Default STP Configuration Feature Enable state Mode Default Value STP enabled for all VLANs PVST Bridge priority 32768 STP port priority (configurable on a per-port basis used on LAN ports configured as Layer 2 access ports) STP port cost (configurable on a per-port basis used on LAN ports configured as Layer 2 access ports) STP VLAN port priority (configurable on a per-vlan basis used on LAN ports configured as Layer 2 trunk ports) STP VLAN port cost (configurable on a per- VLAN basis used on LAN ports configured as Layer 2 trunk ports) Hello time Forward delay time Maximum aging time 128 10-Gigabit Ethernet: 2 Gigabit Ethernet: 4 Fast Ethernet: 19 Ethernet: 100 128 10-Gigabit Ethernet: 2 Gigabit Ethernet: 4 Fast Ethernet: 19 Ethernet: 100 2 seconds 15 seconds 20 seconds Enabling STP Note: STP is enabled by default on VLAN 1 and on all newly created VLANs. To enable STP on a per-vlan basis, perform this task: Command Router(config)# spanning-tree vlanvlan_id Router(config)# default spanning-tree vlan vlan_id Purpose Enables STP on a per-vlan basis. The vlan_id value can be 1 through 4094. Reverts all STP parameters to default values for the specified VLAN. Router(config)# no spanning-tree vlan vlan_id Disables STP on the specified VLAN. Router# show spanning-tree vlanvlan_id Verifies that STP is enabled. 11
This example shows how to enable STP on VLAN 200: Router# configure terminal Router(config)# spanning-tree vlan 200 Configuring the Root Bridge To configure the switch as the root bridge, perform this task: Command Router(config)# spanning-tree vlan vlan_id root primary [diameter hops [hellotime seconds]] Purpose Configures the switch as the root bridge. The vlan_id value can be 1 through 4094. Router(config)# no spanning-tree Clears the root bridge configuration. vlan vlan_idroot This example shows how to configure the switch as the root bridge for VLAN 10: Router# configure terminal Router(config)# spanning-tree vlan 10 root primary Router(config)# end Configuring a Secondary Root Bridge To configure the switch as the secondary root bridge, perform this task: Command Purpose Router(config)# [no] spanning-tree vlan vlan_idroot secondary [diameter hops [hellotimeseconds]] Configures the switch as the secondary root bridge. The vlan_idvalue can be 1 through 4094, Router(config)# no spanning-tree Clears the root bridge configuring. vlan vlan_idroot This example shows how to configure the switch as the secondary root bridge for VLAN 10: Router# configure terminal Router(config)# spanning-tree vlan 10 root secondary diameter 4 Configuring the Bridge Priority of a VLAN To configure the STP bridge priority of a VLAN, perform this task: Command Purpose Router(config)# spanning-tree vlan vlan_id priority {0 4096 8192 12288 16384 20480 24576 286 72 32768 36864 40960 45056 49 152 53248 57344 61440} Router(config)# no spanning-tree vlan vlan_id priority Configures the bridge priority of a VLAN when the extended system ID is enabled. The vlan_id value can be 1 through 4094, except reserved VLANs (seetable 23-1). Reverts to the default bridge priority value. 11
Router# show spanningtree vlan vlan_id bridge [detail] Verifies the configuration. This example shows how to configure the bridge priority of VLAN 200 to 33792 when the extended system ID is disabled: Router# configure terminal Router(config)# spanning-tree vlan 200 priority 32768 Router(config)# end Troubleshoot STP Path Cost Automatically Changes When a Port Speed/Duplex Is Changed STP calculates the path cost based on the media speed (bandwidth) of the links between switches and the port cost of each port forwarding frame. Spanning tree selects the root port based on the path cost. The port with the lowest path cost to the root bridge becomes the root port. The root port is always in the forwarding state. If the speed/duplex of the port is changed, spanning tree recalculates the path cost automatically. A change in the path cost can change the spanning tree topology. Refer to the Calculating and Assigning Port Costs section of Configuring Spanning Tree for more information on how to calculate the port cost. Troubleshoot Commands show spantree vlan_id Shows the current state of the spanning tree for this VLAN ID, from the perspective of the switch on which you issue the command. show spantree summary Provides a summary of connected spanning tree ports by VLAN. show spantree statistics Shows spanning tree statistical information. show spantree backbonefast Displays whether the spanning tree BackboneFast Convergence feature is enabled. show spantree blockedports Displays only the blocked ports. show spantree portstate Determines the current spanning tree state of a Token Ring port within a spanning tree. show spantree portvlancost Shows the path cost for the VLANs on a port. show spantree uplinkfast Shows the UplinkFast settings. 12