Learn Computer Networking PNETLab - Loop Prevention with Spanning Tree Protocol (STP & RSTP)

#Introduction

In episode 5 you built dual trunks between switches. Redundant topologies like that are good for reliability, but at Layer 2, uncontrolled redundancy is a disaster: frames can spin forever and take down the network. Episode 7 discusses the protocol that saves a network from itself: Spanning Tree Protocol (STP).

We start with the problems loops cause, then break down how STP 802.1D works, followed by Rapid STP 802.1w, and close with the Cisco optimization features PortFast and BPDU Guard that must exist on access ports.

#The Problem of Redundant Layer 2 Topologies

#Broadcast Storm, Multiple Frame, and CAM Instability

Without STP, a Layer 2 loop causes three serious problems:

• Broadcast Storm: broadcast frames are re-transmitted endlessly by every switch in the loop, consuming bandwidth until the network is unusable.
• Multiple Frame Transmission: a unicast frame can be received repeatedly by the destination because it arrives through different paths.
• CAM Table Instability: the switch receives frames with the same MAC from many ports, so the MAC table flaps and the switch loses the correct forwarding decision.

Try it in PNETLab: assemble three switches in a triangle, connect a PC, and leave it for a few seconds. The CPU and links will swell — that is a real broadcast storm.

#How Spanning Tree Protocol Works

#Root Bridge Selection

STP builds one loop-free logical topology over physically redundant links. The first step: selecting the Root Bridge, the switch that becomes the center of the calculation. The Root Bridge is chosen by the lowest Bridge Priority, and if tied, by the lowest MAC address.

Show the results in PNETLab:

SW1# show spanning-tree vlan 10
Spanning tree enabled protocol ieee
Root ID    Priority    32769
           Address     0050.7966.6800
           This bridge is the root
Bridge ID  Priority    32769  (priority 32768 sys-id-ext 10)
           Address     0050.7966.6800
Interface   Role        Sts      Cost      Prio.Nbr Type
---------   ----------- -------- --------- -------- --------------
Gi0/0       Desg        FWD       4        128.1    P2p
Gi0/1       Desg        FWD       4        128.2    P2p

The show spanning-tree output shows the Root ID and the role of each port. The root bridge always makes all of its ports Designated Ports (DP).

#Port Roles: Root, Designated, and Blocked

• Root Port (RP): the best port of a non-root switch toward the root bridge, one per switch.
• Designated Port (DP): the port that is the segment's determiner, one per segment.
• Blocked / Non-Designated Port (BP): the port that is logically disabled to break the loop.

#Port State Transitions

STP ports move through four states: Blocking (only listening to BPDUs), Listening, Learning (populating the MAC table), then Forwarding. This transition takes about 30 seconds on classic STP — the long delay that led to RSTP being developed.

#Rapid Spanning Tree Protocol (RSTP)

#Fast Convergence with Alternate and Backup Ports

RSTP (IEEE 802.1w) speeds up convergence by introducing new ports: Alternate Port (a backup root port, going straight to forwarding when the RP fails) and Backup Port (a backup designated port). These new roles make failover almost instant without waiting for the 30-second timer.

Enable RSTP on all switches in your lab:

configure terminal
spanning-tree mode rapid-pvst
exit

spanning-tree mode rapid-pvst replaces classic PVST+ with Rapid PVST+, the per-VLAN version of RSTP used by Cisco.

#STP Optimization Features on Cisco

#PortFast: Direct Access to Forwarding

An access port connected to a PC does not need to wait through the 30-second convergence process. PortFast makes the port go straight to the Forwarding state when the link comes up:

configure terminal
interface range g0/1 - 5
 switchport mode access
 spanning-tree portfast
 spanning-tree bpduguard enable
exit

spanning-tree portfast skips the listening and learning phases on access ports. Remember: PortFast is only for access ports facing end devices, not for switch-to-switch links.

#BPDU Guard: Shutting Down Rogue Ports

BPDU Guard monitors ports that should never receive BPDUs. If an incoming BPDU frame is detected — for example, a user plugged in a rogue switch — the port automatically goes into err-disable state and shuts down. Verify:

SW1# show interfaces status | include err-dis
Gi0/5                         err-disabled

show interfaces status displays ports that went into err-disable because of BPDU Guard. Re-enable it with shutdown then no shutdown after the source of the BPDUs has been cleaned up.

#Designing STP in PNETLab

In the lab, manually determine which switch becomes root with spanning-tree vlan 10 root primary or by setting spanning-tree vlan 10 priority 4096. The root bridge should be the switch with the best performance, not a random switch that happens to have the lowest MAC. Consistency between STP and your VLAN design from episode 5 will help a lot during troubleshooting in episode 20.

#Closing

Key takeaways:

• Layer 2 loops cause broadcast storms, multiple frames, and CAM instability.
• The root bridge is chosen by the lowest bridge priority and MAC address.
• Port roles: Root Port, Designated Port, and Blocked Port.
• RSTP 802.1w speeds up convergence with alternate and backup ports.
• PortFast skips the convergence process on access ports.
• BPDU Guard shuts down ports that receive BPDUs from rogue devices.

In the next episode, episode 8, we discuss link aggregation: EtherChannel with LACP and PAgP — combining up to 8 physical links into a single logical channel, the active passive desirable auto negotiation modes, Layer 2 and Layer 3 EtherChannel configuration, and verification with show etherchannel summary.