1.1.e Spanning Tree Protocol

The Spanning Tree Protocol (STP) is a layer 2 loop prevention mechanism. There are multiple flavors that we need to be aware of:

802.1D (Original Standard)
PVST – Per VLAN Spanning Tree
PVST/PVST+ Per VLAN Spanning Tree (Cisco proprietary)
Rapid Spanning Tree (802.1W)
Multiple Spanning Tree/MST (802.1S)

The basic premise of STP is:

Elect one Root Bridge
Elect one Root Port per switch/bridge
Elect Designated Ports

Root Bridge Election:

The switch with the lowest Bridge ID in the network becomes the Root Bridge.

Bridge ID (8 Bytes) contains:

Bridge Priority with a value from 0-61440 (in increments of 4096) where 0 is the most preferred.
System ID Extension (0-4095) used to encode the VLAN number of the STP instance.
MAC address where lowest value MAC address is most preferred.

Let’s see which one of the switches is root:

SW1#sh span vlan 1

VLAN0001
  Spanning tree enabled protocol ieee
  Root ID    Priority    32769
             Address     5000.000b.0000
             This bridge is the root
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec

  Bridge ID  Priority    32769  (priority 32768 sys-id-ext 1)
             Address     5000.000b.0000
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec
             Aging Time  300 sec

SW2#sh span vl 1

VLAN0001
  Spanning tree enabled protocol ieee
  Root ID    Priority    32769
             Address     5000.000b.0000
             Cost        4
             Port        7 (GigabitEthernet1/2)
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec

  Bridge ID  Priority    32769  (priority 32768 sys-id-ext 1)
             Address     5000.000c.0000
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec
             Aging Time  300 sec

As we can see SW1 is root, because of the lower MAC Address (Bridge priority and System Id Ext. are the same on both switches). Output of SW3 and SW4 omitted since they have a higher MAC Address (trust me :-D)

Only a Root Bridge can generate BPDU packets (802.1d)
Once elected, BPDUs flow from root of the tree to the leaves.

Root Port Election:

Root port is upstream facing toward the Root Bridge
Elected based on lowest Root Path Cost, the cumulative cost of all links to get to the Root Bridge.
Cost is calculated on inverse bandwidth, e.g. 10Mbps = 100, 100Mbps = 19, 1000Mbps = 1
Cost tiebreaker, Chose lowest upstream Bridge ID or choose lowest upstream Port ID.

Designated Port Election:

Designated Ports are downstream away from the Root Bridge.
Similar to Root Port, elected based on Lowest Root Path Cost, Lowest BID, Lowest Port ID.
All other ports go into blocking mode; can receive BPDUs, Discard all other traffic, Cannot send traffic

802.1d Convergence:

STP convergence is based on timers set on the Root Bridge.

Hello Timer – how often to send a BPDU (Bridge Protocol Data Unit)
- Default Hello Timer is 2s
Forward Delay Timer – to control transition from blocking – listening – learning – forwarding stages
- Default Forward Delay Timer is 15s
Max Age Timer – How long to wait for an upstream device to send a BPDU before downstream device declares it down.
- Default Max Age Timer is 20s

Convergence time is Forward Delay time + Max Age

1.1.e i PVST+, Rapid PVST+, MST

PVST+

One instance of Legacy STP (802.1d) per VLAN
Default mode on Catalyst platforms
Allows Root/Port placement per VLAN

Rapid PVST+ (802.1w)

Faster convergence compared to 802.1d
Rapid convergence based on sync process or proposal process
Allow for faster initial convergence
Allows a bridge to announce itself as Root Bridge when starting up and sending proposals
Switches agree on proposal on defining the Root Bridge in sub-second
RSTP simplifies the port state to three stages; Discarding, Learning, Forwarding
As well as the Port Roles defined in 802.1D (Root and Designated), RSTP adds Alternate Port (a port that provides an alternate path to the Root Bridge through a different switch) and Backup Port (A port that provides link redundancy toward the current Root Switch)
All bridges generate BPDUs
- Hello interval 2s
- If three hellos are missed, neighbor is declared down and CAM is immediately flushed
- Three hello timers is greater than Max Age; 6s vs 20s
- Allows for faster re-convergence
Backwards compatible with 802.1D

Enabling rapid spanning-tree:

spanning-tree mode rapid-pvst

Worth noting here that Multi-access Layer 2 devices e.g. A Hub can only connect at Half-Duplex. As such, it will fall under the backwards compatibility rules and utilize 802.1D states and convergence times.

MST (802.1s)

Multiple Spanning Tree Protocol
User defined instances to a VLAN or multiple VLANs
Uses 802.1w for rapid convergence
Highly scalable
- Switches with the same instances, configuration revision number and name form a ‘region’
- Different regions see each other as virtual bridges

MST works by de-coupling VLAN and STP instances, so you can choose to have VLANs 1-10 mapped to one MST instance, VLANs 11-20 mapped to another MST instance and so on.

Grouping VLANs into instances can reduce the load (CPU/Memory) on the switch (Rapid-PVST+ runs an instance per VLAN, which can become a problem if you have thousands fo VLANs)

Configuring MST

spanning-tree mst configuration
 name Region1
 revision 1
 instance 1 vlan 10, 30
 instance 2 vlan 20, 40
!
spanning-tree mode mst
!
! setting the switch to become the root
spanning-tree mst 0-4094 priority 4096

1.1.e iii PortFast, BPDU Guard, BPDU Filter

Portfast

PortFast disables the ability for a device connected to that interface to create a TCN (Topology Change Notification) at all. On top of this, it skips the learning and listening states and goes straight to forwarding state.

There’s a few different ways that PortFast can be enabled:

Spanning-tree portfast default	Enables PortFast globally, but not for Trunk ports
Spanning-tree portfast edge	When entered on an interface will enable PortFast only for that interface.
Spanning-tree portfast edge trunk	Enables PortFast on a trunk link, however this should only be used for client devices with a single connection but still require a trunk, such as a VM host.

BPDU Guard

BPDU Guard is a feature that protects the spanning-tree topology. When a BPDU is received on a port that is configured with PortFast, BPDU Guard will put that interface into ‘errdisable’ state. This is a pro-active way of ensuring that Layer 2 loops do not occur accidentally.

BPDU Guard commands:

Spanning-tree portfast bpduguard default	Enables BPDU Guard on all PortFast interfaces
Spanning-tree bpduguard	When entered on an interface will enable BPDU Guard on that interface.

BPDU Filter

BPDU Filter is a feature that will block BPDUs from being transmitted from an interface. It can be enabled globally or specifically on any given interface individually.

When configured globally, using the command spanning-tree portfast bpdufilter default, all interfaces configured with PortFast, stop sending or receiving BPDUs.
- If a BPDU is received by an interface after BPDU Filter is enabled globally, that interface will lose its PortFast config, BPDU Filter will be disabled on that port and the port then behaves normally.
When configured on individual interfaces using the command spanning-tree bpdufilter enable, BPDU Filter will ignore any received BPDUs and that interface will be prevented from sending any BPDUs.
- This configuration is essentially the same as disabling Spanning Tree Protocol on that interface and must be deployed with caution.

1.1.e iv Loop Guard, Root Guard

Loop Guard

In fiber networking, the cables are usually in core pairs – one to transmit, the other to receive. You can end up with unidirectional traffic, if one of those cores are broken or becomes deteriorated. One way to mitigate this is the use of UDLD (mentioned previously in 1.1b). The other way of mitigating this, is Spanning-Tree’s Loop Guard mechanism.

Loop Guard prevents ports that are marked as Root or Alternate from becoming Designated in case BPDUs stop being received on those interfaces. Loop Guard will simply place the affected port in ‘errdisable’ state, when the port starts receiving BPDUs again, it will recover from ‘errdisable’ state and will transition through the STP states.

Spanning-tree loopguard default	Configures Loop Guard globally
Spanning-tree guard loop	Configured on an individual interface

Root Guard

Root Guard is configured only on individual interfaces and essentially stops any interface from ever becoming a root port and therefore, stopping another potentially misconfigured switch from becoming the Root Bridge in a topology. If an interface configured with Root Guard receives a BPDU with a superior value, it will place that interface in ‘errdisable’ state. Configure this on an interface with command spanning-tree guard root.

Digital Amnesia