Spanning tree explained: root bridge, port roles, RSTP

Ethernet frames have no time to live. A router drops a packet after enough hops; a switch forwards a broadcast out of every port, forever. With two paths between switches you get three problems at once: broadcast storms, duplicate frames reaching the hosts, and a MAC address table that keeps learning the same address on different ports.

Spanning tree keeps the redundant cables, and logically switches off just enough ports to leave one loop free path, a tree.

Every tree needs a root. Each switch has a bridge ID: a priority, then its MAC address. The lowest bridge ID wins. The priority defaults to 32,768 on all four vendors, and you change it in steps of 4,096, from zero up to 61,440. On Cisco, part of the priority field carries the VLAN number, which is why VLAN 1 shows a priority of 32,769.

If every priority is left at its default, the switch with the lowest MAC address becomes root. That is usually the oldest switch in the building, not the one you would choose.

Once the root is known, every other switch picks its best way to reach it, by path cost. Faster links cost less. The original table gave a gigabit link a cost of 4 and ten gigabit a cost of 2; the newer long values give twenty thousand and two thousand, which leaves room for 100 gigabit and beyond. Every switch in the network must use the same method.

Huawei uses the long values by default. On Cisco, Juniper and Aruba the documentation does not agree with itself across releases, so check the method on your own switches before you compare numbers.

Each switch keeps one root port, its best path to the root. On every segment, one designated port forwards towards it. Every other port that could create a loop becomes an alternate port, and it blocks. When costs tie, the switches compare the sender's bridge ID, then the port ID.

The original protocol was careful, and slow. Switches send a hello every two seconds. When a better path is lost, a switch waits for the old information to age out, twenty seconds, then listens for fifteen, then learns addresses for fifteen more.

Cisco puts it plainly: around fifty seconds with default settings. On a network carrying voice, that is an outage.

Rapid spanning tree, IEEE 802.1w, replaced the waiting with a handshake. On a point to point link, the upstream switch sends a proposal. The downstream switch makes that port its root port, blocks its other non edge ports for a moment, and answers with an agreement. The link forwards immediately.

If a root port fails, the best alternate port takes over at once. Cisco states it in its own guide: less than one second, against fifty with the old protocol.

Port states shrink to three: discarding, learning and forwarding. And only a port moving to forwarding counts as a topology change; edge ports never cause one.

Ports facing a PC or a printer should never be part of the tree. Mark them as edge ports and they forward the moment the link comes up. On Cisco that is portfast edge. On Huawei, stp edged-port enable. On Aruba, port-type admin-edge. On Juniper, the edge statement under the RSTP interface.

Edge ports are an invitation, though: anyone plugging a switch into them can talk spanning tree. Which brings us to the guards.

BPDU Guard shuts an edge port the moment a spanning tree message arrives on it. Cisco calls it bpduguard, Huawei calls it BPDU protection, Aruba bpdu-guard, and Juniper blocks BPDUs on edge ports.

Root Guard stops a port from ever leading to a new root. If a better bridge appears behind it, the port blocks instead of handing it the crown. Huawei documents exactly that failure: a new switch with a better priority, plugged into an access switch, becomes root, the 100 gigabit core link is blocked, and traffic squeezes through two 10 gigabit links.

Loop Guard covers the quiet failure: a link that still carries traffic one way but has stopped delivering BPDUs. Without it, the blocked port assumes the other side is gone and starts forwarding. That is a loop. Cisco names unidirectional links as one frequent reason for spanning tree failures. Root Guard and Loop Guard cannot share a port. And BPDU filter is the one to treat with care: it makes a port ignore spanning tree, which is close to switching it off.

Cisco switches run a spanning tree per VLAN by default, Rapid PVST+, although one Cisco reference still says PVST. Huawei and Aruba default to MSTP, the IEEE standard that maps many VLANs onto a few instances. Juniper EX runs RSTP. Aruba's own guide says it directly: in a multi vendor network, MSTP is the preferred option.

Switches share an MSTP region only if three things match exactly: the region name, the revision number and the VLAN to instance map. Even then, Huawei documents a case where a Cisco and a Huawei switch with identical settings still disagree, because of how each computes the region digest, and the fix is digest snooping on the Huawei port.

Where MSTP meets Cisco's per VLAN tree, Cisco's rule is simple: keep the root inside the MSTP backbone.

The questions are always the same: who is root, and which ports block. Cisco answers with show spanning-tree, Huawei with display stp brief, Aruba with show spanning-tree, and Juniper with show spanning-tree bridge and show spanning-tree interface.

Same protocol, four vocabularies: blocking, discarding, alternate, ALT.

Asking every switch one by one does not scale. NacTrack reads spanning tree from each switch over SSH, whatever the vendor, and shows on one page which bridge is root for each VLAN, which ports are blocking, and where BPDU Guard is missing. The questions above, answered for the whole network at once.