Networking LabsLabsIntermediate

Lab: spanning tree root control and EtherChannel

Q: Which EtherChannel mode actively sends LACP packets?

active . passive only responds, and on forces a bundle without any negotiation.

By Mohamed Fayas 9 min readUpdated 8 October 2026

In short: Redundant switch links create loops unless the Spanning Tree Protocol (STP) blocks some of them. In this lab you choose the root bridge for each VLAN instead of leaving it to chance, protect user ports, and combine two links into one logical EtherChannel so both carry traffic.

Aim and what you need

The aim is to make a redundant switched network predictable. Left alone, STP elects the switch with the lowest MAC address as root, which is often the oldest switch in the cupboard. You will set the root deliberately, harden user ports, and use Link Aggregation Control Protocol (LACP) to bundle links.

Packet Tracer or your own lab: three 2960 switches and two PCs.
Links: S1 Fa0/23 and Fa0/24 to S2 Fa0/23 and Fa0/24 (the bundle); S1 G0/1 to S3 G0/1; S2 G0/2 to S3 G0/2.
VLANs 10 and 20 created on all three switches, and all inter-switch links set as trunks (see the VLAN lab).

Design

Figure 1. S1 and S2 share the root role per VLAN, are joined by a two-link LACP bundle, and both connect to access switch S3.

Figure 2. Spanning tree elects a root bridge, then chooses root and designated ports, and blocks the remaining redundant ports.

Splitting the root role means VLAN 10 traffic prefers S1 and VLAN 20 traffic prefers S2, so both uplinks from S3 are used. If the root fails, the other switch takes over because it has the next lowest priority.

Steps

Turn on Rapid PVST+ on all switches for faster convergence.
Set S1 as primary root for VLAN 10 and secondary for VLAN 20, and the opposite on S2.
Bundle Fa0/23-24 between S1 and S2 with LACP. Configure the member ports identically, then configure the port-channel as a trunk.
On S3, set user-facing ports as edge ports with PortFast and BPDU Guard.

! all switches
spanning-tree mode rapid-pvst
! S1
spanning-tree vlan 10 root primary
spanning-tree vlan 20 root secondary
! S2
spanning-tree vlan 20 root primary
spanning-tree vlan 10 root secondary
! S1 and S2: EtherChannel
interface range fa0/23 - 24
 shutdown
 switchport mode trunk
 channel-group 1 mode active
 no shutdown
interface port-channel 1
 switchport mode trunk
 switchport trunk allowed vlan 10,20
! S3: user ports
interface range fa0/1 - 20
 switchport mode access
 spanning-tree portfast
 spanning-tree bpduguard enable

Verify

Success looks like this: S1 says "This bridge is the root" for VLAN 10, S2 says the same for VLAN 20; S3 shows a root port towards S1 for VLAN 10 and towards S2 for VLAN 20, with the other uplink as alternate. The EtherChannel summary shows Po1 with the flags SU (Layer 2, in use) and both members with P (bundled).

show spanning-tree vlan 10
show spanning-tree vlan 20
show spanning-tree root
show etherchannel summary
show interfaces port-channel 1
show spanning-tree interface fa0/1 detail

Test failover: shut S3 G0/1 and run a continuous ping between the PCs (ping -t on Windows). With Rapid PVST+, you should lose very few replies while the alternate port takes over. To test BPDU Guard, connect a spare switch to an S3 user port: the port should go into the err-disabled state.

Troubleshooting and clean-up

Port-channel will not come up: member ports must match in speed, duplex, VLANs and trunk mode. Both ends must use compatible modes: active with active or passive; never mix on with LACP.
Wrong root: another switch has a lower priority; check with show spanning-tree root and lower yours (priority values go in steps of 4096).
Port err-disabled: BPDU Guard caught a switch on an edge port. Remove the cause, then shutdown and no shutdown the port.
Never use PortFast on links to other switches: it skips loop checks and can cause a broadcast storm.

To clean up, remove channel-group from the members, delete the port-channel with no interface port-channel 1, and reset priorities with no spanning-tree vlan 10 root. In campus networks, the distribution switches (or the switch that holds the default gateway) should be the root.

Practice

What decides which switch becomes the root bridge?

The lowest bridge ID: priority first, then the lowest MAC address as a tie-breaker.

Why use BPDU Guard together with PortFast?

PortFast skips listening and learning on user ports; BPDU Guard shuts the port if a switch is plugged in, preventing loops and rogue root bridges.

Which EtherChannel mode actively sends LACP packets?

active. passive only responds, and on forces a bundle without any negotiation.

Key takeaways

Set the root bridge on purpose with root primary and secondary per VLAN.
Rapid PVST+ converges much faster than classic STP.
PortFast plus BPDU Guard protects user-facing ports.
EtherChannel bundles links so STP sees one logical port and both links carry traffic.
Member ports must match; verify with show etherchannel summary.

Tracks your learning on this device only. See your progress on the learning paths.

About the author

Mohamed Fayas

Founder of FM TecHub. CCNA certified, with a BTEC HND in Network Engineering, and BEng (Hons) in Computer Networking and Cloud Security. He writes practical, plain-English guides on networking, security and cloud.

More about the author