Spanning tree in practice: port states, path cost, PortFast and BPDU Guard

Port states and roles

Spanning tree elects a root bridge and blocks just enough ports to remove loops. How a port behaves depends on its state (what it does with frames) and its role (its job in the tree).

RSTP roles are root (best path to the root), designated (forwards onto a segment), alternate (a ready backup path to the root) and backup (a spare on a shared segment). Classic timers are 2-second hellos, a 20-second max age and 15-second forward delay. RSTP uses a quick handshake between switches instead, so it normally converges in about a second. On Cisco, run spanning-tree mode rapid-pvst.

Path cost and the root port

Each non-root switch picks the port with the lowest total path cost to the root as its root port. Ties are broken by the lowest sender bridge ID, then the lowest sender port ID.

Use the same method (spanning-tree pathcost method long) on all switches.

Choosing the root bridge

Always choose the root on purpose: make your core or distribution switch the root for each VLAN, with a second switch as backup. Otherwise the oldest switch with the lowest MAC address might become root and pull traffic through a slow path.

spanning-tree mode rapid-pvst
spanning-tree vlan 10,20,30 root primary      ! on the core switch
spanning-tree vlan 10,20,30 root secondary    ! on the backup core
show spanning-tree vlan 10
show spanning-tree summary

Protecting the tree

• PortFast lets access ports for PCs, printers and phones go straight to forwarding. It avoids DHCP timeouts at boot and stops topology change floods every time a PC restarts. Use it only on ports facing end devices.
• BPDU Guard shuts down (err-disables) a PortFast port if a BPDU arrives, meaning someone plugged in a switch. Pair it with PortFast everywhere.
• Root Guard on distribution ports facing access switches blocks any port that receives a superior BPDU, so no downstream switch can become root.
• Loop Guard stops a blocked port from moving to forwarding just because BPDUs stopped arriving, which can happen with a one-way fibre fault.

interface range GigabitEthernet1/0/1 - 46
 switchport mode access
 spanning-tree portfast
 spanning-tree bpduguard enable
errdisable recovery cause bpduguard
errdisable recovery interval 300

Real-world example: a staff member brought a small switch from home and connected two of its ports to two wall sockets to "get more speed". Without protection this created a loop and a broadcast storm across the floor. With BPDU Guard enabled, both access ports went err-disabled within a second, the rest of the network carried on, and the logs showed exactly which sockets to visit.

Common mistakes: enabling PortFast on a port that connects to another switch, which can create a temporary loop; using BPDU filter globally to "quieten" logs, which silently disables protection; letting different switches run different spanning tree modes without a plan; and never checking which switch is actually the root. Run show spanning-tree root on a few switches after every change to confirm the root bridge is where you expect it, and record the result in your documentation.