PVST+, root bridge placement and Rapid Spanning Tree (RSTP) configuration

PVST+: one tree per VLAN

The original IEEE standard ran a single spanning tree for all VLANs, so a blocked uplink was blocked for everyone. Cisco's Per-VLAN Spanning Tree Plus (PVST+) runs a separate instance for each VLAN, each with its own root, costs and blocked ports. That costs some CPU and BPDUs, but it lets you share load across redundant links.

To keep a separate bridge ID per VLAN, the 16-bit priority field is split: 4 bits of priority and a 12-bit extended system ID that holds the VLAN number. This is why priority can only change in steps of 4096 and why show spanning-tree vlan 10 shows a default priority of 32778 (32768 + 10).

Placing the root bridge

Never leave root election to chance: the switch with the lowest MAC address wins ties, which is often the oldest switch in the building. Make your distribution or core switches the roots and share VLANs between them:

! DIST-1
spanning-tree mode rapid-pvst
spanning-tree vlan 10,30 root primary
spanning-tree vlan 20,40 root secondary
! DIST-2
spanning-tree mode rapid-pvst
spanning-tree vlan 20,40 root primary
spanning-tree vlan 10,30 root secondary
show spanning-tree root

The root primary macro sets the priority to 24576, or lower if needed to beat the current root; root secondary sets 28672. You can also set values directly with spanning-tree vlan 10 priority 4096, which is more predictable. With this design each access switch forwards VLANs 10 and 30 on its uplink to DIST-1 and VLANs 20 and 40 on the other uplink. Align the HSRP or VRRP active gateway for each VLAN with its root, so traffic does not take an extra hop.

How RSTP converges quickly

Rapid Spanning Tree (IEEE 802.1w, now part of 802.1D-2004 and 802.1Q) keeps the same election rules but changes how ports move to forwarding:

• Three states: discarding, learning and forwarding.
• Every switch sends BPDUs every hello time. Missing three in a row (6 seconds) means the neighbour is gone, instead of waiting 20 seconds of max age.
• Alternate ports are pre-calculated backups for the root port. If the root port fails, the alternate becomes the root port and forwards immediately.
• Edge ports (PortFast on Cisco) connect to hosts and forward at once. If an edge port ever receives a BPDU, it loses its edge status.
• Proposal and agreement: on a point-to-point link, a designated port proposes to forward; the neighbour briefly blocks its own non-edge ports (sync), agrees, and both sides forward at once. The handshake ripples outward in well under a second.
• Topology changes: only non-edge ports moving to forwarding cause a change. The switch flushes MAC entries immediately and floods the TC flag itself, without waiting for the root.

The handshake only works on point-to-point links, which RSTP assumes for full-duplex ports. Half-duplex ports are treated as shared and fall back to slower timer-based behaviour.

Configuring Rapid PVST+

spanning-tree mode rapid-pvst
interface range GigabitEthernet1/0/1 - 44
 spanning-tree portfast
 spanning-tree bpduguard enable
interface GigabitEthernet1/0/48
 spanning-tree link-type point-to-point
show spanning-tree vlan 10
show spanning-tree summary

Rapid PVST+ falls back to classic behaviour on any port where it hears 802.1D BPDUs, so convert the whole network, not one switch at a time over months.

Real-world example: a secondary school ran classic PVST+ with every VLAN rooted on one old access switch in the science block, because nobody had set priorities. All traffic from the other blocks crossed that switch, and when it rebooted the network froze for nearly a minute. The technician made the two new core switches the roots, splitting staff and student VLANs between them, and moved every switch to Rapid PVST+. Unplugging a core uplink in a test now causes a drop of about one second, and both uplinks carry traffic.