Skip to content
Study CCNP

Configure And Verify

3.1.c Configure and verify common Spanning Tree Protocols (RSTP, MST) and Spanning Tree enhancements such as root guard and BPDU guard

4 min read ENCOR 350-401 v1.2

Aligned to Cisco's 350-401 ENCOR v1.2 exam topics.

On this page

Spanning Tree Protocol prevents Layer 2 loops. That sentence is simple, but the behavior matters because loops can destroy a campus network quickly.

ENCOR focuses on common STP families and protections:

  • RSTP for fast convergence.
  • MST for mapping many VLANs into a smaller number of spanning-tree instances.
  • Root Guard to stop an unexpected switch from becoming root.
  • BPDU Guard to shut down an edge port that receives BPDUs.

The root bridge idea

Each spanning-tree instance elects one root bridge. Every non-root switch calculates its best path toward that root. Redundant links that are not needed are blocked or put into a non-forwarding role.

If the wrong switch becomes root, traffic may take a bad path. Worse, a cheap access switch can accidentally become the center of your Layer 2 topology.

Root bridge
Distribution switch · root port toward root
Access switch · designated and alternate ports

On a non-root switch, the root port is the best path toward the root. A designated port forwards traffic onto a segment. An alternate port is the backup path and stays blocked. If you see unexpected blocking, check which bridge is root and which port roles each switch chose.

RSTP basics

Rapid PVST+ runs one rapid spanning-tree instance per VLAN.

spanning-tree mode rapid-pvst
!
spanning-tree vlan 10,20 root primary
spanning-tree vlan 30,40 root secondary

Verify:

show spanning-tree summary
show spanning-tree vlan 10
show spanning-tree root

Look for:

  • Root bridge ID and local bridge ID.
  • Root port on non-root switches.
  • Designated ports forwarding toward downstream segments.
  • Alternate ports blocking as backup paths.

PortFast and BPDU Guard

PortFast is for edge ports connected to end hosts. It lets the port skip normal listening/learning behavior and begin forwarding quickly.

BPDU Guard protects that assumption. If an edge port receives a BPDU, the switch treats it as a sign that another switch was connected there and err-disables the port.

That sentence needs to be interpreted strictly: edge means host-facing. Do not normalize PortFast on inter-switch links just because it makes a lab converge faster. If a PortFast port receives a BPDU and BPDU Guard is enabled, the correct result is usually errdisable, not “STP is broken.”

PortFast edge port (expects a host only):
  PC connected
  port forwards quickly
  Switch BPDU arrives
  BPDU Guard · errdisable (correct)
spanning-tree portfast default
spanning-tree portfast bpduguard default
!
interface gi1/0/10
 description User PC
 switchport mode access
 switchport access vlan 10
 spanning-tree portfast

Verify:

show spanning-tree summary
show spanning-tree interface gi1/0/10 detail
show interfaces status err-disabled
show errdisable recovery

If a port is err-disabled by BPDU Guard:

show logging | include BPDU|ERR
show interfaces status err-disabled

Fix the cabling or config first. Then recover:

interface gi1/0/10
 shutdown
 no shutdown

Do not simply bounce the port if a switch is still connected. It will fail again, and it should.

Root Guard

Root Guard protects ports where the current switch should never hear superior BPDUs. If a superior BPDU arrives, the port moves to root-inconsistent state instead of allowing the downstream device to become root.

Use it on designated ports facing access switches, not on ports where the real root might be reachable.

Use Root Guard on ports facing places that should never provide the root bridge. Do not put it on the legitimate upstream path to the intended root, or you can create the outage you were trying to prevent.

interface gi1/0/24
 description Downlink to access switch
 spanning-tree guard root

Verify:

show spanning-tree inconsistentports
show spanning-tree interface gi1/0/24 detail

Root Guard does not err-disable the interface. When the superior BPDUs stop, the port can recover automatically.

MST basics

MST maps VLANs to instances. Instead of running one STP instance per VLAN, you can group VLANs that should share the same topology.

All switches in the same MST region must match:

  • Region name.
  • Revision number.
  • VLAN-to-instance mapping.

Example:

spanning-tree mode mst
!
spanning-tree mst configuration
 name CAMPUS
 revision 10
 instance 1 vlan 10,20
 instance 2 vlan 30,40
 exit
!
spanning-tree mst 1 root primary
spanning-tree mst 2 root secondary

Verify:

show spanning-tree mst configuration
show spanning-tree mst
show spanning-tree mst 1

If the region values do not match, switches may treat each other as different regions. That changes boundary behavior and can make the topology look wrong.

Lab: Protect the access layer

Topology

Dist1
Acc1
Acc2

Dist1 should be root for VLAN 10. Acc1 and Acc2 are access switches.

Task 1: Make Dist1 root

On Dist1:

spanning-tree mode rapid-pvst
spanning-tree vlan 10 root primary

On Acc1 and Acc2:

spanning-tree mode rapid-pvst

Verify on Acc1:

show spanning-tree vlan 10

Task 2: Protect access ports

On Acc1:

spanning-tree portfast default
spanning-tree portfast bpduguard default

Connect a test switch to an access port and observe BPDU Guard. Then remove the test switch and recover the port.

Task 3: Protect a distribution-facing downlink

On Dist1 downlink toward Acc1:

interface gi1/0/24
 spanning-tree guard root

Now make Acc1 try to become root:

spanning-tree vlan 10 priority 0

On Dist1:

show spanning-tree inconsistentports

You should see the protected port block the superior BPDU.

Exam traps

  • PortFast belongs on host-facing ports, not switch-to-switch trunks.
  • BPDU Guard usually err-disables the port.
  • Root Guard usually places the port into root-inconsistent state and can recover automatically.
  • MST region mismatch is caused by name, revision, or VLAN mapping mismatch.
  • RSTP uses roles like root, designated, alternate, and backup. Know what they mean.

Quick checklist

  1. Which switch is root for each VLAN or MST instance?
  2. Which ports are root, designated, alternate, or blocking/discarding?
  3. Are PortFast and BPDU Guard applied only where edge behavior is intended?
  4. Is Root Guard protecting access-facing or downstream ports?
  5. Are trunks carrying the VLANs you are checking?
  6. Does MST mapping match across switches?