3.1.c Configure and verify common Spanning Tree Protocols (RSTP, MST) and Spanning Tree enhancements such as root guard and BPDU guard

What this objective tests

The objective says "configure and verify". The exam wants working configs and correct reading of show spanning-tree output.

Spanning Tree Protocol (STP) prevents Layer 2 loops. Each instance elects one root bridge. Every other switch finds its best path to the root. Extra links move to a non-forwarding role.

Four tools matter for ENCOR:

• Rapid PVST+: fast convergence, one instance per VLAN.
• Multiple Spanning Tree (MST): maps many VLANs to a few instances.
• Root Guard: stops a port from accepting a better root.
• BPDU Guard: err-disables an edge port that receives a Bridge Protocol Data Unit (BPDU).

Port roles

Example: Rapid PVST+ with BPDU Guard

DSW1 is the root for VLANs 10 and 20. ASW1 is an access switch with host ports.

DSW1:

spanning-tree mode rapid-pvst
spanning-tree vlan 10,20 root primary
!
interface GigabitEthernet1/0/1
 description Trunk to ASW1
 switchport mode trunk

ASW1:

spanning-tree mode rapid-pvst
spanning-tree portfast edge default
spanning-tree portfast edge bpduguard default
!
interface GigabitEthernet1/0/10
 description User PC
 switchport mode access
 switchport access vlan 10

BPDU Guard protects the edge assumption. If a switch appears on Gi1/0/10, the port moves to err-disabled. That is the correct result, not a fault.

Verify on ASW1:

ASW1# show spanning-tree vlan 10

VLAN0010
  Spanning tree enabled protocol rstp
  Root ID    Priority    24586
             Address     0cd9.96ad.4000
             Cost        4
             Port        1 (GigabitEthernet1/0/1)
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec

  Bridge ID  Priority    32778  (priority 32768 sys-id-ext 10)
             Address     5000.000a.0000
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec
             Aging Time  300 sec

Interface           Role Sts Cost      Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------------------
Gi1/0/1             Root FWD 4         128.1    P2p
Gi1/0/10            Desg FWD 4         128.10   P2p Edge

Correct output shows:

• The root bridge ID matches DSW1.
• The ASW1 root port is Gi1/0/1, toward DSW1.
• The host port is designated and marked Edge.

If a port is err-disabled, find the cause:

show interfaces status err-disabled

Remove the wrong device first. Then recover the port:

interface GigabitEthernet1/0/10
 shutdown
 no shutdown

Example: Root Guard on a downlink

Root Guard protects ports that face access switches. A superior BPDU on that port means a rogue switch claims to be root.

DSW1:

interface GigabitEthernet1/0/1
 description Trunk to ASW1
 spanning-tree guard root

If ASW1 sends a superior BPDU, DSW1 moves the port to root-inconsistent state. The port stops forwarding until the superior BPDUs stop. The port recovers by itself. It does not err-disable.

Verify:

DSW1# show spanning-tree inconsistentports

Name                 Interface                Inconsistency
-------------------- ------------------------ ------------------
VLAN0010             GigabitEthernet1/0/1     Root Inconsistent

Number of inconsistent ports (segments) in the system : 1

Note: Do not put Root Guard on the port toward the real root bridge. It can cause the outage it was meant to prevent.

Example: MST region with VLAN mapping

MST runs a few instances for many VLANs. All switches in a region must agree on three values: region name, revision number, and VLAN-to-instance mapping.

Map VLANs 10 and 20 to instance 1. Map VLANs 30 and 40 to instance 2. All other VLANs stay in instance 0.

All switches in the region:

spanning-tree mode mst
!
spanning-tree mst configuration
 name CAMPUS
 revision 1
 instance 1 vlan 10,20
 instance 2 vlan 30,40

DSW1 is the root for instance 1 and the backup root for instance 2:

spanning-tree mst 1 root primary
spanning-tree mst 2 root secondary

Verify the region:

SW1# show spanning-tree mst configuration
Name      [CAMPUS]
Revision  1     Instances configured 3

Instance  Vlans mapped
--------  ---------------------------------------------------------------------
0         1-9,11-19,21-29,31-39,41-4094
1         10,20
2         30,40
-------------------------------------------------------------------------------

If the name, revision, or mapping differs, the switches form separate regions. The boundary behavior changes and the topology looks wrong.

Check instance 1:

SW1# show spanning-tree mst 1

##### MST1    vlans mapped:   10,20
Bridge        address 5000.000a.0000  priority      32769 (32768 sysid 1)
Root          address 0cd9.96ad.4000  priority      24577 (24576 sysid 1)
              port    Gi1/0/1         path cost     0         rem hops 19

Interface        Role Sts Cost      Prio.Nbr Type
---------------- ---- --- --------- -------- --------------------------------
Gi1/0/1          Root FWD 20000     128.1    P2p
Gi1/0/2          Altn BLK 20000     128.2    P2p

Correct output shows the root for instance 1, the root port toward it, and the alternate port in blocking state.

Lab: build and protect RSTP

Topology:

[DSW1]
        /    \
   Gi1/0/1  Gi1/0/2
      /        \
   [ASW1]====[ASW2]
     |          |
    PC1        PC2  (VLAN 10)

Do these steps:

1. Create VLAN 10 on all switches. Configure all interconnect links as trunks.
2. Set spanning-tree mode rapid-pvst on all switches.
3. Make DSW1 the root: spanning-tree vlan 10 root primary.
4. Verify on ASW2 with show spanning-tree vlan 10. Find the root port and the alternate port.
5. Enable PortFast edge and BPDU Guard defaults on ASW1 and ASW2. Put the PC ports in VLAN 10.
6. Connect a test switch to an ASW1 host port. Confirm the port goes err-disabled. Remove the test switch. Recover the port.
7. Configure spanning-tree guard root on both DSW1 downlinks.
8. Set spanning-tree vlan 10 priority 0 on ASW1. Check show spanning-tree inconsistentports on DSW1.
9. Restore the ASW1 priority. Confirm the DSW1 port recovers.

Exam traps

• PortFast is for host ports. Never enable it on a switch-to-switch link.
• BPDU Guard err-disables the port. Root Guard sets root-inconsistent state and recovers by itself.
• An MST region match needs name, revision, and VLAN mapping. All three.
• root primary sets the priority lower than the current root. root secondary sets a backup value.
• RSTP port states are discarding, learning, and forwarding. Blocking is the old 802.1D term.

Pass check

You are ready when you can do these things:

• Read show spanning-tree output and name the root, the root port, and the port roles.
• Configure an MST region and prove the region matches on two switches.
• Explain what BPDU Guard does and how to recover the port.
• Explain what Root Guard does and where to apply it.