Spanning Tree Cheat Sheet

01 STP essentials

Spanning Tree Protocol (STP) prevents Layer 2 switching loops by selecting a loop-free forwarding topology. Redundant Ethernet links remain physically present, but some logical paths discard traffic. A topology change can activate an alternate path.

02 Root bridge, port roles and failover

The root bridge is the switch with the lowest bridge ID (priority plus extended system ID plus MAC address). Each non-root switch chooses one root port with the lowest total path cost. Every segment has a designated port; redundant paths can become alternate/discarding ports.

Use the same path-cost method on every switch (spanning-tree pathcost method long if you need to distinguish links faster than 10 Gb/s).

If SW3 loses its forwarding link to SW1, RSTP can rapidly transition its alternate port toward SW2. Actual convergence depends on topology and platform behavior.

03 Per-VLAN load balancing

Configure SW1 as root for VLAN 10 and SW2 as root for VLAN 20. This gives different VLANs different preferred Layer 2 roots. Plan gateway placement and uplink utilization together; a root bridge is not automatically the default gateway.

! SW1
conf t
spanning-tree mode rapid-pvst
spanning-tree vlan 10 priority 4096
spanning-tree vlan 20 priority 8192
end
! SW2
conf t
spanning-tree mode rapid-pvst
spanning-tree vlan 10 priority 8192
spanning-tree vlan 20 priority 4096
end

04 Edge protection and trunk hardening

Use PortFast only on verified endpoint-facing ports. BPDU Guard shuts down an edge port that receives an unexpected BPDU, helping contain accidental loops and rogue switches. Root Guard protects a designated port from an unexpected superior root advertisement. Loop Guard protects non-designated/root path conditions when BPDUs disappear.

! Confirm these are host-only access ports
interface range GigabitEthernet1/0/10-24
 switchport mode access
 spanning-tree portfast
 spanning-tree bpduguard enable
! Designated downlink to an access switch, not an uplink to root
interface GigabitEthernet1/0/3
 spanning-tree guard root
! Optional network-wide loop protection (validate design first)
spanning-tree loopguard default

05 MST configuration and region consistency

MST maps many VLANs to a small number of spanning-tree instances. Switches in the same MST region must match region name, revision, and VLAN-to-instance mappings. A mismatch creates a boundary and can produce surprising forwarding behavior.

spanning-tree mode mst
spanning-tree mst configuration
 name MAG212-CAMPUS
 revision 5
 instance 1 vlan 10,30
 instance 2 vlan 20,40
 exit
spanning-tree mst 1 priority 4096
spanning-tree mst 2 priority 8192
! Verify
show spanning-tree mst configuration
show spanning-tree mst detail

06 Critical verification commands

SW3# show spanning-tree vlan 10
VLAN0010
  Root ID    Priority    4106
             Address     0011.2233.4400
             Cost        4
             Port        1 (Gi1/0/1)
  Bridge ID  Priority    32778
Interface           Role Sts Cost
Gi1/0/1            Root FWD 4
Gi1/0/2            Altn BLK 4

07 Troubleshooting playbook

Change-control sequence: capture baseline, change one switch or VLAN group at a time, verify root IDs and port roles, then simulate one approved link failure during a maintenance window.

08 Practice Q&A

09 Sources & further reading

This is an original MAG212 CYBER guide: all diagrams, examples and explanations were written independently. The topic coverage was inspired by the classic PacketLife.net Spanning Tree cheat sheet.

Standards and vendor references: IEEE 802.1D (STP), 802.1w (RSTP) and 802.1s/802.1Q (MST); Cisco — Understanding Rapid Spanning Tree Protocol (802.1w); Cisco — Troubleshoot STP Problems and Related Design Considerations. Verify syntax against your platform and software release before applying changes.