STP and Its Variants: Loop-Free Design

STP (Spanning Tree Protocol) is the long-established protocol introduced in 1990 to prevent L2 loops in redundant networks. It has several variants: STP, RSTP, MST, and PVST+. In 2026, it remains widely deployed at the access and aggregation layers of campus networks despite the emergence of EVPN-VXLAN. This guide covers the variants, best practices, and troubleshooting.

The Problem STP Solves

Without STP, 2 redundant links between 2 switches create a catastrophic L2 loop:

• Broadcast storm: every broadcast is retransmitted indefinitely
• MAC table instability: the same MAC is detected on multiple ports
• Result: the switch is overloaded in <1 minute and the network goes down

STP Variants

Classic STP (802.1D, 1990)

• Convergence: 30-50 seconds (listening → learning → forwarding)
• 1 spanning-tree instance for all VLANs
• Obsolete; do not use

RSTP (Rapid STP, 802.1w, 2001)

• Convergence: 1-3 seconds
• Port roles: Root, Designated, Alternate, Backup
• Proposal/Agreement mechanism for rapid convergence
• Replaces classic STP

MSTP (Multiple STP, 802.1s, 2002)

• VLAN groups mapped to STP instances
• Up to 64 instances per MST region
• VLAN-based load balancing (e.g., VLAN 10-50 on Switch A and VLAN 51-100 on Switch B)
• Multi-vendor standard

PVST+ / Rapid-PVST+ (Cisco proprietary)

• 1 STP instance per VLAN (Per-VLAN Spanning Tree)
• Highly flexible but CPU-intensive at scale
• Cisco-only compatibility

RSTP Port Roles

• Root port (RP): points toward the root bridge, with 1 per non-root switch
• Designated port (DP): forwards on each segment, with 1 per segment
• Alternate port: backup for the root port (forwards immediately if the RP fails)
• Backup port: backup for the designated port

Root bridge: the central switch

• Elected by priority (default 32768) + MAC (tiebreaker)
• Priority can be configured in increments of 4096
• Best practice: set the priority explicitly on the core switch (priority 8192)
• Secondary root: 2nd core with priority 16384
• NEVER leave the default priority—a switch at the access layer could become the root!

Cisco Configuration Best Practices

• spanning-tree mode rapid-pvst (or mst for multi-vendor environments)
• spanning-tree vlan 1-4094 priority 8192 (on the primary core)
• spanning-tree vlan 1-4094 priority 16384 (on the secondary core)
• interface range gi1/0/1-48 ; spanning-tree portfast: endpoint ports
• interface range gi1/0/1-48 ; spanning-tree bpduguard enable: security
• spanning-tree loopguard default: protection against unidirectional links
• spanning-tree bpduguard default (alternative global mode)

PortFast + BPDU Guard

Mandatory combination on endpoint access ports:

• PortFast: places the port in the forwarding state immediately (skips listening/learning)
• BPDU Guard: places the port in err-disable state if a BPDU is received (a user connected a switch!)
• Prevents accidental loops caused by a user connecting a consumer-grade switch
• Reactivation: errdisable recovery cause bpduguard + timeout

Root Guard

• Prevents a neighboring switch from becoming the root
• Configuration: interface gi1/0/48 ; spanning-tree guard root
• Apply on ports connected to switches that are not designated core/aggregation switches

Loop Guard vs. UDLD

• Loop Guard: prevents loops on one-way optical links
• UDLD (Unidirectional Link Detection): active detection through hello packets
• Recommended on fiber links: aggressive UDLD + Loop Guard

Typical Campus STP Design

• Core = primary root (priority 8192) + secondary root (16384)
• Distribution: forwards all VLANs
• Access: endpoint ports configured with PortFast + BPDU Guard
• VLAN load balancing: PVST+ or MST with 2 instances

Evolution Beyond STP

• SD-Access: LISP/VXLAN fabric with no STP
• EVPN-VXLAN campus: routed access with no STP on uplinks
• MLAG/VSS: 2 switches grouped as 1 logical switch, with no inter-switch STP
• Cisco StackWise Virtual: 2 Catalyst 9500 switches operate as 1, with no STP between them

Troubleshooting

• show spanning-tree: global status
• show spanning-tree vlan 10 detail: instance details
• show spanning-tree bridge: local priority
• show spanning-tree inconsistentports: ports in BPDU-related err-disable state
• show errdisable recovery: recovery configuration
• debug spanning-tree events (use caution in production)

Order from OPTINOC

Campus STP design or migration to routed access/SD-Access. Catalyst 9300 switches configured according to PortFast/BPDU Guard best practices. Complimentary STP audit. Quote within 48h.