Spanning Tree Best Practices: RSTP, MSTP, and Layer 2 Hardening

Part 1 — STP Mode Selection

Always use RSTP (802.1w) or MSTP (802.1s) — never classic 802.1D STP. RSTP converges in 1–2 seconds versus 30–50 seconds of legacy STP.

SW1(config)# spanning-tree mode rapid-pvst
# rapid-pvst = RSTP per VLAN (most common in enterprise)

SW1(config)# spanning-tree mode mst
# mst = MSTP — use when managing many VLANs (groups them into instances)

SW1# show spanning-tree summary

Part 2 — Root Bridge Placement

Never let the network elect the root bridge. An access switch winning the election causes suboptimal traffic paths and congestion. Explicitly set priorities on distribution and core switches.

# Priority must be a multiple of 4096. Default = 32768.
DIST-SW1(config)# spanning-tree vlan 1-100 priority 4096
DIST-SW2(config)# spanning-tree vlan 1-100 priority 8192

# Or use the macro
DIST-SW1(config)# spanning-tree vlan 1-100 root primary
DIST-SW2(config)# spanning-tree vlan 1-100 root secondary

# Verify — look for "This bridge is the root"
SW1# show spanning-tree vlan 10

Part 3 — PortFast and Edge Ports

PortFast skips Listening/Learning states on access ports, eliminating the 30-second delay when end devices connect. Use only on ports connecting to end devices — never on trunk or uplink ports.

# Enable globally on all non-trunk ports (recommended)
SW1(config)# spanning-tree portfast default
SW1(config)# spanning-tree portfast bpduguard default

# Per-interface (for specific ports only)
SW1(config)# interface GigabitEthernet1/0/1
SW1(config-if)#  spanning-tree portfast
SW1(config-if)#  spanning-tree bpduguard enable

Part 4 — Layer 2 Protection Features

BPDU Guard

Shuts down an access port if it receives a BPDU — prevents rogue switches from being plugged into access ports and disrupting the STP topology.

SW1(config)# spanning-tree portfast bpduguard default

# Auto-recover err-disabled ports after 5 minutes
SW1(config)# errdisable recovery cause bpduguard
SW1(config)# errdisable recovery interval 300

SW1# show interfaces status err-disabled

Root Guard

Prevents a port from becoming a Root Port — protects the designated root from being displaced by a downstream switch with a lower priority.

# Apply on distribution ports facing access layer
DIST-SW1(config)# interface GigabitEthernet1/0/10
DIST-SW1(config-if)#  spanning-tree guard root

SW1# show spanning-tree inconsistentports

Loop Guard

Prevents a blocked port from transitioning to Forwarding when BPDUs stop arriving due to a unidirectional link failure — a scenario BPDU Guard cannot catch.

# Enable globally on all switch-to-switch links (recommended)
SW1(config)# spanning-tree loopguard default

# Note: Loop Guard and Root Guard are mutually exclusive on the same port

Part 5 — MSTP for Multi-VLAN Environments

MSTP groups VLANs into instances, reducing STP process count and enabling load balancing across redundant uplinks. Use when managing more than 20–30 VLANs.

SW1(config)# spanning-tree mode mst
SW1(config)# spanning-tree mst configuration
SW1(config-mst)#  name CAMPUS-MST
SW1(config-mst)#  revision 1
SW1(config-mst)#  instance 1 vlan 10,20,30,40,50
SW1(config-mst)#  instance 2 vlan 60,70,80,90,100

# Load balance — each switch is root for half the instances
DIST-SW1(config)# spanning-tree mst 1 priority 4096
DIST-SW1(config)# spanning-tree mst 2 priority 8192
DIST-SW2(config)# spanning-tree mst 1 priority 8192
DIST-SW2(config)# spanning-tree mst 2 priority 4096

Part 6 — Troubleshooting STP

SW1# show spanning-tree vlan 10
SW1# show spanning-tree vlan 10 detail
SW1# show spanning-tree vlan 10 interface GigabitEthernet1/0/24

# High topology change counts = instability — find the source
SW1# show spanning-tree detail | include topology change|occurs

# Find which port is triggering topology changes
SW1# show spanning-tree vlan 10 | include from

# Debug STP events (use carefully in production)
SW1# debug spanning-tree events
SW1# no debug all

Quick Reference — Port Roles and States