Cisco CCNP Enterprise (ENCOR 350-401) · lesson 7 of 12 · 30 min
Why STP Still Matters at CCNP Level
Spanning Tree Protocol prevents Layer 2 loops in switched networks. At the CCNP level, you need to understand not just how STP works, but how to design it intentionally — controlling which switch is root, how fast convergence happens, and how to protect against misconfigurations and attacks.
STP Evolution: 802.1D → RSTP → MST
RSTP Port States and Roles
RSTP’s speed comes from the Alternate port — it’s pre-validated as loop-free and can take over the root port role in milliseconds. This is the key difference from 802.1D where a blocked port had to wait through Listening and Learning states.
MST: Multiple Spanning Tree
MST maps multiple VLANs to a smaller number of STP instances. Instead of running 100 separate PVST+ instances for 100 VLANs, you might run 3 MST instances — dramatically reducing CPU and memory overhead. MST Configuration spanning-tree mst configuration → name MYREGION → revision 1 → instance 1 vlan 10-20 → instance 2 vlan 30-40 → exit → spanning-tree mode mst
STP Protection Features
BPDU Guard and Root Guard are commonly confused. BPDU Guard protects PortFast ports from receiving any BPDUs (err-disables the port). Root Guard prevents a port from becoming a root port if it receives a superior BPDU (puts port in root-inconsistent state, not err-disabled).
Controlling Root Bridge Placement
Never leave root bridge election to chance. The switch with the lowest bridge priority wins. Default priority is 32768. Configure the primary root with priority 4096 and secondary root with 8192.
Flashcard Drill
RSTP Alternate port Pre-validated backup to the root port — takes over immediately if root port fails. No waiting through Listening/Learning. RSTP Edge port Connected to end devices — immediately transitions to Forwarding. Equivalent to PortFast. BPDU Guard Err-disables a PortFast port if any BPDU is received — prevents rogue switches from connecting. Root Guard Prevents a port from becoming a root port — puts it in root-inconsistent state if a superior BPDU arrives. Loop Guard Prevents a non-designated port from transitioning to Forwarding if BPDUs stop — protects against unidirectional link failures. MST region Switches with matching MST name, revision, and VLAN-instance mapping — they share the same MST topology. IST (Instance 0) MST default instance — carries all VLANs not explicitly mapped to other instances. STP priority multiple STP bridge priority must be a multiple of 4096 (0, 4096, 8192… 61440). PVST+ vs Rapid PVST+ PVST+ runs 802.1D per VLAN (slow). Rapid PVST+ runs 802.1w per VLAN (fast). Rapid PVST+ is the Cisco default.
Knowledge Check — 12 Questions
Advanced STP: RSTP, MST & Protection
What is the RSTP port role that serves as a pre-validated backup to the root port?
- Backup port
- Alternate port
- Edge port
- Designated port
Answer: Alternate port
The Alternate port is pre-validated as loop-free and can immediately take over as root port without going through Listening/Learning states.
Which STP protection feature err-disables a port if a BPDU is received?
- Root Guard
- Loop Guard
- BPDU Filter
- BPDU Guard
Answer: BPDU Guard
BPDU Guard err-disables a PortFast port immediately upon receiving any BPDU — prevents rogue switches from connecting to access ports.
What does Root Guard do when it receives a superior BPDU?
- Err-disables the port
- Puts the port in root-inconsistent state
- Ignores the BPDU
- Resets the STP topology
Answer: Puts the port in root-inconsistent state
Root Guard puts the port in root-inconsistent (blocking) state when a superior BPDU is received. The port recovers automatically when superior BPDUs stop.
STP bridge priority must be a multiple of _____.
Answer: 4096
STP bridge priority must be a multiple of 4096 (0, 4096, 8192, etc.) due to the extended system ID that includes the VLAN number.
What is the primary advantage of MST over Rapid PVST+?
- Faster convergence
- Fewer STP instances — reduces CPU and memory overhead
- Better loop prevention
- Supports more VLANs
Answer: Fewer STP instances — reduces CPU and memory overhead
MST maps multiple VLANs to fewer STP instances. Instead of 100 PVST+ instances for 100 VLANs, you might run 3 MST instances.
Which RSTP port state replaces both Blocking and Listening from 802.1D?
- Forwarding
- Learning
- Discarding
- Inactive
Answer: Discarding
RSTP combines 802.1D Blocking and Listening into a single Discarding state. RSTP has only 3 states: Discarding, Learning, Forwarding.
BPDU Filter on an interface stops both sending and receiving BPDUs.
- True
- False
Answer: True
BPDU Filter on an interface stops both sending and receiving BPDUs. This can cause loops if used incorrectly — use BPDU Guard instead for PortFast ports.
What three parameters must match for switches to be in the same MST region?
- Priority, VLAN list, revision
- Name, revision, VLAN-to-instance mapping
- Name, priority, hello time
- Region ID, VLAN list, bridge ID
Answer: Name, revision, VLAN-to-instance mapping
MST region membership requires matching: MST region name, revision number, and VLAN-to-instance mapping table.
Loop Guard protects against which type of failure?
- Rogue switch connections
- Root bridge misconfiguration
- Unidirectional link failures
- Broadcast storms
Answer: Unidirectional link failures
Loop Guard prevents a non-designated port from transitioning to Forwarding when BPDUs stop arriving — which can happen with unidirectional link failures.
What is the default STP bridge priority?
- 0
- 4096
- 32768
- 65535
Answer: 32768
The default STP bridge priority is 32768. Lower priority wins the root bridge election.
Which command sets a switch as the primary root bridge for VLAN 10?
- spanning-tree vlan 10 priority 0
- spanning-tree vlan 10 root primary
- spanning-tree vlan 10 root-bridge
- spanning-tree vlan 10 priority 32768
Answer: spanning-tree vlan 10 root primary
spanning-tree vlan 10 root primary is a macro that sets the priority to 24576 or lower than the current root bridge priority.
What is the MST default instance that carries all unmapped VLANs?
- Instance 1
- IST (Instance 0)
- CST
- CIST
Answer: IST (Instance 0)
The Internal Spanning Tree (IST) is MST Instance 0 — it carries all VLANs not explicitly mapped to other MST instances.
Previous lesson: BGP route filtering: prefix-lists, route-maps, communities, conditional advertisement
Back to Cisco CCNP Enterprise (ENCOR 350-401)
Next lesson: Wireless architecture: WLC, CAPWAP, FlexConnect, roaming (L2/L3), RRM