STP ו־RSTP: בחירת Root Bridge ותפקידי פורטים

How switches prevent loops, who is elected Root, and how to read show spanning-tree.

Analogy: Imagine three rooms connected by three corridors in a circle. Without a clear rule, a message would circulate in the loop forever. STP closes one corridor and keeps it as a reserve — if an active corridor is blocked, the reserve one opens.

Bridge ID is priority plus MAC address and the lowest value wins, so SW1 with priority 4096 becomes root. SW2 and SW3 each pick the lowest-cost port toward the root as their root port, and the link between them is blocked to break the loop. Port roles: designated (one per segment), root (path to the root) and blocking (standby). RSTP speeds up convergence; PortFast plus BPDU Guard belong on access ports.

How the Root Bridge is elected

Each switch sends a BPDU with Bridge ID = Priority (default 32768) + MAC Address.
The switch with the lowest Bridge ID becomes the Root Bridge.
If the Priority is identical — the lower MAC address wins (usually the oldest switch — not desirable!).
Root Port — The port with the lowest cost to the Root, one on each non-Root switch.
Designated Port — One active port on each network segment.
Blocking / Alternate Port — The redundant port that is blocked to prevent a loop.

! Force the core switch to be Root
Switch(config)# spanning-tree vlan 10,20 root primary
Switch(config)# spanning-tree vlan 10,20 priority 4096

! User ports — immediate transition to Forwarding + protection
Switch(config-if)# spanning-tree portfast
Switch(config-if)# spanning-tree bpduguard enable

! Faster mode (RSTP) — convergence in seconds instead of ~50 seconds
Switch(config)# spanning-tree mode rapid-pvst

! Checks
Switch# show spanning-tree vlan 10
Switch# show spanning-tree root
Switch# show spanning-tree interface gi0/1 detail

bash

Architecture and Theory — Under the Hood

Without STP, a physical loop between switches creates a Broadcast Storm that takes down the network within seconds. STP elects a Root Bridge, calculates the cheapest path to it, and blocks other links.

Bridge ID = Priority (4096 steps) + VLAN ID + MAC
Root election: Lowest wins (priority, and if equal - MAC)

        [ROOT SW1]
        /        \
   Root Port    Root Port
   [SW2] ---- BLOCKED ---- [SW3]

text

Port roles: Root Port (cheapest path to the Root), Designated Port (one per segment), Blocking/Alternate.
Cost by speed: 10G=2, 1G=4, 100M=19, 10M=100.
Standard STP (802.1D): 30-50 seconds convergence. RSTP (802.1w): less than a second.
PortFast: User port immediately goes to Forwarding; BPDU Guard disables it if a BPDU is received (signaling a switch connection).

Practical Configuration (CLI)

! Forcing Expected Root
SW1(config)# spanning-tree mode rapid-pvst
SW1(config)# spanning-tree vlan 10,20 root primary
SW2(config)# spanning-tree vlan 10,20 root secondary
! Or manually
SW1(config)# spanning-tree vlan 10 priority 4096

! Protections on user ports
SW(config)# interface range gi0/2-20
SW(config-if-range)# spanning-tree portfast
SW(config-if-range)# spanning-tree bpduguard enable
! On ports towards switches that should not be Root
SW(config-if)# spanning-tree guard root

bash

Real-world Scenarios in the Organization

The Root Bridge should be the central switch (Core/Distribution) — not a random access switch.
PortFast + BPDU Guard on all user ports, in every organization, always.
When upgrading infrastructure, verify the Root in advance to prevent traffic from taking a circuitous route.

Troubleshooting

SW# show spanning-tree
SW# show spanning-tree vlan 10
SW# show spanning-tree root
SW# show spanning-tree interface gi0/1 detail
SW# show interfaces status err-disabled

bash

Slow and suddenly 'stuck' network → Broadcast Storm; look for a loop and check if STP is active.
Unexpected Root Bridge → someone connected an old switch; set manual priority and enable Root Guard.
Port in err-disabled with BPDUGuard → a switch was connected to a user port.
Slow convergence → still 802.1D; switch to rapid-pvst.

Glossary and Quick Command Line

Bridge Priority default 32768, increments of 4096
802.1D states: Blocking → Listening → Learning → Forwarding
RSTP roles: Root, Designated, Alternate, Backup
spanning-tree portfast + bpduguard = mandatory on edge ports

STP and RSTP: Root Bridge Election and Port Roles

What you will learn here

Root Bridge Election and Port Roles

How the Root Bridge is elected

Check yourself