By default, in Cisco Catalyst switches, a single STP instance is enabled for each configured VLAN. This is referred to as Per VLAN Spanning Tree Plus (PVST+), which simply means a single Spanning Tree instance for every individual VLAN.
NOTE: PVST+ is a Cisco proprietary protocol that supports 802.1Q. It is an extension of PVST, which is also a Cisco proprietary protocol that supports ISL. PVST is described in detail in the CCNA guide. There is no explicit configuration command required to enable PVST+. A sample PVST+ frame is illustrated in Figure 3-42 below:
Fig. 3-42. PVST+ Frame Format
Configuring the Spanning Tree Root Bridge
Root Bridge election can be influenced by administrators in one of two ways:
- By manually configuring the Bridge Priority
- By using the macro available in Cisco IOS software
In Cisco IOS software, administrators can manually configure the Bridge Priority of the switch they want to become elected Root Bridge via the spanning-tree vlan [number] priority [number] global configuration command. The switch with the highest priority will be elected Root Bridge for that particular VLAN. The priority value must be configured in increments of 4,096, with 0 being the lowest possible value and 61,440 being the highest possible value. The following output illustrates how to configure a switch as the Root Bridge for standard VLAN 80:
| VTP-Switch-1#config t Enter configuration commands, one per line. End with CNTL/Z. VTP-Switch-1(config)#spanning-tree vlan 80 priority 0 VTP-Switch-1(config)#exit |
The show spanning-tree vlan [number] [detail] command can be used to validate the Root Bridge configuration as illustrated in the following output:
| VTP-Switch-1#show spanning-tree vlan 80 detailVLAN0080 is executing the ieee compatible Spanning Tree protocol Bridge Identifier has priority 0, sysid 80, address 000d.bd06.4100 Configured hello time 2, max age 20, forward delay 15 We are the root of the spanning tree Topology change flag not set, detected flag not set Number of topology changes 1 last change occurred 00:24:30 ago from FastEthernet0/1 Times: hold 1, topology change 35, notification 2 hello 2, max age 20, forward delay 15 Timers: hello 1, topology change 0, notification 0, aging 300 … … [Truncated Output] |
There is a macro available in Cisco IOS software that allows the software to configure dynamically the priority of the Root Bridge or secondary (backup) Root Bridge. The Root Bridge is configured dynamically via the spanning-tree vlan [number] root [primary|secondary] global configuration command. When this command is executed using the [primary] keyword, Cisco IOS software checks the switch priority of the current Root Switch for the specified VLAN.
Because of the extended system ID support, the switch sets the switch priority for the specified VLAN to 24,576 if this value will cause this switch to become the Root Bridge for the specified VLAN. However, if the Root Switch for the specified VLAN has a priority lower than 24,576, the switch sets its own priority for the specified VLAN to 4,096 less than the lowest switch priority. This continues until the switch has a lower priority than the current Root Bridge and is itself elected Root Bridge.
To demonstrate how this Cisco IOS macro works, we will use the topology in Figure 3-43 below:
Fig. 3-43. Configuring the Root Bridge Using the Cisco IOS Macro
In Figure 3-43, Switch 1 and Switch 2 are connected via their respective FastEthernet0/1 ports. Both of the switches reside in the same VTP domain and a trunk has been successfully configured between the two. Both switches are configured as VTP servers. VLAN 10 is configured and because the Bridge Priority values are the same (32,768), Switch 2 is elected Root Bridge because it has a lower MAC address. This is reflected in the show spanning-tree vlan [number] command on Switch 1 as illustrated in the following output:
| VTP-Switch-1#show spanning-tree vlan 10VLAN0010 Spanning tree enabled protocol ieee Root ID Priority 32768 Address 0005.32f5.5b01 Cost 19 Port 1 (FastEthernet0/1) Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Bridge ID Priority 32778 (priority 32768 sys-id-ext 10) Address 000d.bd06.4100 Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Aging Time 300 Interface Role Sts Cost Prio.Nbr Type |
The spanning-tree vlan 10 root primary command is executed on Switch 1 to allow Cisco IOS software to dynamically configure Switch 1 to become the Root Bridge for this VLAN. This is illustrated in the following output:
| VTP-Switch-1#conf t Enter configuration commands, one per line. End with CNTL/Z. VTP-Switch-1(config)#spanning-tree vlan 10 root primary VTP-Switch-1(config)#exit |
Once executed, the show spanning-tree vlan 10 command is used to validate that this switch that has now been elected Root Bridge, as shown in the following output:
| VTP-Switch-1#show spanning-tree vlan 10VLAN0010 Spanning tree enabled protocol ieee Root ID Priority 24586 Address 000d.bd06.4100 This bridge is the root Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Bridge ID Priority 24586 (priority 24576 sys-id-ext 10) Address 000d.bd06.4100 Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Aging Time 15 Interface Role Sts Cost Prio.Nbr Type |
In the output above, we can see that the priority for the VLAN has been set to 24,576 and this switch is elected Root Bridge. Now, suppose Switch 2 was manually configured in the manner illustrated in the following output:
| VTP-Switch-2#conf t Enter configuration commands, one per line. End with CNTL/Z. VTP-Switch-2(config)#spanning-tree vlan 10 priority 8192 VTP-Switch-2(config)#exit |
The result of this manual change is that Switch 2 becomes the Root Bridge for this VLAN. This is because the macro works only once. In other words, the Cisco IOS macro works only once, each time it is executed, and does not continually check to see if any other switches have had their priority values changed so that it can adjust the local switch priority accordingly in order to ensure that it remains the Root Bridge. Switch 1 retains the priority value set by the macro but is now no longer the Root Bridge for VLAN 10, as shown in the following output:
| VTP-Switch-1#show spanning-tree vlan 10VLAN0010 Spanning tree enabled protocol ieee Root ID Priority 8192 Address 0005.32f5.5b01 Cost 19 Port 1 (FastEthernet0/1) Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Bridge ID Priority 24586 (priority 24576 sys-id-ext 10) Address 000d.bd06.4100 Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Aging Time 15 Interface Role Sts Cost Prio.Nbr Type |
To configure Switch 1 as the Root Bridge, the macro command must be entered again. This is illustrated in the following output:
| VTP-Switch-1#conf t Enter configuration commands, one per line. End with CNTL/Z. VTP-Switch-1(config)#spanning-tree vlan 10 root primary VTP-Switch-1(config)#exit |
The priority is lowered by 4,096 and Switch 1 becomes Root Bridge for VLAN 10 again. This is shown in the following output:
| VTP-Switch-1#show spanning-tree vlan 10VLAN0010 Spanning tree enabled protocol ieee Root ID Priority 4106 Address 000d.bd06.4100 This bridge is the root Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Bridge ID Priority 4106 (priority 4096 sys-id-ext 10) Address 000d.bd06.4100 Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Aging Time 15 … [Truncated Output] |
When the spanning-tree vlan [number] root secondary command is executed, the software changes the switch priority from the default value of 32,768 to 28,672. Assuming all defaults, this value would be the next best priority value in the Spanning Tree domain, after the value of 24,576 that is assigned to the Root Bridge by thespanning-tree vlan [number] root primary command. If the Root Bridge should fail, this switch becomes the next Root Bridge.
Configuring the Spanning Tree Port Cost
The Root Path Cost value is contained in the STP BPDU. This value is calculated using the Path Cost. Administrators can adjust the Spanning Tree port cost to allow for load balancing between different links within the Spanning Tree domain. In Figure 3-44 below, Switch 1 and Switch 2 reside within the same STP domain. The switches have two links between them, FastEthernet0/1 and FastEthernet0/2. VLAN 20 is configured on both switches (VTP servers) and Switch 2 is elected Root Bridge for the VLAN.
Fig. 3-44. Configuring the Spanning Tree Port Cost
By default, GigabitEthernet0/1 will be placed into a Forwarding state by Switch 1 because this port has a lower cost value (4) than that of the FastEthernet0/1 interface (19). The spanning-tree vlan [number] cost [value]interface configuration command can be used to manipulate the interface that is placed into the Forwarding state by STP for a specified VLAN. For example, the cost on port FastEthernet 0/1 can be lowered to a value less than 4, making it preferred over GigabitEthernet0/1 for all traffic in VLAN 20. This would be implemented using the configuration commands shown in the following output:
| VTP-Switch-1(config)#interface fastethernet 0/1 VTP-Switch-1(config-if)#spanning-tree vlan 20 cost 1 VTP-Switch-1(config-if)#exit |
The lower cost value assigned to FastEthernet0/1 means that it is moved into a Forwarding state for VLAN 20 while GigabitEthernet0/1 is moved into the Blocking state for VLAN 20. This configuration can be validated by using the show spanning-tree vlan [number] command as illustrated in the following output:
| VTP-Switch-1#show spanning-tree vlan 20VLAN0020 Spanning tree enabled protocol ieee Root ID Priority 32768 Address 0005.32f5.5b02 Cost 1 Port 1 (FastEthernet0/1) Hello Time 2 sec Max Age 20 sec Forward Delay 15 secBridge ID Priority 32788 (priority 32768 sys-id-ext 20) Address 000d.bd06.4100 Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Aging Time 300 Interface Role Sts Cost Prio.Nbr Type |
Although FastEthernet0/1 is elected Root Port for VLAN 20, GigabitEthernet0/1 is still elected as the Root Port for all other VLANs because the port cost for those VLANs has not been modified. This is shown in the following output:
| VTP-Switch-1#show spanning-tree vlan 40VLAN0040 Spanning tree enabled protocol ieee Root ID Priority 32768 Address 0005.32f5.5b04 Cost 4 Port 25 (GigabitEthernet0/1) Hello Time 2 sec Max Age 20 sec Forward Delay 15 secBridge ID Priority 32808 (priority 32768 sys-id-ext 40) Address 000d.bd06.4100 Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Aging Time 300 Interface Role Sts Cost Prio.Nbr Type |
In addition to manipulating the cost value for individual VLANs, Cisco IOS software allows administrators to manipulate the interfaces via which all VLAN traffic is forwarded. This is performed by issuing the spanning-tree cost [number] interface configuration command on the desired interface. This is illustrated in the following output:
| VTP-Switch-1(config)#interface fastethernet 0/1 VTP-Switch-1(config-if)#spanning-tree cost 1 VTP-Switch-1(config-if)#exit |
Based on this configuration, FastEthernet0/1 would be elected Root Port for all VLANs and port GigabitEthernet0/1 would be placed into a Blocking state.
Changing the cost value is not typically recommended as this does have an effect on the entire Spanning Tree domain. By default, when a Switch receives a BPDU, it adds its local cost value to the received Root Path Cost value before propagating it downstream. If this cost value is incorrect, then the Spanning Tree network might not be able to select the most optimal path. Consider the network topology illustrated in Figure 3-45 below:
Fig. 3-45. Understanding the Effects of Changing the STP Port Cost
Figure 3-45 shows four switches in a network. Based on the inter-switch links, STP will proceed and elect the following Root Ports on the switches:
- Switch 4 – Interface GigabitEthernet0/1 (Root Path Cost of 12)
- Switch 3 – Interface GigabitEthernet0/2 (Root Path Cost of 8)
- Switch 2 – Interface GigabitEthernet0/1 (Root Path Cost of 4)
NOTE: FastEthernet has a Spanning Tree cost of 19, so the Root Path Cost via FastEthernet0/1 on Switch 4 would be 0 + 19, which equals 19, whereas the Root Path Cost via GigabitEthernet0/1 is 0 + 4 + 4 + 4 = 12. This value is better than 19, so GigabitEthernet0/1 wins.
If the port cost on Switch 4 was changed to force it to use port FastEthernet0/1 as the Root Port interface instead, this would impact the entire Spanning Tree topology. For example, the cost for FastEthernet0/1 is changed to 1 for all VLANs as illustrated in the following output:
| VTP-Switch-4(config)#interface fastethernet 0/1 VTP-Switch-4(config-if)#spanning-tree cost 1 VTP-Switch-4(config-if)#exit |
This Path Cost value results in a Root Path Cost of 1 for FastEthernet0/1. This BPDU shows a Root Path Cost of 1 from Switch 4 as illustrated in Figure 3-46 below:
Fig. 3-46. Verifying the Spanning Tree Port Cost (Contd.)
Switch 4 propagates the BPDU to Switch 4 and STP then selects the following Root Ports for each Switch:
- Switch 4 – Interface FastEthernet0/1 (New Root Path Cost of 1)
- Switch 3 – Interface GigabitEthernet0/1 (Root Path Cost of 5)
- Switch 2 – Interface GigabitEthernet0/1 (Root Path Cost of 4)
The Spanning Tree network topology is recalculated and changed as shown in Figure 4-47 below:
Fig. 3-47. Understanding the Effects of Changing the STP Port Cost (Contd.)
Naturally, this is a suboptimal path because a FastEthernet interface has less bandwidth than GigabitEthernet interface; however, because the cost values have been changed, the Spanning Tree calculation deems this the best (least cost) path to the Root Bridge. It is very important to understand the network topology before manipulating Spanning Tree cost values.
Earlier in this chapter, it was stated that the port cost should only be configured on the Root Bridge. This is because port cost is the Path Cost. It is used in the calculation of the Root Path Cost, which leads to the election of the Root Port. The Root Bridge originates BPDUs and there is no Root Port on the Root Bridge. In other words, the Root Bridge will never receive a BPDU from another switch and needs to determine which path to use to get to the Root Bridge, because it is the Root already. |
Configuring the Spanning Tree Port Priority
In the event that ports have the same cost value, the port priority is used as a tiebreaker to determine which port will be placed into the Forwarding state. This priority is locally significant for the connection between two switches and has no effect on the remainder of the Spanning Tree domain. Figure 3-48 below will be used to illustrate this concept.
Fig. 3-48. Manipulating the Default Spanning Tree Port Priority
In Figure 3-48, Switch 1 and Switch 2 are connected using two FastEthernet links. Switch 2 is the Root Bridge for VLAN 20. By default, Switch 1 places port FastEthernet0/1 into the Forwarding state because it is the port that has the lower port ID. Remember, as stated earlier, the port ID is comprised of the port priority and the port number. This concept is illustrated in the following output:
| VTP-Switch-1#show spanning-tree vlan 20VLAN0020 Spanning tree enabled protocol ieee Root ID Priority 32768 Address 0005.32f5.5b02 Cost 19 Port 1 (FastEthernet0/1) Hello Time 2 sec Max Age 20 sec Forward Delay 15 secBridge ID Priority 32788 (priority 32768 sys-id-ext 20) Address 000d.bd06.4100 Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Aging Time 300 Interface Role Sts Cost Prio.Nbr Type |
Switch 1 places FastEthernet0/1 into the Forwarding state because the port ID of FastEthernet0/1 (128.1) is lower than that of FastEthernet0/2 (128.2). The tiebreaker values used are as follows:
- Lowest Root Bridge ID – The BPDUs are originated from the same switch; this is equal
- Lowest Root Path Cost to Root Bridge – Both ports are FastEthernet; this is equal
- Lowest Sender Bridge ID – The BPDUs are originated from the same switch; this is equal
- Lowest Sender Port ID – The PID of Fa0/1 is 128.1; the PID of Fa0/2 is 128.2. Fa0/1 is better
The spanning-tree vlan [number] port-priority [value] interface configuration command can be used to manipulate the port that Spanning Tree places into the Forwarding state when multiple equal cost paths exist between two switches. However, this must be done on the switch sending the BPDUs, effectively influencing the inbound path of the remote switch. The higher the priority (which is the lower numerical value) the more preferred the BPDU.
As an example, the priority of FastEthernet0/2 can be changed to 96 on Switch 2 to influence Switch 1 to place FastEthernet0/2 into the Forwarding state for VLAN 20 as illustrated in the following output:
| VTP-Switch-2#conf t Enter configuration commands, one per line. End with CNTL/Z. VTP-Switch-2(config)#interface fastethernet 0/2 VTP-Switch-2(config-if)#spanning-tree vlan 20 port-priority 96 VTP-Switch-2(config-if)#exit |
NOTE: The priority value is entered in increments of 16, as stated earlier in this chapter.
The result of this configuration changes the election process as follows:
- Lowest Root Bridge ID – The BPDUs are originated from the same switch; this is equal
- Lowest Root Path Cost to Root Bridge – Both ports are FastEthernet; this is equal
- Lowest Sender Bridge ID – The BPDUs are originated from the same switch; this is equal
- Lowest Sender Port ID – The PID of Fa0/1 is 128.1, the PID of Fa0/2 is 96.2. Fa0/2 is better
This result is reflected on Switch 1, which has now placed FastEthernet0/2 into a Forwarding state for VLAN 20. Port FastEthernet0/1 is placed into a Blocking state. This is illustrated in the following output:
| VTP-Switch-1#show spanning-tree vlan 20VLAN0020 Spanning tree enabled protocol ieee Root ID Priority 32768 Address 0005.32f5.5b02 Cost 19 Port 2 (FastEthernet0/2) Hello Time 2 sec Max Age 20 sec Forward Delay 15 secBridge ID Priority 32788 (priority 32768 sys-id-ext 20) Address 000d.bd06.4100 Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Aging Time 300 Interface Role Sts Cost Prio.Nbr Type |
NOTE: You will not see the priority value configured on the remote switch (Switch 2) on the local switch (Switch 1). This is used in the internal STP calculation and is not reflected in the show spanning-tree vlan [number]output.
Adjusting Spanning Tree Timers
The Spanning Tree timers (which should never be changed without due cause) can be adjusted in global configuration mode via the spanning-tree vlan [number] [forward-time| hello-time| max-age] global configuration command. These values should always be adjusted on the Root Bridge, which will then send them out in the Configuration BPDUs. These options are illustrated in the following output:
| Root-Bridge(config)#spanning-tree vlan 10 ? forward-time Set the forward delay for the spanning tree hello-time Set the hello interval for the spanning tree max-age Set the max age interval for the spanning tree |
Adjusting the Spanning Tree timers requires careful thought and consideration because they are used in the calculation of the Spanning Tree diameter. The following output illustrates how to change the Spanning Tree Hello Time interval to 1 second for a specified VLAN:
| Root-Bridge#conf t Enter configuration commands, one per line. End with CNTL/Z. Root-Bridge(config)#spanning-tree vlan 10 hello-time 1 Root-Bridge(config)#exit |
NOTE: These values should always be changed on the Root Bridge.
Once adjusted, the show spanning-tree vlan [number] command can be used to verify the timers set on the Root Bridge. The following output shows the Hello Time change implemented on the Root Bridge reflected on a Non-Root Bridge in the Spanning Tree domain:
| VTP-Client-Switch-1#show spanning-tree vlan 10VLAN0010 Spanning tree enabled protocol ieee Root ID Priority 8192 Address 0005.32f5.5b01 Cost 19 Port 1 (FastEthernet0/1) Hello Time 1 sec Max Age 20 sec Forward Delay 15 secBridge ID Priority 32778 (priority 32768 sys-id-ext 10) Address 000d.bd06.4100 Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Aging Time 300 Interface Role Sts Cost Prio.Nbr Type |
NOTE: In the output above, the Hello Time from the Root Bridge is used; however, we can also see that the switch has its own locally set values. These values are not used in relayed BPDUs.
Changing the Spanning Tree Diameter
As is the case with Spanning Tree timers, changing the Spanning Tree Protocol diameter is not recommended without just cause or guidance from the Cisco TAC. However, in the event that the diameter does need to be changed, this can be performed via the spanning-tree vlan [number] root [primary|secondary] diameter [value] global configuration command on either the Root Bridge or backup Root Bridge for a specified VLAN. The following output shows how to change the default Spanning Tree diameter to 2 on the Root Bridge:
| VTP-Switch-1#conf t Enter configuration commands, one per line. End with CNTL/Z. VTP-Switch-1(config)#spanning-tree vlan 80 root primary diameter 2 VTP-Switch-1(config)#exit |
By default, when the diameter is changed, Cisco IOS software automatically calculates the appropriate values for the Hello Time, Forward Delay, and Max Age timers. These dynamic changes are illustrated in the following output:
| VTP-Switch-1#show spanning-tree vlan 80VLAN0080 Spanning tree enabled protocol ieee Root ID Priority 80 Address 000d.bd06.4100 This bridge is the root Hello Time 2 sec Max Age 10 sec Forward Delay 7 secBridge ID Priority 80 (priority 0 sys-id-ext 80) Address 000d.bd06.4100 Hello Time 2 sec Max Age 10 sec Forward Delay 7 sec Aging Time 300 … [Truncated Output] |
These changes are propagated in all BPDUs sent out by the Root Bridge. Figure 3-49 below illustrates an STP BDPU that reflects the adjusted timer values:
Fig. 3-49. STP BPDU Parameters after Changing the STP Diameter
NOTE: After you change the diameter, you can also use the spanning-tree vlan [number] hello-time [seconds]command to reduce the Hello Time if so desired.
Configuring Port Fast
The Port Fast feature can be enabled on a per-port basis or globally, for the entire switch. If you enable Port Fast globally, it is enabled for all ports on the switch. This operation may create loops in redundant Spanning Tree networks and the Cisco IOS software warns of this. To enable Port Fast globally, the spanning-tree portfast default command must be issued. This is illustrated in the following output:
| VTP-Switch-1#conf t Enter configuration commands, one per line. End with CNTL/Z. VTP-Switch-1(config)#spanning-tree portfast default %Warning: this command enables portfast by default on all interfaces. You should now disable portfast explicitly on switched ports leading to hubs, switches and bridges as they may create temporary bridging loops.VTP-Switch-1(config)#exit |
NOTE: Notice the warning message issued by the switch when this is performed.
To enable Port Fast on a per-interface basis, the spanning-tree portfast interface configuration command must be applied to the desired interface(s). This is illustrated in the following output:
| VTP-Switch-1(config)#interface fastethernet 0/5 VTP-Switch-1(config-if)#spanning-tree portfast %Warning: portfast should only be enabled on ports connected to a single host. Connecting hubs, concentrators, switches, bridges, etc… to this interface when portfast is enabled can cause temporary bridging loops. Use with CAUTION%Portfast has been configured on FastEthernet0/5 but will only have effect when the interface is in a non-trunking mode. Switch-1(config-if)#exit |
NOTE: It is also important to remember that the Port Fast feature (although not recommended) can also be manually enabled on a trunk link by issuing the spanning-tree portfast trunk interface configuration command to the desired interface(s). This is illustrated in the following output:
| Switch-1(config)#interface gigabitethernet 0/1 Switch-1(config-if)#switchport Switch-1(config-if)#switchport mode trunk Switch-1(config-if)#spanning-tree portfast trunk %Warning: portfast should only be enabled on ports connected to a single host. Connecting hubs, concentrators, switches, bridges, etc… to this interface when portfast is enabled can cause temporary bridging loops. Use with CAUTIONSwitch-1(config-if)#exit |
Although Cisco IOS allows you to do so, keep in mind that enabling Port Fast on a trunk link is not recommended. The only way to validate Port Fast configuration is to look at the switch configuration. There are no Cisco IOSshow commands to verify Port Fast configuration. The following output shows how to look at the configuration to verify Port Fast configuration:
| VTP-Switch-1#show running-config interface gigabitethernet 0/1 Building configuration…Current configuration : 118 bytes ! interface GigabitEthernet0/1 switchport mode trunk no ip address no keepalive spanning-tree portfast trunk end |
Configuring BPDU Guard
The BPDU Guard feature can also be enabled globally or on a per-port basis. To enable BPDU Guard in global configuration mode, the spanning-tree portfast bpduguard default command must be issued on the switch. This is illustrated in the following output:
| VTP-Switch-1#conf t Enter configuration commands, one per line. End with CNTL/Z. VTP-Switch-1(config)#spanning-tree portfast bpduguard default VTP-Switch-1(config)#exit |
Global configuration of the BPDU Guard feature can be validated by issuing the show spanning-tree summarycommand. This verification is shown in the following output:
| VTP-Switch-1#show spanning-tree summary Switch is in pvst mode Root bridge for: VLAN0080, VLAN4000 EtherChannel misconfiguration guard is enabled Extended system ID is enabled Portfast is enabled by default PortFast BPDU Guard is enabled by default Portfast BPDU Filter is disabled by default Loopguard is disabled by default UplinkFast is disabled BackboneFast is disabled Pathcost method used is short … [Truncated Output] |
BPDU Guard can also be enabled on a per-port basis via the spanning-tree bpduguard enable interface configuration command. This is illustrated in the following output:
| VTP-Switch-1#conf t Enter configuration commands, one per line. End with CNTL/Z. VTP-Switch-1(config)#int fast 0/2 VTP-Switch-1(config-if)#spanning-tree bpduguard enable VTP-Switch-1(config-if)#exit VTP-Switch-1(config)# |
If the port receives a BPDU, an error message will be printed on the console. The following output shows a typical error message printed on the console when a BPDU is received on a port that has had the BPDU Guard feature enabled:
| 00:23:23: %SPANTREE-2-BLOCK_BPDUGUARD: Received BPDU on port FastEthernet0/2 with BPDU Guard enabled. Disabling port. 00:23:23: %PM-4-ERR_DISABLE: bpduguard error detected on Fa0/2, putting Fa0/2 in err-disable state 00:23:24: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/2, changed state to down 00:23:25: %LINK-3-UPDOWN: Interface FastEthernet0/2, changed state to down |
The port is then placed into an errdisable state as illustrated in the following output:
| VTP-Switch-1#show interface fastethernet 0/2 FastEthernet0/2 is down, line protocol is down (err-disabled) Hardware is Fast Ethernet, address is 000d.bd06.4102 (bia 000d.bd06.4102) MTU 1500 bytes, BW 100000 Kbit, DLY 1000 usec, reliability 255/255, txload 1/255, rxload 1/255 Encapsulation ARPA, loopback not set Keepalive set (10 sec) Auto-duplex, Auto-speed input flow-control is off, output flow-control is off ARP type: ARPA, ARP Timeout 04:00:00 Last input 00:03:20, output 00:03:21, output hang never Last clearing of ‘show interface’ counters never Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0 Queueing strategy: fifo … [Truncated Output] |
To re-enable the port, one of two actions can be taken. The first is that the administrator can manually re-enable the interface by performing a shut and no shut on the interface. These configuration steps are illustrated in the following output:
| VTP-Switch-1#conf t Enter configuration commands, one per line. End with CNTL/Z. VTP-Switch-1(config)#int f0/2 VTP-Switch-1(config-if)#shut VTP-Switch-1(config-if)#no shut VTP-Switch-1(config-if)#exit VTP-Switch-1(config)#exit VTP-Switch-1# VTP-Switch-1#show interface fastethernet 0/2 FastEthernet0/2 is up, line protocol is up (connected) Hardware is Fast Ethernet, address is 000d.bd06.4102 (bia 000d.bd06.4102) MTU 1500 bytes, BW 100000 Kbit, DLY 1000 usec, reliability 255/255, txload 1/255, rxload 1/255 Encapsulation ARPA, loopback not set Keepalive set (10 sec) Full-duplex, 100Mb/s input flow-control is off, output flow-control is off ARP type: ARPA, ARP Timeout 04:00:00 Last input 00:00:00, output 00:00:00, output hang never Last clearing of ‘show interface’ counters never Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0 Queueing strategy: fifo … [Truncated Output] |
The second option is to enable automatic errdisable recovery in Cisco IOS software via the errdisable recovery cause [reason] global configuration command. The following output shows how to configure the switch to enable errdisabled ports automatically:
| VTP-Switch-1(config)#errdisable recovery cause ? all Enable timer to recover from all causes bpduguard Enable timer to recover from BPDU Guard error disable state channel-misconfig Enable timer to recover from channel misconfig disable state dtp-flap Enable timer to recover from dtp-flap error disable state gbic-invalid Enable timer to recover from invalid GBIC error disable state link-flap Enable timer to recover from link-flap error disable state loopback Enable timer to recover from loopback detected disable state pagp-flap Enable timer to recover from pagp-flap error disable state psecure-violation Enable timer to recover from psecure violation disable state security-violation Enable timer to recover from 802.1x violation disable state udld Enable timer to recover from udld error disable state vmps Enable timer to recover from vmps shutdown error disable state |
The errdisable recovery cause command configures Cisco IOS software to re-enable ports that have been placed into the errdisable state automatically by any one of the options above. By default, Cisco IOS software will re-enable the ports after 300 seconds (5 minutes). The following output illustrates how to enable errdisable recovery for BPDU Guard:
| VTP-Switch-1(config)#errdisable recovery cause bpduguard |
The errdisable configuration is validated using the show errdisable recovery command as shown in the following output:
| VTP-Switch-1#show errdisable recovery ErrDisable Reason Timer Status —————– ————– udld Disabled bpduguard Enabled security-violatio Disabled channel-misconfig Disabled vmps Disabled pagp-flap Disabled dtp-flap Disabled link-flap Disabled gbic-invalid Disabled psecure-violation Disabled loopback DisabledTimer interval: 300 secondsInterfaces that will be enabled at the next timeout: Interface Errdisable reason Time left(sec) |
From the output above, we can see that errdisable recovery is enabled for BPDU Guard. We can also see that the default timer (i.e. when Cisco IOS software will re-enable the affected port(s)) is 5 minutes. And finally, we can see that FastEthernet0/2, which has been placed into the errdisable state because it has BPDU Guard enabled and received a BPDU, will be re-enabled in 277 seconds by the Cisco IOS software.
NOTE: Keep in mind, however, that if the port is automatically re-enabled and the same condition still exists (i.e. it receives another BPDU) it will be errdisabled again.
To adjust the default errdisable timer, use the errdisable recovery interval [seconds] command as illustrated in the following output:
| VTP-Switch-1#conf t Enter configuration commands, one per line. End with CNTL/Z. VTP-Switch-1(config)#errdisable recovery interval 60 VTP-Switch-1(config)#exit |
Again, the show errdisable recovery command can be used to validate this configuration as illustrated in the following output:
| VTP-Switch-1#show errdisable recovery ErrDisable Reason Timer Status —————– ————– udld Disabled bpduguard Enabled security-violatio Disabled channel-misconfig Disabled vmps Disabled pagp-flap Disabled dtp-flap Disabled link-flap Disabled gbic-invalid Disabled psecure-violation Disabled loopback DisabledTimer interval: 60 secondsInterfaces that will be enabled at the next timeout: Interface Errdisable reason Time left(sec) |
Configuring BPDU Filter
Unlike the BPDU Guard feature, which allows a Port Fast interface to still send BPDUs but errdisables the port in the event that it receives BPDUs, the BPDU Filter feature prevents the port from both sending and receiving BPDUs.
By default, the BPDU Filter feature is disabled on all ports. However, this feature can be enabled by issuing thespanning-tree portfast bpdufilter default global configuration command, or on a per-port basis via thespanning-tree bpdufilter enable interface configuration command. The following output illustrates how to enable the BPDU Filter on a global basis:
| VTP-Switch-1#conf t Enter configuration commands, one per line. End with CNTL/Z. VTP- Server-1(config)#spanning-tree portfast bpdufilter default VTP- Server-1(config)#exit |
The following output illustrates how to configure the BPDU Filter on a per-port basis:
| VTP-Switch-1#conf t Enter configuration commands, one per line. End with CNTL/Z. VTP-Switch-1(config)#int f0/4 VTP-Switch-1(config-if)#spanning-tree bpdufilter enable VTP-Switch-1(config-if)#exit |
This configuration can be validated by looking at the switch configuration or via the show spanning-tree summarycommand as illustrated in the following output:
| VTP-Switch-1#show spanning-tree summary Switch is in pvst mode Root bridge for: VLAN0001 EtherChannel misconfiguration guard is enabled Extended system ID is enabled Portfast is disabled by default PortFast BPDU Guard is disabled by default Portfast BPDU Filter is enabled by default Loopguard is disabled by default UplinkFast is disabled BackboneFast is disabled Pathcost method used is short |
Configuring Loop Guard
By default, the Loop Guard feature is disabled. However, it can be enabled either globally or on a per-port basis. To enable Loop Guard globally, use the spanning-tree loopguard default global configuration command. To enable Loop Guard on a per-port basis, use the spanning-tree guard loop interface configuration command. The following output illustrates how to enable Loop Guard globally on the switch:
| VTP-Switch-1#conf t Enter configuration commands, one per line. End with CNTL/Z. VTP-Switch-1(config)#spanning-tree loopguard default VTP-Switch-1(config)#exit |
The following output illustrates how to enable Loop Guard on a per-port basis:
| VTP-Switch-1#conf t Enter configuration commands, one per line. End with CNTL/Z. VTP-Switch-1(config)#int f0/2 VTP-Switch-1(config-if)#spanning-tree guard loop VTP-Switch-1(config-if)#exit |
The show spanning-tree summary command can be used to verify Loop Guard configuration. This is illustrated in the following output:
| VTP-Switch-1#show spanning-tree summary Switch is in pvst mode Root bridge for: VLAN0080, VLAN4000 EtherChannel misconfiguration guard is enabled Extended system ID is enabled Portfast is disabled by default PortFast BPDU Guard is disabled by default Portfast BPDU Filter is disabled by default Loopguard is enabled by default UplinkFast is disabled BackboneFast is disabled Pathcost method used is short … [Truncated Output] |
Configuring Root Guard
The Root Guard feature is disabled by default. This feature is used to prevent a Designated Port from becoming a Root Port. If a switch advertises a superior BPDU, or one with a lower BID, on a port where Root Guard is enabled, the local switch will not allow the new switch to become the Root Bridge. Instead, the port will be placed into a root-inconsistent state and will remain in this state as long as it continues to receive those BPDUs.
The port, however, can continue to relay received BPDUs to downstream switches. The Root Guard feature can only be enabled on a per-port basis. This is performed by issuing the spanning-tree guard root interface configuration command. The following output illustrates how to enable Root Guard on a port:
| VTP-Switch-1#conf t Enter configuration commands, one per line. End with CNTL/Z. VTP-Switch-1(config-if)#spanning-tree guard root VTP-Switch-1(config-if)#exit |
There is no show command that can be used to verify which ports are configured with the Root Guard feature. However, this can be validated by looking at the switch configuration. This is illustrated in the following output:
| VTP-Switch-1#show running-config interface fastethernet 0/2 Building configuration…Current configuration : 97 bytes ! interface FastEthernet0/2 switchport mode trunk no ip address spanning-tree guard root end |
If there are any ports that are configured for Root Guard and placed into the root-inconsistent state, they can be viewed by issuing the show spanning-tree inconsistentports command, which is shown in the following output:
| VTP-Switch-1#show spanning-tree inconsistentportsName Interface Inconsistency ——————– ———————- —————— VLAN0001 FastEthernet0/2 Root Inconsistent VLAN0010 FastEthernet0/2 Root Inconsistent VLAN0020 FastEthernet0/2 Root Inconsistent VLAN0030 FastEthernet0/2 Root Inconsistent VLAN0040 FastEthernet0/2 Root InconsistentNumber of inconsistent ports (segments) in the system : 5 |
Although the port is placed into a root-inconsistent state, it is important to know that it is not errdisabled. This still allows the port to retain the ability to relay BPDUs downstream as shown in the following output:
| VTP-Switch-1#show interfaces fastethernet 0/2 FastEthernet0/2 is up, line protocol is up (connected) Hardware is Fast Ethernet, address is 000d.bd06.4102 (bia 000d.bd06.4102) MTU 1500 bytes, BW 100000 Kbit, DLY 1000 usec, reliability 255/255, txload 1/255, rxload 1/255 Encapsulation ARPA, loopback not set Keepalive set (10 sec) Full-duplex, 100Mb/s input flow-control is off, output flow-control is off ARP type: ARPA, ARP Timeout 04:00:00 Last input 00:00:00, output 00:00:01, output hang never Last clearing of ‘show interface’ counters never Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0 Queueing strategy: fifo … [Truncated Output] |
Configuring Uplink Fast
Uplink Fast is enabled on Access layer switches and keeps track of possible paths to the Root Bridge. Once the Uplink Fast feature is enabled globally, it is enabled for the entire switch and all VLANs. By default, when Uplink Fast is enabled, Cisco IOS software performs the following actions on the local switch:
- The Bridge Priority of the switch is raised to 49,152
- The Port Cost of all VLANs is increased by 3,000
These two actions ensure that the switch will never be elected Root Bridge, and it makes the path through this switch as undesirable as possible for any downstream switches. For this reason, Uplink Fast should never be enabled on the Root Bridge because it will lose its Root status or lose switches that have other downstream switches connected to them. The following output illustrates how to enable Uplink Fast on an Access layer switch:
| VTP-Switch-1#conf t Enter configuration commands, one per line. End with CNTL/Z. VTP-Switch-1(config)#spanning-tree uplinkfast VTP-Switch-1(config)#exit |
The Bridge Priority and port cost adjustments by Uplink Fast are reflected in the show spanning-tree command as illustrated in the following output:
| VTP-Access-Switch-1#show spanning-treeVLAN0001 Spanning tree enabled protocol ieee Root ID Priority 32768 Address 0005.32f5.5b00 Cost 3019 Port 1 (FastEthernet0/1) Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Bridge ID Priority 49153 (priority 49152 sys-id-ext 1) Address 000d.bd06.4100 Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Aging Time 300 Uplinkfast enabled Interface Role Sts Cost Prio.Nbr Type VLAN0010 Bridge ID Priority 49162 (priority 49152 sys-id-ext 10) Interface Role Sts Cost Prio.Nbr Type
VLAN0020 Bridge ID Priority 49172 (priority 49152 sys-id-ext 20) Interface Role Sts Cost Prio.Nbr Type |
Uplink Fast configuration can be validated by issuing the show spanning-tree uplinkfast command. The information printed by this command is illustrated in the following output:
| VTP-Access-Switch-1#show spanning-tree uplinkfast UplinkFast is enabledStation update rate set to 150 packets/sec.UplinkFast statistics ———————– Number of transitions via uplinkFast (all VLANs) : 0 Number of proxy multicast addresses transmitted (all VLANs) : 0 Name Interface List |
By transitioning the port to a Forwarding state almost immediately, the Uplink Fast feature presents the potential problem of incorrect entries in the CAM tables of the other switches because they have not had an opportunity to re-learn the new path for the MAC addresses of the devices connected to the Access switch.
To prevent this, the Access layer switch on which the Uplink Fast feature is enabled floods dummy frames with the different MAC addresses that it has in its CAM as a source. The frames are sent to the Multicast address 01-00.0C-CD-CD-CD and appear to originate from the hosts connected to the switch so all the upstream switches can learn of these addresses through the new port. This message is shown in Figure 3-50 below:
Fig. 3-50. Uplink Fast Destination Address
By default, the switch sends out these Multicast frames at a rate of 150 packets per second (pps). However, this value can be adjusted by using the spanning-tree uplinkfast max-update-rate [rate] global configuration command. The following output illustrates how to change the number of packets sent to 500 pps on the Access switch:
| VTP-Access-Switch-1#conf t Enter configuration commands, one per line. End with CNTL/Z. VTP-Switch-1(config)#spanning-tree uplinkfast max-update-rate 500 VTP-Switch-1(config)#exit |
This configuration is reflected in the output of the show spanning-tree uplinkfast command. The output is shown in the following output:
| VTP-Access-Switch-1#show spanning-tree uplinkfast UplinkFast is enabledStation update rate set to 500 packets/sec.UplinkFast statistics ———————– Number of transitions via uplinkFast (all VLANs) : 15 Number of proxy multicast addresses transmitted (all VLANs) : 12 Name Interface List |
Configuring Backbone Fast
The Spanning Tree Backbone Fast feature is used to speed up convergence in the event of an indirect link failure to the Root Bridge. By immediately aging out the Max Age timer, this feature speeds up convergence from 50 seconds to 30 seconds.
By default, the Backbone Fast feature is disabled on all switches. However, if enabled, then it should be enabled on all switches in the STP domain. This enables the use of the Root Link Query protocol on all switches, which allows them to process RLQ packets. The Backbone Fast feature is enabled globally on the switch via thespanning-tree backbonefast global configuration command. The following output illustrates how to enable Backbone Fast on a switch:
| VTP-Switch-1#conf t Enter configuration commands, one per line. End with CNTL/Z. VTP-Switch-1(config)#spanning-tree backbonefast VTP-Switch-1(config)#exit |
This configuration is validated using the show spanning-tree summary or the show spanning-tree backbonefastcommands as shown in the following output:
| VTP-Switch-1#show spanning-tree summary Switch is in pvst mode Root bridge for: VLAN0080, VLAN4000 EtherChannel misconfiguration guard is enabled Extended system ID is enabled Portfast is disabled by default PortFast BPDU Guard is disabled by default Portfast BPDU Filter is disabled by default Loopguard is disabled by default UplinkFast is disabled BackboneFast is enabled Pathcost method used is shortName Blocking Listening Learning Forwarding STP Active ———————- ——– ——— ——– ———- ———- VLAN0001 1 0 0 2 3 VLAN0010 1 0 0 1 2 VLAN0020 1 0 0 1 2 VLAN0030 1 0 0 1 2 VLAN0040 1 0 0 1 2 VLAN0080 0 0 0 2 2 VLAN4000 0 0 0 2 2 ———————- ——– ——— ——– ———- ———- 7 vlans 5 0 0 10 15 VTP-Switch-1# VTP-Switch-1# VTP-Switch-1#show spanning-tree backbonefast BackboneFast is enabledBackboneFast statistics ———————– Number of transitions via backboneFast (all VLANs) : 0 Number of inferior BPDUs received (all VLANs) : 0 Number of RLQ request PDUs received (all VLANs) : 0 Number of RLQ response PDUs received (all VLANs) : 0 Number of RLQ request PDUs sent (all VLANs) : 0 Number of RLQ response PDUs sent (all VLANs) : 0 |
Configuring Unidirectional Link Detection
By default, UDLD is disabled on all switch ports. This feature can be enabled globally for all Fiber-connected ports or on a per-port basis. UDLD normal mode is enabled globally via the udld enable command, while UDLD aggressive mode is enabled via the udld aggressive global configuration command. The following output illustrates how to enable UDLD normal mode (which is the default UDLD mode of operation) on a switch:
| VTP-Switch-1#conf t Enter configuration commands, one per line. End with CNTL/Z. VTP-Switch-1(config)#udld enable VTP-Switch-1(config)#exit |
The following output illustrates how to configure UDLD aggressive mode on a switch:
| VTP-Switch-1#conf t Enter configuration commands, one per line. End with CNTL/Z. VTP-Switch-1(config)#udld aggressive VTP-Switch-1(config)#exit |
To enable UDLD on a per-port basis, issue the udld port [aggressive] interface configuration command. This command cannot be used for Fiber-connected ports, as they enable or disable UDLD operation based on the udld enable or udld aggressive global configuration commands. The following output illustrates how to enable UDLD normal mode on a point-to-point link between two FastEthernet switches:
| VTP-Switch-1(config)#interface fast 0/1 VTP-Switch-1(config-if)#description ‘Point-to-Point Link To VTP-Switch-2′ VTP-Switch-1(config-if)#udld port VTP-Switch-1(config-if)#exit |
| VTP-Switch-2(config)#interface fast 0/1 VTP-Switch-2(config-if)#description ‘Point-to-Point Link To VTP-Switch-2′ VTP-Switch-2(config-if)#udld port VTP-Switch-2(config-if)#exit |
The show udld [interface] command can be used to view UDLD configuration parameters. This is shown in the following output:
| VTP-Switch-1#show udld fastethernet 0/1Interface Fa0/1 — Port enable administrative configuration setting: Enabled Port enable operational state: Enabled Current bidirectional state: Bidirectional Current operational state: Advertisement – Single neighbor detected Message interval: 15 Time out interval: 5Entry 1 — Expiration time: 121 Device ID: 1 Current neighbor state: Bidirectional Device name: 00:05:32:F5:5B:00 Port ID: Fa0/1 Neighbor echo 1 device: FOC0730W239 Neighbor echo 1 port: Fa0/1 Message interval: 5 |
To adjust the default UDLD timers, the udld message time [seconds] command can be used. The following output illustrates how to change the time interval between UDLD probe messages on UDLD ports to 10 seconds:
| VTP-Switch-1#conf t Enter configuration commands, one per line. End with CNTL/Z. VTP-Switch-1(config)#udld message time 10 VTP-Switch-1(config)#exit |
The show udld [interface] command can be used to view UDLD configuration parameters. The following output shows how to verify the UDLD message interval time:
| VTP-Switch-1#show udldInterface Fa0/1 — Port enable administrative configuration setting: Enabled Port enable operational state: Enabled Current bidirectional state: Bidirectional Current operational state: Advertisement – Single neighbor detected Message interval: 10 Time out interval: 5Entry 1 — Expiration time: 169 Device ID: 1 Current neighbor state: Bidirectional Device name: 00:05:32:F5:5B:00 Port ID: Fa0/1 Neighbor echo 1 device: FOC0730W239 Neighbor echo 1 port: Fa0/1 Message interval: 5
|