Exam Objective 2.5: Configure operations of the Rapid Per VLAN Spanning Tree Protocol (Rapid PVST+).
2.5.a Root port, root bridge (primary/secondary), and other port names
2.5.b Port states and roles
2.5.c PortFast
2.5.d Root guard, loop guard, and BPDU guard
Redundant physical links between switches are essential for network resilience, but a switched Layer 2 topology with redundant paths creates loops — and unlike Layer 3, Ethernet frames have no TTL field to eventually expire and disappear. A frame caught in a Layer 2 loop circulates forever, rapidly consuming all available bandwidth (a broadcast storm) and causing MAC address table instability. Spanning Tree Protocol exists specifically to prevent this by logically blocking redundant paths while still keeping them available as automatic backups. Rapid PVST+ is Cisco's enhanced, fast-converging, per-VLAN implementation of this protocol, and it's the version you're expected to know in depth for the exam.
Why Spanning Tree Exists — The Loop Problem
When switches are interconnected with redundant physical links (for resilience) but no loop-prevention mechanism, three specific problems occur:
Broadcast storms — a broadcast frame sent into a looped topology gets flooded out every port repeatedly, multiplying exponentially with each pass through the loop, rapidly consuming all available bandwidth until the network becomes unusable.
MAC address table instability — because a looped frame arrives at a switch from multiple directions, the switch continuously relearns the same source MAC address on different, rapidly alternating ports, corrupting the reliability of the MAC address table for actual forwarding decisions.
Multiple frame copies — a destination host can receive multiple duplicate copies of the same frame, since the frame is looping and being delivered repeatedly rather than just once.
Spanning Tree Protocol solves all three problems by calculating a loop-free logical tree topology across the switched network, using redundant physical links only as automatic standby paths that spring into use if the active path fails.
PVST+ (Per VLAN Spanning Tree Plus) — a Cisco enhancement that runs a separate independent instance of Spanning Tree Protocol for each VLAN, rather than a single shared spanning tree instance across the entire switched network. This allows different VLANs to use different root bridges and different blocked/forwarding link assignments, enabling more efficient load distribution across redundant links (for example, VLAN 10 could use one uplink as its active path while VLAN 20 uses the other uplink as its active path, load-balancing traffic across both physical links instead of leaving one completely idle).
Rapid PVST+ (RPVST+) — combines PVST+'s per-VLAN instance model with IEEE 802.1w (Rapid Spanning Tree Protocol, RSTP), Cisco's implementation of the faster-converging spanning tree standard. This is the default and recommended spanning tree mode on modern Cisco Catalyst switches, replacing the much slower legacy 802.1D STP.
Why "rapid" matters — convergence time: Legacy 802.1D STP takes up to 50 seconds to converge after a topology change (30 seconds moving through listening and learning states at 15 seconds each, plus additional delay for detecting the failure itself). Rapid PVST+ (802.1w) converges in a few seconds under most circumstances, using proposal/agreement handshakes between switches instead of just relying on fixed timers.
Configuration:
spanning-tree mode rapid-pvst
Exam Alert: Know that Rapid PVST+ is Cisco's combination of per-VLAN spanning tree instances (PVST+) with the IEEE 802.1w rapid convergence mechanism, and that it is the modern default/recommended mode, replacing legacy 802.1D STP's much slower convergence behavior.
Every spanning tree instance (one per VLAN under Rapid PVST+) needs exactly one root bridge — the logical "top" of the loop-free tree that all other switches calculate their best path toward.
Bridge ID (BID): Root bridge election is based on comparing each switch's Bridge ID, which consists of a 4-bit priority value (actually a 4-bit priority multiplied against a 4-bit extended system ID that encodes the VLAN number, together forming the full 2-byte priority field) combined with the switch's 6-byte MAC address. The switch with the lowest overall Bridge ID becomes the root bridge for that VLAN's spanning tree instance.
Default priority: 32768, in increments of 4096 (the increment is dictated by the extended system ID reserving the lower 12 bits of the priority field for the VLAN ID). If every switch in the topology is left at the default priority, the switch with the numerically lowest MAC address wins the root bridge election by default — which is rarely the switch an administrator would actually want as root, making manual priority configuration a standard best practice.
Manually influencing root bridge election:
spanning-tree vlan 10 priority 4096
Or, more commonly used in practice:
spanning-tree vlan 10 root primary
spanning-tree vlan 10 root secondary
spanning-tree vlan [x] root primary — automatically sets this switch's priority low enough (checking the current root's priority and setting this switch 4096 lower, or to 24576 if that's already the lowest available default step) to win the root bridge election for the specified VLAN.
spanning-tree vlan [x] root secondary — sets this switch's priority to 28672, positioning it to automatically take over as root if the primary root bridge fails, without requiring manual reconfiguration at failover time.
Exam Alert: Know the default priority (32768) and the tiebreaker (lowest MAC address wins if priorities are equal). Also know that root primary and root secondary are the standard, recommended way to designate root bridge preference in production, rather than manually calculating and typing exact priority values.
Once a root bridge is elected, every other (non-root) switch must determine its own best path toward the root, and every port on every switch is assigned a specific role based on that calculation.
Root port (RP): On every non-root switch, exactly one port is selected as the root port — the port offering the best (lowest-cost) path back toward the root bridge. Every non-root switch has exactly one root port, and it is always in the forwarding state.
Designated port (DP): On every network segment (link), exactly one switch is responsible for forwarding traffic onto that segment — the switch closest to the root bridge; the port that switch uses on that segment is the designated port. The root bridge itself has all of its active ports acting as designated ports, since it is by definition the closest point to itself on every connected segment.
Non-designated / blocking port: Any port that is neither a root port nor a designated port becomes a blocking (non-designated) port, meaning it does not forward traffic but still listens for BPDUs, in order to instantly detect a topology change and recalculate if needed. This is the mechanism that actually breaks the physical loop, without physically disconnecting the redundant cable.
Path cost: The metric used to determine the "best" (lowest-cost) path to the root bridge, based on the cumulative cost of each link along the path, where each link's individual cost is derived from its bandwidth (higher bandwidth = lower cost). Common default costs: 10 Mbps = 100, 100 Mbps = 19, 1 Gbps = 4, 10 Gbps = 2.
Tiebreaker sequence when path costs are equal: (1) lowest sender Bridge ID, (2) lowest sender port ID (priority + port number). This layered tiebreaker sequence ensures a deterministic outcome even in a fully symmetric topology.
Exam Alert: Every non-root switch has exactly one root port. Every segment has exactly one designated port. Everything else blocks. Path cost is inversely related to bandwidth — faster links have lower cost and are therefore preferred.
Rapid PVST+ (802.1w) simplified the legacy 802.1D five-state model down to three functional states, dramatically speeding up convergence.
Legacy 802.1D states (for comparison/context): Blocking, Listening, Learning, Forwarding, Disabled — the listening and learning states each imposed a fixed 15-second timer, producing the notorious ~50-second worst-case convergence time.
Rapid PVST+ (802.1w) states:
Discarding — combines the old Blocking and Listening states into one; the port neither forwards frames nor learns MAC addresses, but does process received BPDUs
Learning — the port does not yet forward frames, but has begun learning MAC addresses from received frames, populating the MAC address table in preparation for the forwarding state
Forwarding — the port both forwards frames and learns MAC addresses; normal operational state for a root port or designated port
Roles reflected in state: A port's role (root, designated, or blocking/alternate) determines what state it will ultimately settle into — root ports and designated ports converge to forwarding, while alternate/backup ports remain in the discarding state.
Additional Rapid PVST+-specific port roles (beyond root/designated/blocking):
Alternate port — a port that has a path to the root bridge, but not the best path (the root port already covers that role) — functionally similar to the legacy "blocking" concept, but specifically describes a backup path to the root, ready to immediately take over as the new root port if the current root port fails
Backup port — a port that provides a redundant/backup connection to the same network segment that this switch is already forwarding traffic onto via another port — this specific role can only occur when two ports on the same switch connect to the same shared segment (for example, two ports both connected to the same hub, an increasingly rare scenario in modern all-switched networks)
Exam Alert: Know the three Rapid PVST+ states in order (Discarding, Learning, Forwarding) and that Discarding is the merger of legacy Blocking and Listening. Also recognize alternate port (backup path to root) versus backup port (backup path to a shared segment) as distinct, specifically Rapid-PVST+-defined roles, even though backup ports are rarely seen in typical modern switched topologies.
PortFast is a Cisco enhancement designed specifically for ports connecting to a single end host (a PC, printer, or similar device that will never itself introduce a Layer 2 loop), allowing that port to skip the normal spanning tree progression and move directly to the forwarding state as soon as the physical link comes up.
Configuration (interface-level):
interface GigabitEthernet0/1
spanning-tree portfast
Configuration (global, applies to all access ports):
spanning-tree portfast default
Why PortFast matters: Without PortFast, every time an end host's NIC power-cycles or a cable is unplugged and replugged, the switch port would cycle through the full discarding/learning/forwarding progression before the host could actually send traffic — a delay of several seconds even under Rapid PVST+'s faster convergence, and a much longer delay under legacy 802.1D. For a simple end host that poses no loop risk, this delay is unnecessary and disruptive (commonly breaking DHCP requests sent immediately at boot, for example).
Critical restriction — PortFast must only be used on true edge ports: PortFast should never be enabled on a port connecting to another switch, hub, or any device capable of forming a loop. If a PortFast-enabled port is connected to another switch, it will begin forwarding immediately without going through the normal loop-detection progression, potentially creating an active Layer 2 loop before spanning tree has a chance to detect and block it.
Exam Alert: PortFast alone does not protect against a loop being introduced on that port — it only skips the state delay. BPDU Guard (covered next) is what actually protects against a PortFast port being misused as a switch-to-switch connection.
These three features are all protective enhancements layered on top of standard Rapid PVST+ operation, each addressing a distinct specific failure/attack scenario.
BPDU Guard:
Purpose — protects a PortFast-enabled edge port by immediately error-disabling that port if it ever receives a BPDU
Rationale — a legitimate single end host should never send BPDUs; receiving one indicates a switch, hub, or another spanning-tree-capable device has been connected where only a simple end host was expected, which could introduce a loop
Configuration (interface-level): spanning-tree bpduguard enable
Configuration (global, applies automatically to all PortFast-enabled ports): spanning-tree portfast bpduguard default
Result of violation — the port is placed into the err-disabled state and stops passing traffic entirely until manually re-enabled (or automatically recovered if err-disable recovery is separately configured)
Root Guard:
Purpose — prevents a port from ever being allowed to become a root port, protecting the intentionally designated root bridge from being displaced by a rogue or misconfigured switch advertising a superior (lower priority) BPDU
Rationale — typically applied on designated ports facing access-layer switches, where the administrator never wants that direction of the network to become the path toward the root
Configuration (interface-level): spanning-tree guard root
Result of violation — if a superior BPDU is received on a Root-Guard-enabled port, the port is placed into a root-inconsistent state (a specific blocking condition), rather than being allowed to become the new root port; the port automatically recovers to normal operation once the superior BPDUs stop being received
Loop Guard:
Purpose — protects against a specific failure mode where a port that should be receiving BPDUs (a root port or a non-designated/blocking port) stops receiving them — not because the link failed, but because of a unidirectional link failure or another problem that silently stops BPDU transmission while the physical link otherwise still appears up
Rationale — without Loop Guard, a port that stops receiving expected BPDUs will, after the timer expires, transition to the forwarding state (assuming the lack of BPDUs means it's now safe to do so) — which can actually create the very loop that spanning tree is supposed to prevent, if the underlying link problem is one-directional rather than a full link failure
Configuration (interface-level): spanning-tree guard loop
Configuration (global): spanning-tree loopguard default
Result of violation — the port is placed into a loop-inconsistent state (blocking) rather than incorrectly transitioning to forwarding, and automatically recovers once BPDUs resume being received normally
Comparing the three guards:
Root Guard — applied on designated ports, prevents that port from becoming a root port (protects the root bridge's identity/position in the topology).
Loop Guard — applied on root ports and non-designated (alternate/blocking) ports, prevents an incorrect transition to forwarding when expected BPDUs stop arriving (protects against unidirectional link failures).
BPDU Guard — applied on PortFast edge ports, error-disables the port entirely if any BPDU is received at all (protects against an end-host port being misused as a switch connection).
Exam Alert: This is one of the most commonly confused trios on the exam. Anchor them by where they're typically applied and what specific failure they prevent: Root Guard = wrong place, blocks becoming root port. Loop Guard = missing BPDUs, blocks incorrect forwarding transition. BPDU Guard = any BPDU at all on an edge port, shuts the port down completely (err-disable) rather than just blocking it.
show spanning-tree — displays the spanning tree topology for all VLANs (or a specified VLAN), including root bridge identification, this switch's own bridge priority, and the role/state of every port
show spanning-tree vlan [x] — narrows the output to a single specific VLAN's spanning tree instance
show spanning-tree summary — a condensed overview showing the spanning tree mode in use (confirming Rapid PVST+ is actually active) and a count of blocking/forwarding ports
show spanning-tree interface [interface] detail — detailed spanning tree information for one specific interface
show spanning-tree root — displays root bridge information specifically, useful for quickly confirming which switch is currently root for a given VLAN
Exam Alert: show spanning-tree output will directly show you the root bridge's Bridge ID, this switch's own priority, and a per-port breakdown of role (Root/Desg/Altn/Back) and state — expect to be shown this output and asked to identify the root bridge, identify a specific port's role, or identify why a particular port is blocking.
Confirm the switch is actually running in Rapid PVST+ mode with show spanning-tree summary (spanning-tree mode rapid-pvst if it needs to be changed).
Identify the intended root bridge for each VLAN and confirm it using show spanning-tree root; use spanning-tree vlan [x] root primary / root secondary to deliberately control root bridge placement rather than relying on default priority and MAC address tiebreakers.
Review port roles and states with show spanning-tree vlan [x] to confirm the topology matches expectations — one root port per non-root switch, one designated port per segment, everything else blocking/discarding as appropriate.
Apply spanning-tree portfast (or the global default) only on true single-host edge ports, never on switch-to-switch or hub connections.
Pair every PortFast-enabled edge port with spanning-tree bpduguard enable (or the global default) to protect against accidental or malicious loop introduction on that port.
Apply spanning-tree guard root on designated ports facing access-layer switches where that switch should never become the root bridge direction.
Apply spanning-tree guard loop (or the global default) on root ports and blocking ports to protect against unidirectional link failures causing an incorrect transition to forwarding.
If a port unexpectedly ends up in an err-disabled, root-inconsistent, or loop-inconsistent state, use show spanning-tree interface [interface] detail and show logging to determine which guard feature triggered and why, before deciding whether to manually clear the condition.
Q1. A switch has been left at the default spanning tree priority (32768) for VLAN 10, along with every other switch in the topology. Which switch will be elected root bridge for VLAN 10?
A. The switch with the highest MAC address
B. The switch with the lowest MAC address
C. The switch with the most connected ports
D. The election will fail with no priorities manually configured
Answer: B. When every switch shares the same default priority, the Bridge ID tiebreaker falls to the MAC address portion, and the switch with the numerically lowest MAC address wins the root bridge election. Since this outcome is essentially arbitrary and rarely the switch an administrator would actually prefer, manually configuring root bridge priority (or using root primary/root secondary) is standard best practice.
Q2. Which Rapid PVST+ port state combines the functions of the legacy 802.1D Blocking and Listening states?
A. Learning
B. Forwarding
C. Discarding
D. Disabled
Answer: C. Rapid PVST+ (802.1w) simplified the legacy five-state model down to three states — Discarding, Learning, and Forwarding. The Discarding state merges the old Blocking and Listening states, since a port in either of those legacy states was not forwarding frames or learning MAC addresses, just differing in whether it was actively listening for topology changes.
Q3. An administrator wants to guarantee that a specific access-layer switch's uplink port can never become a root port, protecting the intended root bridge from being displaced by a misconfigured downstream switch. Which feature should be configured?
A. spanning-tree portfast
B. spanning-tree guard root
C. spanning-tree guard loop
D. spanning-tree bpduguard enable
Answer: B. Root Guard, configured with spanning-tree guard root on a designated port, prevents that port from ever transitioning into the root port role. If a superior BPDU is received (which would normally indicate a better path to a new root bridge), the port instead enters a root-inconsistent (blocking) state rather than allowing the topology's root bridge to be displaced.
Q4. A port connected to a single desktop PC has both PortFast and BPDU Guard enabled. A user disconnects the PC and instead connects an unmanaged switch to that same port, which begins forwarding a BPDU it received from elsewhere in its own small network. What happens to the switch port?
A. The port transitions normally through discarding, learning, and forwarding
B. The port is immediately placed into the err-disabled state and stops passing traffic
C. The port becomes the new root port
D. Nothing happens, since PortFast ports ignore BPDUs entirely
Answer: B. BPDU Guard protects a PortFast-enabled edge port by immediately error-disabling it the moment any BPDU is received, since a legitimate single end host should never generate one. This shuts the port down completely, rather than simply blocking it, protecting against the loop risk introduced by unexpectedly connecting a switch or hub to what was configured as a simple end-host port.
Q5. Which spanning tree guard feature is specifically designed to protect against a unidirectional link failure that causes a port to stop receiving expected BPDUs while the physical link otherwise still appears up?
A. Root Guard
B. Loop Guard
C. BPDU Guard
D. UplinkFast
Answer: B. Loop Guard addresses the specific scenario where a root port or blocking port stops receiving BPDUs it should normally be receiving — not due to a full link failure, but potentially due to a unidirectional link problem. Without Loop Guard, the port might incorrectly assume it's now safe to transition to forwarding, which can actually create a loop; Loop Guard instead places the port into a loop-inconsistent (blocking) state until BPDUs resume.
Q6. On a non-root switch, how many root ports and how many designated ports will typically exist?
A. Exactly one root port per switch, and exactly one designated port per network segment
B. Exactly one root port per network segment, and exactly one designated port per switch
C. Multiple root ports are allowed per switch, but only one designated port total
D. Root ports and designated ports are the same thing under Rapid PVST+
Answer: A. Every non-root switch selects exactly one root port — the single best path back toward the root bridge. Separately, every network segment (link) has exactly one designated port, which is the port (on whichever connected switch is closest to the root) responsible for forwarding traffic onto that specific segment. These are segment-based and switch-based designations respectively, not interchangeable.