Switching
Advanced STP (RSTP, PVST+, Guards)
Rapid PVST+ speeds up convergence compared to classic 802.1D STP, and additional guard features protect against topology instability and unauthorized switches.
What you need to know
- Rapid PVST+ (802.1w) uses port roles alternate and backup in addition to root and designated, converging in seconds instead of 30-50s.
- RSTP port states are simplified to discarding, learning, and forwarding.
- Root Guard prevents a port from becoming a root port, protecting the intended root bridge placement; it err-disables/blocks the port if a superior BPDU is received.
- Loop Guard prevents alternate/root ports from becoming designated when BPDUs stop being received, avoiding loops from unidirectional link failures.
- UplinkFast and BackboneFast are legacy 802.1D convergence enhancements largely obsolete once Rapid PVST+ is used.
- spanning-tree mode rapid-pvst enables Rapid PVST+ per-VLAN on Cisco switches.
- BPDU Filter suppresses sending/receiving BPDUs entirely on a port, effectively disabling STP protection there.
Configuration commands
| Command | Mode | Purpose |
|---|---|---|
| spanning-tree mode rapid-pvst | config | Enable Rapid PVST+ globally. |
| spanning-tree guard root | config-if | Enable Root Guard on a port facing access-layer or untrusted switches. |
| spanning-tree guard loop | config-if | Enable Loop Guard on a non-designated port. |
| spanning-tree loopguard default | config | Enable Loop Guard globally on eligible ports. |
| spanning-tree bpdufilter enable | config-if | Disable BPDU transmission/reception on the interface. |
| spanning-tree uplinkfast | config | Enable legacy UplinkFast convergence feature (802.1D only). |
| spanning-tree vlan 10 hello-time 1 | config | Adjust the hello timer for VLAN 10 (root bridge only, rarely changed). |
Verify it
- show spanning-tree vlan 10 detail
- show spanning-tree summary totals
- show spanning-tree interface fa0/1 detail
- show spanning-tree root
- show running-config | section spanning-tree
Common mistakes
- Enabling Root Guard on the wrong port and blocking legitimate root bridge traffic.
- Confusing Loop Guard with UDLD; they solve similar but distinct unidirectional link problems.
- Applying BPDU Filter on inter-switch links, silently disabling loop protection.
- Not setting spanning-tree mode rapid-pvst consistently across all switches in the topology.
- Assuming RSTP port roles map one-to-one with 802.1D states when troubleshooting.
Practise Advanced STP (RSTP, PVST+, Guards) in a real CLI
Generated labs, graded against the simulated network state.