Core

Spanning Tree Protocol (STP)

STP prevents Layer 2 loops by placing redundant links into a blocking state, electing a root bridge and calculating loop-free paths.

What you need to know

Default bridge priority is 32768; priority must be a multiple of 4096 (increments of 4096).
The root bridge is elected using the lowest bridge ID (priority + MAC address).
Port roles are root, designated, and blocking (alternate in RSTP terminology).
Default STP timers: Hello 2 seconds, Forward Delay 15 seconds, Max Age 20 seconds.
PVST+ runs a separate spanning tree instance per VLAN; Cisco default mode on most switches.
PortFast bypasses listening/learning states for access ports connected to end hosts, speeding convergence.
BPDU Guard err-disables a PortFast port if it receives a BPDU, protecting against accidental loops.

Command	Mode	Purpose
spanning-tree mode pvst	config	Set the STP mode to Per-VLAN Spanning Tree Plus.
spanning-tree vlan 10 priority 4096	config	Set a low priority to influence root bridge election for VLAN 10.
spanning-tree vlan 10 root primary	config	Automatically set priority low enough to become root for VLAN 10.
spanning-tree vlan 10 root secondary	config	Set priority for the backup root bridge.
spanning-tree portfast	config-if	Enable PortFast on an access port.
spanning-tree bpduguard enable	config-if	Enable BPDU Guard on the interface.
spanning-tree portfast bpduguard default	config	Enable BPDU Guard globally on all PortFast-enabled ports.

Using an invalid priority value not divisible by 4096.
Enabling PortFast on a port connected to another switch, risking a loop.
Forgetting root primary/secondary only adjusts priority, not other bridge ID factors like MAC.
Assuming PVST+ runs a single instance for all VLANs instead of one per VLAN.
Not verifying the intended root bridge actually won the election with show spanning-tree.

Practise Spanning Tree Protocol (STP) in a real CLI

Generated labs, graded against the simulated network state.