Default STP Behavior on Cisco Switches

In a prior blog, Functionality of Layer 2 Switches/Bridges, I discussed the core functionality of layer 2 switches. In this blog, I hit upon the Spanning Tree Protocol (STP) used on layer 2 switches to prevent loops. As mentioned before, loops can be created via layer 2 switches by using more than one link to connect to the same switches. This is often done for redundancy purposes but is not possible without STP.

STP is a Layer 2 protocol that prevents loops and allows for a degree of network redundancy. In a layer 2 network, only one active path can exist between switches. If this rule is broken, packets have multiple ways to reach the same destination and the MAC address tables can get constantly thrashed, duplicate packets can be received at the destination, and broadcast storms will eventually bring down the network.

How STP prevents loops in a layer 2 topology is by electing one switch to be the root bridge. Once the root bridge is elected, all other bridges must make a single path to the root bridge. Switches exchange information via Bridge Protocol Data Units (BPDUs) to determine which switch will become the root bridge and correspondingly the best path to the root bridge and the ports that will be blocked. The root bridge is decided based on bridge ID. The bridge ID consists of the device priority and MAC address of the switch. By default, all switches have a priority of 32,768, so if the priority has not been set manually, the switch with the lowest MAC address will become the root bridge. To enforce a specific switch to become the root bridge set its bridge priority to the lowest value compared to other switches.

The port on each switch with the best path to the root bridge is called the root port. The port on each switch that has the lowest cost to the root bridge via the root port is called the designated port. The designated port is eventually put into forwarding state.

A layer 2 interface participating in STP on a switch can be in several different states:

* Blocking – the interface does not participate in frame forwarding, however, BPDU data is still received.
* Listening – transitional state in which the interface processes BPDUs and awaits possible new information. It does forward frames but does not populate the MAC address table.
* Learning – the interface prepares to participate in frame forwarding. It learns the source addresses from frames received and adds them to the filtering database. It populates the MAC address table.
* Forwarding – the interface receives and sends data. STP continues monitoring incoming BPDUs to react to topology changes and prevent loops.
* Disabled- the interface is not participating in spanning tree. The port may have no link, be shutdown, or have no spanning-tree instance running on it.

On Cisco switches spanning tree is enabled by default. Every interface in the domain or VLAN will start from the blocking state and go through all the transitional states until spanning tree stabilizes and each interface is either in the forwarding or blocking state. In the below diagram, I use two Cisco 3560 switches [IOS 12.2(25r)SEC] connected together via two links to show the default behavior of the switch in regards to STP.

Cisco 3560 switches demonstrating STP

All connected ports are in the default VLAN (the same STP domain). As you can see below, Switch2 has become the root bridge since default priorities were not changed and it has a lower MAC address. Also, note “interface fastEthernet 0/2” on Switch1 has been put into blocking state to prevent a loop.

"show spanning-tree" command on Switch1

Below I forcibly change the root bridge to be Switch1 with the “spanning-tree vlan 1 root primary” command. Note the output of the “show spanning-tree” command and the fact that the root bridge has only forwarding interfaces.

Changed the root bridge to Switch1