š Lab Overview
This laboratory exercise focuses on understanding Spanning Tree Protocol (STP) fundamentals, configuring root bridge election, and analyzing port roles in a redundant network topology. You will configure bridge priorities to influence root bridge selection and verify port roles (root port, designated port, blocked port) using Cisco CLI commands.
šÆ Lab Objectives
- Understand Spanning Tree Protocol (STP) fundamentals and loop prevention mechanisms
- Configure and manipulate Bridge Priority to influence Root Bridge election
- Identify Root Ports, Designated Ports, and Blocked Ports in a redundant topology
- Analyze path costs and tie-breaker mechanisms for port role selection
- Verify STP topology using Cisco CLI commands
- Troubleshoot Root Bridge election issues and port role discrepancies
š¢ Real-World Scenario
ABC Corporation operates a three-switch network with redundant links to prevent single points of failure. The network requires proper STP configuration to block redundant paths and prevent Layer 2 loops. You will configure bridge priorities to designate SW-A as the root bridge, verify port roles on all switches, and understand the STP convergence process.
š¦ Equipment & Prerequisites
Hardware Requirements
| Equipment | Quantity | Model/Specification | Purpose |
|---|---|---|---|
| Cisco Catalyst Switch | 3 | Catalyst 2960, 3560, or higher | Primary switching platform |
| Ethernet Cables | 4+ | Cat5e or Cat6 patch cables | Inter-switch connectivity |
| Console Cable | 3 | RJ-45 to RS-232 or USB | CLI access to switches |
| Terminal Emulation Software | 1 | PuTTY, SecureCRT, or Cisco NETLAB | Console session management |
Software & Knowledge Requirements
- Cisco IOS or IOS-XE version 15.0 or later
- Basic understanding of Layer 2 switching concepts
- Familiarity with Cisco CLI command structure
- Knowledge of STP concepts (BPDU, bridge ID, path cost)
- Understanding of redundancy and loop prevention
š Network Topology
Three-Switch STP Topology with Redundant Links:
%3C/text%3E%3C/svg%3E)
Figure 1: Three-Switch STP Topology with Redundant Links - Root Bridge (SW-A) with two active links to SW-B and SW-C, STP blocks one link between SW-B and SW-C to prevent loops
āļø Step-by-Step Configuration Guide
1Initial Access & Switch Verification
Step 1.1: Connect to Switch via Console
Switch> enable
Password: (enter enable password)
Switch#
Password: (enter enable password)
Switch#
Step 1.2: Verify Basic Configuration
Switch# show running-config | section spanning-tree
Switch# show version
Switch# show spanning-tree
Switch# show version
Switch# show spanning-tree
ā¹ļø Note: Document the MAC address and current priority of each switch. These values are critical for understanding Root Bridge election.
2Configure Switch Hostnames
Step 2.1: Set Hostname on Switch A
configure terminal
hostname SW-A
no logging console
exit
write memory
hostname SW-A
no logging console
exit
write memory
Step 2.2: Set Hostname on Switch B
configure terminal
hostname SW-B
no logging console
exit
write memory
hostname SW-B
no logging console
exit
write memory
Step 2.3: Set Hostname on Switch C
configure terminal
hostname SW-C
no logging console
exit
write memory
hostname SW-C
no logging console
exit
write memory
ā Verification: Prompt should change on each switch to reflect the new hostname.
3Configure Trunk Ports Between Switches
Step 3.1: Configure Trunk Ports on Switch A
configure terminal
interface gi0/1
description Link to SW-B
switchport mode trunk
switchport trunk allowed vlan 1-1005
no shutdown
exit
interface gi0/2
description Link to SW-C
switchport mode trunk
switchport trunk allowed vlan 1-1005
no shutdown
exit
exit
interface gi0/1
description Link to SW-B
switchport mode trunk
switchport trunk allowed vlan 1-1005
no shutdown
exit
interface gi0/2
description Link to SW-C
switchport mode trunk
switchport trunk allowed vlan 1-1005
no shutdown
exit
exit
Step 3.2: Configure Trunk Ports on Switch B (Similar)
configure terminal
interface gi0/1
description Link to SW-A
switchport mode trunk
switchport trunk allowed vlan 1-1005
no shutdown
exit
interface gi0/2
description Link to SW-C
switchport mode trunk
switchport trunk allowed vlan 1-1005
no shutdown
exit
exit
interface gi0/1
description Link to SW-A
switchport mode trunk
switchport trunk allowed vlan 1-1005
no shutdown
exit
interface gi0/2
description Link to SW-C
switchport mode trunk
switchport trunk allowed vlan 1-1005
no shutdown
exit
exit
Step 3.3: Configure Trunk Ports on Switch C (Similar)
configure terminal
interface gi0/1
description Link to SW-A
switchport mode trunk
switchport trunk allowed vlan 1-1005
no shutdown
exit
interface gi0/2
description Link to SW-B
switchport mode trunk
switchport trunk allowed vlan 1-1005
no shutdown
exit
exit
interface gi0/1
description Link to SW-A
switchport mode trunk
switchport trunk allowed vlan 1-1005
no shutdown
exit
interface gi0/2
description Link to SW-B
switchport mode trunk
switchport trunk allowed vlan 1-1005
no shutdown
exit
exit
ā Verification: Run show interfaces trunk on each switch to confirm trunk configuration.
4Configure Spanning Tree Mode (Rapid PVST+)
Step 4.1: Change STP Mode on All Switches
configure terminal
spanning-tree mode rapid-pvst
exit
spanning-tree mode rapid-pvst
exit
Step 4.2: Verify Configuration
show spanning-tree summary
ā¹ļø About RAPID PVST+: This mode provides faster convergence (typically 6 seconds vs 50 seconds for classic STP) and is the industry best practice for modern networks.
5Configure Bridge Priority for Root Bridge Election
Step 5.1: Set Priority on Switch A (Make it Root Bridge)
configure terminal
spanning-tree vlan 1 priority 4096
exit
spanning-tree vlan 1 priority 4096
exit
Step 5.2: Set Priority on Switch B (Secondary Root)
configure terminal
spanning-tree vlan 1 priority 8192
exit
spanning-tree vlan 1 priority 8192
exit
Step 5.3: Set Priority on Switch C
configure terminal
spanning-tree vlan 1 priority 12288
exit
spanning-tree vlan 1 priority 12288
exit
ā Result: STP will immediately recalculate and SW-A should become the new Root Bridge.
6Verify Root Bridge Election & Port Roles
Step 6.1: Check STP Status on All Switches
show spanning-tree vlan 1
show spanning-tree detail
show spanning-tree detail
Step 6.2: Expected Output on SW-A (Root Bridge)
Bridge ID Priority 4097 (priority 4096 sys-id-ext 1)
Address aaaa.bbbb.cccc
Root ID Priority 4097
Address aaaa.bbbb.cccc ā Same as Bridge ID (This IS the root)
RootPort ā ā No root port on root bridge
Address aaaa.bbbb.cccc
Root ID Priority 4097
Address aaaa.bbbb.cccc ā Same as Bridge ID (This IS the root)
RootPort ā ā No root port on root bridge
Key Observations:
- Root Bridge has no Root Port
- Each non-root switch has exactly one Root Port
- Port states: Forwarding (active) or Discarding (blocked)
ā Configuration Verification Commands
Display STP Summary
show spanning-tree summary
(Shows STP mode, root bridge info)
(Shows STP mode, root bridge info)
View Detailed STP Information
show spanning-tree vlan 1 detail
(Comprehensive STP topology including port states)
(Comprehensive STP topology including port states)
Check Interface STP Status
show spanning-tree interface gi0/1
(Specific interface role and state)
(Specific interface role and state)
Monitor STP Statistics
show spanning-tree statistics
(BPDU counters and topology change history)
(BPDU counters and topology change history)
š Lab Completion Checklist
Configuration Verification
- ā All three switches are properly configured with correct hostnames
- ā Trunk ports are active and passing traffic between switches
- ā Root Bridge election is successful with SW-A as primary root
- ā All port roles are correctly assigned (Root, Designated, Blocked)
- ā Path costs reflect accurate link speeds (4 for 1Gbps)
- ā No Layer 2 loops present in the topology
- ā STP is running in Rapid PVST+ mode
- ā All verification commands execute successfully
- ā Failover test completed and Root Bridge re-election confirmed
- ā Configuration saved to NVRAM on all switches
š” Key Takeaways & Learning Outcomes
- Spanning Tree Protocol (STP) prevents Layer 2 loops by blocking redundant paths
- Bridge Priority determines Root Bridge election (lower priority wins)
- Root Port selection depends on path cost (lower cost to root wins)
- Designated Ports forward traffic on segments, Blocked Ports prevent loops
- Rapid PVST+ provides faster convergence than classic STP (6 seconds vs 50 seconds)
- BPDU (Bridge Protocol Data Unit) frames carry STP information between switches
- Port roles: Root Port (best path to root), Designated Port (lowest cost to segment), Blocked Port (redundant)
š Best Practices & Security Recommendations
STP Configuration Best Practices
- Always manually set bridge priority for root candidates instead of relying on MAC address
- Use consistent priority values across all switches (e.g., 4096, 8192, 12288)
- Configure Rapid PVST+ for faster convergence in production networks
- Enable BPDU Guard on access ports to prevent accidental topology changes
- Monitor STP topology changes and investigate unexpected root bridge elections
- Document the intended STP topology and root bridge designation
- Use Root Guard to prevent rogue switches from becoming root bridge
STP Security Best Practices
- Disable STP on edge ports (not connected to other switches) using PortFast
- Enable BPDU Guard to prevent accidental or malicious STP manipulation
- Use STP Loop Guard to prevent alternate/backup port transitions to designated port
- Monitor for STP topology changes that could indicate network compromise
- Implement STP authentication using MD5 or SHA (if supported)
- Prevent unauthorized switch connections that could influence root bridge election
š§ Troubleshooting Guide
| Issue | Cause | Solution |
|---|---|---|
| Unexpected Root Bridge election | Bridge priority not configured or MAC address tie-breaker activated | Verify bridge priority values with show spanning-tree |
| Port stuck in blocking state | Port role calculation resulted in blocked port (normal or loop condition) | Verify topology with show spanning-tree detail and physical cable connections |
| No Root Port on non-root switch | Switch is incorrectly acting as root or BPDU reception issue | Check bridge priority configuration and BPDU reception on all ports |
| Slow convergence after topology change | STP mode set to classic instead of Rapid PVST+ | Configure spanning-tree mode rapid-pvst and reload if necessary |
ā Lab Completion Indicator: You have successfully completed Lab 4.1 when you can explain Root Bridge election, identify port roles in a three-switch topology, understand bridge priority influence, and verify STP configuration using CLI commands.