Spanning Tree Protocol Basics: Root Bridge Election in a Lab

Spanning Tree Protocol (STP) is the reason you can cable switches in a loop for redundancy without melting your network with a broadcast sto...

Spanning Tree Protocol (STP) is the reason you can cable switches in a loop for redundancy without melting your network with a broadcast storm. In this lab you will connect three Cisco switches in a triangle, watch STP elect a root bridge on its own, read the port roles, then take control by changing the bridge priority. We finish with PortFast and BPDU Guard on access ports, which you should configure on every real network.

Why switches need STP

Ethernet frames have no TTL field. If two switches are connected by two paths, a single broadcast frame can circulate forever, multiply at every switch, and fill MAC address tables with wrong entries. Within seconds the CPU on every switch is at 100% and users lose connectivity. STP prevents this by logically blocking enough ports to turn the physical loop into a loop-free tree, while keeping the blocked links ready as backups.

Cisco switches run Per-VLAN Spanning Tree Plus (PVST+) by default, which means a separate spanning tree instance for every VLAN. In this lab everything is in VLAN 1, so we are working with one instance.

Key terms in one place

Term	Meaning
BPDU	Bridge Protocol Data Unit: the message switches exchange to build the tree, sent every 2 seconds by default
Bridge ID (BID)	Priority (default 32768) + VLAN number (sys-id-ext) + switch MAC address. Lowest BID wins
Root bridge	The switch with the lowest BID. All its ports are designated
Root port	On every non-root switch, the single port with the lowest cost path to the root
Designated port	On every link, the one port that forwards toward that segment
Alternate / blocking port	A port that is neither root nor designated; it discards frames to break the loop

Default port costs used by PVST+ (short method):

Link speed	STP cost
10 Mbps	100
100 Mbps	19
1 Gbps	4
10 Gbps	2

Lab topology

Figure: STP triangle with default priorities: SW2 (lowest MAC) is root and SW3 Gi0/1 blocks

Device	MAC address (base)	Links
SW1	0060.5C2B.1A01	Gi0/1 to SW2 Gi0/1, Gi0/2 to SW3 Gi0/1, Fa0/1 to PC1
SW2	0002.4A7E.3B02	Gi0/1 to SW1 Gi0/1, Gi0/2 to SW3 Gi0/2, Fa0/1 to PC2
SW3	00D0.97C4.5C03	Gi0/1 to SW1 Gi0/2, Gi0/2 to SW2 Gi0/2, Fa0/1 to PC3
PC1 / PC2 / PC3	-	192.168.1.11 / .12 / .13, mask 255.255.255.0

Your switches will have different MAC addresses. Before you start, run show version or show spanning-tree on each switch and write your own MACs in the table. The logic below works the same; only which switch wins may change.

Step 1: Let STP elect the root on its own

Do not configure anything yet. Wait about 30 seconds for the links to turn green (amber means the ports are still in listening/learning). Then look at SW1:

SW1# show spanning-tree
VLAN0001
  Spanning tree enabled protocol ieee
  Root ID    Priority    32769
             Address     0002.4A7E.3B02
             Cost        4
             Port        25(GigabitEthernet0/1)
             Hello Time  2 sec  Max Age 20 sec  Forward Delay 15 sec

  Bridge ID  Priority    32769  (priority 32768 sys-id-ext 1)
             Address     0060.5C2B.1A01
             Hello Time  2 sec  Max Age 20 sec  Forward Delay 15 sec
             Aging Time  20

Interface        Role Sts Cost      Prio.Nbr Type
---------------- ---- --- --------- -------- --------------------------------
Fa0/1            Desg FWD 19        128.1    P2p
Gi0/1            Root FWD 4         128.25   P2p
Gi0/2            Desg FWD 4         128.26   P2p

How to read it:

• Root ID is the root bridge as SW1 sees it: priority 32769, MAC 0002.4A7E.3B02. That is SW2.
• Bridge ID is SW1 itself. The priority 32769 is the default 32768 plus the VLAN number (1), called the system ID extension.
• Cost 4 is SW1's total path cost to the root: one Gigabit hop.
• Port 25(GigabitEthernet0/1) is SW1's root port. On a 2960, Fa0/1 to Fa0/24 are port numbers 1 to 24, and Gi0/1 and Gi0/2 are 25 and 26.

Why SW2 won

All three switches have the same priority (32769), so the tie is broken by the lowest MAC address. Compare them from left to right: 0002... is lower than 0060..., which is lower than 00D0.... SW2 wins without any configuration. This is the problem with leaving STP at defaults: the oldest or cheapest switch, which often has the lowest MAC, can end up as the root of your network.

Port roles across the triangle

Look at SW3:

SW3# show spanning-tree
...output trimmed...
Interface        Role Sts Cost      Prio.Nbr Type
---------------- ---- --- --------- -------- --------------------------------
Fa0/1            Desg FWD 19        128.1    P2p
Gi0/1            Altn BLK 4         128.25   P2p
Gi0/2            Root FWD 4         128.26   P2p

Here is the decision process step by step:

1. Root bridge: SW2. Both its Gigabit ports are designated and forwarding.
2. Root ports: SW1 reaches SW2 directly through Gi0/1 (cost 4), so that is its root port. SW3 reaches SW2 directly through Gi0/2 (cost 4), so that is its root port.
3. The SW1–SW3 link: one side must be designated. Both switches advertise the same cost to the root (4), so the tie is broken by the lower sender BID. SW1 (0060...) beats SW3 (00D0...). SW1 Gi0/2 becomes designated, and SW3 Gi0/1 becomes an alternate port in blocking state.

That one blocked port is all it takes to break the loop.

In Packet Tracer you can see this on the topology too: the link light at SW3 Gi0/1 stays amber while every other port turns green.

Step 2: Make SW1 the root bridge

In a real network, the root should be a core or distribution switch in the middle of the traffic flow. Let us say SW1 is our core switch. Lower its priority:

SW1(config)# spanning-tree vlan 1 priority 4096

The priority must be a multiple of 4096, because the lower 12 bits of the priority field are used by the VLAN ID. If you type something like 5000, IOS rejects it and lists the allowed values (0, 4096, 8192 ... 61440).

Alternatively, you can let IOS pick the value:

SW1(config)# spanning-tree vlan 1 root primary
SW2(config)# spanning-tree vlan 1 root secondary

root primary sets the priority to 24576, or lower if another switch already has a lower priority. root secondary sets 28672, so SW2 takes over if SW1 fails. It is a macro, not a permanent rule: it calculates a value once and writes a normal priority command into the configuration. Use one method or the other; in this lab I am using the explicit priority 4096.

Step 3: Verify the new root

SW1# show spanning-tree
VLAN0001
  Spanning tree enabled protocol ieee
  Root ID    Priority    4097
             Address     0060.5C2B.1A01
             This bridge is the root
             Hello Time  2 sec  Max Age 20 sec  Forward Delay 15 sec

  Bridge ID  Priority    4097  (priority 4096 sys-id-ext 1)
             Address     0060.5C2B.1A01
             Hello Time  2 sec  Max Age 20 sec  Forward Delay 15 sec
             Aging Time  20

Interface        Role Sts Cost      Prio.Nbr Type
---------------- ---- --- --------- -------- --------------------------------
Fa0/1            Desg FWD 19        128.1    P2p
Gi0/1            Desg FWD 4         128.25   P2p
Gi0/2            Desg FWD 4         128.26   P2p

"This bridge is the root" confirms it, and every port on the root is designated. Now the blocked port has moved. SW2 and SW3 both use their direct link to SW1 as root port (Gi0/1 on each). On the SW2–SW3 link both advertise cost 4, so the lower BID wins again: SW2 (0002...) beats SW3 (00D0...), and SW3 Gi0/2 becomes the alternate port.

SW3# show spanning-tree
...output trimmed...
Interface        Role Sts Cost      Prio.Nbr Type
---------------- ---- --- --------- -------- --------------------------------
Fa0/1            Desg FWD 19        128.1    P2p
Gi0/1            Root FWD 4         128.25   P2p
Gi0/2            Altn BLK 4         128.26   P2p

A quick way to see just the root information on any switch is show spanning-tree root, and show spanning-tree summary shows the STP mode and global features such as PortFast defaults.

Step 4: PortFast and BPDU Guard on access ports

When a PC is plugged in, classic STP makes the port wait in listening and learning for 30 seconds (2 x 15-second forward delay) before forwarding. That delay breaks DHCP on some clients and annoys users. PortFast skips those states on ports that connect to end devices.

SW1(config)# interface fastEthernet0/1
SW1(config-if)# switchport mode access
SW1(config-if)# spanning-tree portfast
%Warning: portfast should only be enabled on ports connected to a single
 host. Connecting hubs, concentrators, switches, bridges, etc... to this
 interface  when portfast is enabled, can cause temporary bridging loops.
 Use with CAUTION
...
SW1(config-if)# spanning-tree bpduguard enable

The warning is IOS reminding you of the risk: if someone plugs a switch into a PortFast port, a loop could form before STP reacts. That is exactly what BPDU Guard prevents. If a port with BPDU Guard receives any BPDU, the switch puts the port into err-disabled state immediately.

You can also enable both globally. spanning-tree portfast default applies PortFast to every access (non-trunking) port, and spanning-tree portfast bpduguard default applies BPDU Guard to every port where PortFast is active:

SW1(config)# spanning-tree portfast default
SW1(config)# spanning-tree portfast bpduguard default

Test BPDU Guard

Remove PC1 from SW1 Fa0/1 and connect a spare 2960 switch to that port instead. Within a few seconds SW1 logs messages similar to:

%SPANTREE-2-BLOCK_BPDUGUARD: Received BPDU on port FastEthernet0/1 with BPDU Guard enabled. Disabling port.
%PM-4-ERR_DISABLE: bpduguard error detected on Fa0/1, putting Fa0/1 in err-disable state

SW1# show interfaces status err-disabled

Port      Name               Status       Reason               Err-disabled Vlans
Fa0/1                        err-disabled bpduguard

If your Packet Tracer version does not support that filter, show interfaces fastEthernet0/1 status shows the same err-disabled state. To recover, remove the rogue switch, reconnect PC1, then bounce the port:

SW1(config)# interface fastEthernet0/1
SW1(config-if)# shutdown
SW1(config-if)# no shutdown

On real switches you can automate this with errdisable recovery cause bpduguard, but I prefer manual recovery for BPDU Guard, because someone should find out why a switch was plugged into a user port.

Prefer video? Watch more hands-on labs on the Technical Hakim YouTube channel.

Common mistakes

• Leaving the root election to chance. Always set the priority on your core switch (and a secondary) per VLAN. Otherwise a new access switch with a low MAC can become root and redirect traffic through itself.
• Setting priority on the wrong VLAN. PVST+ is per VLAN. Lowering priority for VLAN 1 does nothing for VLAN 10. Use spanning-tree vlan 1,10,20 priority 4096 to cover several.
• Priority not a multiple of 4096. IOS refuses values like 1000 or 5000.
• Reading the Root ID as the local switch. The Root ID block describes the root; the Bridge ID block describes the switch you are logged into. Only when "This bridge is the root" appears are they the same.
• PortFast on uplinks. PortFast belongs on access ports to end devices, never on links to other switches.
• Disabling STP to "fix" slow ports. no spanning-tree vlan 1 removes your loop protection. Use PortFast instead.
• Not waiting for convergence in Packet Tracer. With classic STP, port states take up to 30–50 seconds to settle. Use the fast-forward button or wait before checking outputs.

Summary

STP elects the switch with the lowest bridge ID as root, gives every other switch one root port, picks one designated port per link, and blocks the rest. Ties are broken by lowest cost, then lowest sender bridge ID, then lowest sender port ID. You controlled the election with spanning-tree vlan 1 priority 4096, verified it with show spanning-tree, and protected access ports with PortFast and BPDU Guard.

Related tutorials

• Configuring Static VLANs on a Cisco Switch (Packet Tracer Lab)
• Trunking and 802.1Q on Cisco Switches: Configs and Common Errors
• EtherChannel Configuration with LACP and PAgP
• Port Security on Cisco Switches: Sticky MAC and Violation Modes

Sources

• IEEE 802.1D-2004 – Media Access Control (MAC) Bridges
• IEEE 802.1Q – Bridges and Bridged Networks (incorporates RSTP and MSTP)
• Cisco Catalyst 2960 Switch Software Configuration Guide – Configuring STP
• Cisco Catalyst 2960 Switch Software Configuration Guide – Configuring Optional Spanning-Tree Features (PortFast, BPDU Guard)