Big networks are built in layers so they can grow and be fixed.

What this course actually is

It is a Layer 2 switching course wearing a design-course name. Everything — VLAN, inter-VLAN, VTP, Spanning Tree, port aggregation — lives at layer 2 or just above it. Later come campus design, basic QoS, HA, and wireless design.

The 3-layer hierarchical model

The slide also asks: "What about Spine and Leaf?" — the modern data-center answer. Every leaf switch connects to every spine, so any server is exactly two hops from any other. It exists because data-center traffic is now mostly east-west (server to server), while the 3-layer model was designed for north-south traffic (user to internet).

What you're expected to already know

• The 7 OSI layers and the TCP/IP stack.
• Basic router and switch configuration.
• Subnetting, especially class C — the labs use /24, /25 and /30.

Tools

128-bit addresses. Written as 8 hex groups, shortened by two rules.

The problem

IPv4 has 2³² addresses and ran out. IPv6 has 2¹²⁸ — enough that every device can have a public address again, which kills the need for NAT. Adoption is now roughly half of Google's traffic; the slide shows the IPv4→IPv6 overlap running through the 2020s and 2030s.

Writing an address

1. 128 bits = 8 groups ("quartets") of 4 hex digits: 2001:DEAD:CAFE:0000:0000:0000:0007:0088
2. Drop leading zeros in each group: 2001:DEAD:CAFE:0:0:0:7:88
3. Replace one run of all-zero groups with :: — 2001:DEAD:CAFE::7:88

Only one :: per address, because with two you couldn't tell how many zero groups each one hides.

Address types — read the first digits

Prefix structure — where the bits go

Typical: ISP gives you 2001:0DB8:1111::/48, you carve …:1::/64, …:2::/64 and so on. /64 is the normal subnet size — the last 64 bits are always the host part.

IPv4 vs IPv6 header — why v6 is faster to route

EUI-64 — build the host part from a MAC

1. Split the 6-byte MAC in half.
2. Insert FFFE between the halves.
3. Flip the 7th bit from the left of the first byte (0↔1).

0013.1234.ABCD → 001312 | 34ABCD → 0013:12FF:FE34:ABCD → flip → 0213:12FF:FE34:ABCD

How a device gets an address

SLAAC in 3 moves: ① learn the subnet prefix on the link using NDP ② pick your own interface ID (random or EUI-64) ③ run DAD to check nobody else has it. The gap is DNS — fill it with stateless DHCPv6 or RDNSS carried inside NDP.

Link-local addresses

• Every IPv6 interface gets one automatically: FE80::/64, interface ID by EUI-64 on Cisco.
• Used for talking to neighbours: NDP, routing protocol hellos, and next-hop addresses.
• That's why routing tables show via FE80::CE01:AFF:FEAE:0 instead of a global address.

Routing protocols for IPv6

From IOS 15.1(3) the OSPFv3 syntax changed to router ospfv3 + ospfv3 1 ipv6 area 0 with address families. Both styles appear in the slides.

ipv6 unicast-routing                ! nothing routes without this
interface Fa0/1
 ipv6 address 2001:DB8:1111:1::1/64
 ipv6 address FE80::1 link-local    ! optional manual LL
 ipv6 enable

ipv6 route 2001:DB8:2::/64 Fa0/1

! RIPng
ipv6 router rip MYRIP
interface Fa0/0
 ipv6 rip MYRIP enable

! OSPFv3 (classic syntax)
ipv6 router ospf 1
 router-id 1.1.1.1
interface Fa0/0
 ipv6 ospf 1 area 0

show ipv6 interface [brief]
show ipv6 route [rip|ospf]
show interface Fa0/0            ! find the burned-in MAC
ping ipv6 2001:DB8:1111:1::1

How a switch learns, and how to lock it down.

The three devices

The five behaviours of a transparent bridge

1. Listen — read the source MAC of every frame and record it against the port it arrived on.
2. Update — if a MAC appears on a new port, move the entry.
3. Flood broadcasts — out every port except the one it came in on.
4. Flood unknown unicast — destination not in the table? Same treatment.
5. Never modify the frame — which is exactly why it's called transparent.

The MAC table

• Cisco calls it CAM (Content-Addressable Memory). Entries age out after 300 s.
• TCAM is a separate, ternary version used for ACL lookups — it can match "don't care" bits.

Cisco hardware families (worth recognising)

Your labs use 2960 (pure L2) and 3650 (multilayer). That difference is why Lab 05 puts SVIs on the 3650 and not the 2960.

Securing access — in the order you type it

1. Hostname and enable secret (hashed) rather than enable password.
2. Console line password with login.
3. Local user for remote access, then line vty 0 4 + login local. "0 4" means five simultaneous sessions (n − m + 1).
4. SSH prerequisites: a domain name → RSA key (2048 recommended) → ip ssh version 2. Without domain + key the crypto simply won't generate.
5. transport input ssh to refuse Telnet entirely (options: all / none / ssh / telnet).
6. service password-encryption to hide the plaintext ones. Removing it later does not decrypt what's already stored.

Management IP

A switch has no routable interface of its own, so the IP goes on an SVI: interface vlan 1 + address + no shutdown, plus ip default-gateway so it can reply to other subnets. Security note from the slide: don't use VLAN 1 for management in production.

Port security

hostname swA
enable secret netdes
line console 0
 password netdes
 login

username student secret netdes
ip domain-name cpe.eng.cmu.ac.th
crypto key generate rsa            ! choose 2048
ip ssh version 2
line vty 0 4
 login local
 transport input ssh
service password-encryption

interface vlan 1
 ip address 192.168.56.251 255.255.255.128
 no shutdown
ip default-gateway 192.168.56.1

interface range Fa0/1 - 2
 description USER PORTS
 duplex auto                       ! auto | full | half

interface Fa0/1
 switchport mode access
 switchport port-security
 switchport port-security mac-address sticky
 switchport port-security maximum 2

! from the switch, SSH out to another device
ssh -l student 192.168.56.252

show ip interface brief
show interface status
show mac address-table
show port-security interface Fa0/1
show ip ssh

One switch, many broadcast domains. One cable, many VLANs.

The problem

A LAN is "everyone in the same broadcast domain", and by default a whole switch is one LAN. To split it you'd need a second physical switch — expensive and inflexible. A VLAN does it in software.

Five benefits — know why, not just what

Trunking

Connecting two switches that share 5 VLANs could mean 5 cables. Instead one trunk carries all of them, tagging each frame with its VLAN ID on the way out. The receiving switch reads the tag, strips it, and delivers into the right VLAN.

The other protocol, Cisco's ISL, is legacy — it wrapped the whole frame instead of inserting a tag. The native VLAN is the one VLAN that crosses the trunk untagged.

VLAN ranges — the full table

If you create a VLAN without naming it, the name defaults to VLAN + the 4-digit ID — VLAN 10 becomes VLAN0010.

Two design philosophies

DTP — how a link decides to become a trunk

vlan 261
 name staffs

interface Fa0/1
 switchport mode access
 switchport access vlan 261

interface range Fa0/1 - 4
 switchport access vlan 261

interface Gi0/1
 switchport trunk encapsulation dot1q   ! only if the switch also knows ISL
 switchport mode trunk
 switchport trunk allowed vlan 10,20
 switchport trunk allowed vlan add 30
 switchport trunk allowed vlan remove 20
 switchport trunk allowed vlan except 99

show vlan brief
show vlan id 261
show interface Fa0/1 switchport
show interface trunk

Create a VLAN once; the domain copies it everywhere.

The problem

With 50 switches you'd type vlan 30 fifty times, and one typo breaks connectivity in a way that's painful to find. VTP carries VLAN additions, deletions and renames in layer-2 frames along trunk links.

Domains

• A domain is one switch or a group of interconnected switches sharing a domain name.
• A switch belongs to exactly one domain. By default it has none until you set it or it learns one.
• VTP advertisements cannot cross a router — it is a layer-2 protocol on trunks.

The three modes

Pruning

By default a trunk carries traffic for every allowed VLAN. If the switch at the far end has no ports in VLAN 3, sending VLAN 3 broadcasts down that trunk is wasted bandwidth. VTP pruning stops broadcasts and unknown unicast for VLANs the neighbour doesn't need.

Versions

Authentication

• Same domain name and password on every switch or nothing syncs.
• Password is 8–64 characters, case sensitive, hashed to 128 bits with MD5.

Where VLANs actually live

On IOU they live in the VM's unix: folder instead. A full factory reset needs both commands — this catches people out constantly.

vtp mode {server | client | transparent}
vtp domain ENG
vtp version 2
vtp password 261434
vtp pruning

vlan 30
 name bachelor

show vtp status         ! mode, domain, version, revision, max VLANs
show vtp counters       ! how many ads sent/received
show vlan brief

Several cables acting as one link — more bandwidth, no STP drama.

The problem

A link is saturated. Two options: buy faster ports (expensive), or bundle the links you already have. Cisco calls the bundle an EtherChannel; the port-channel interface is the logical link you then configure.

Four benefits

• No hardware upgrade needed — reuse existing ports.
• Configure once, on the port-channel interface.
• Redundancy without reconvergence: losing one member does not change the topology, so STP does not recalculate.
• Load balancing across members of the same channel.

The two negotiation protocols

Bundles: desirable+auto · desirable+desirable · active+passive · active+active · on+on
Fails: auto+auto · passive+passive (nobody starts) · on + any negotiating mode (on sends nothing to answer)

silent vs non-silent (PAgP only): with auto or desirable, silent is assumed — the port may join a channel even without hearing PAgP from the partner, which suits file servers and packet analysers. Use non-silent when you know the partner speaks PAgP.

Reading the verification output

The slide's own example log: %EC-5-L3DONTBNDL2: Et0/1 suspended: LACP currently not enabled on the remote port — that's the far side not configured yet.

interface range Gi1/0/1 - 3
 switchport trunk encapsulation dot1q
 switchport mode trunk
 channel-protocol lacp
 channel-group 3 mode active     ! active|passive|desirable|auto|on

interface port-channel 3
 switchport trunk encapsulation dot1q
 switchport mode trunk

show etherchannel summary
show etherchannel 3 port-channel
show interfaces Gi1/0/1 etherchannel
show interfaces etherchannel

One box, three kinds of port.

The three port personalities

None of it routes until you enable ip routing. Verify a port's identity with show interface X switchport — "Switchport: Enabled" means L2, "Disabled" means routed.

ip routing

interface Gi1/0/24
 no switchport
 ip address 192.168.100.2 255.255.255.252

interface vlan 30
 ip address 192.168.30.1 255.255.255.0
 no shutdown

interface Gi1/0/3
 switchport
 switchport mode access
 switchport access vlan 30

show interface Gi1/0/24 switchport
show ip route

Three ways to let VLANs talk. Pick by port count.

The rule that drives everything

• Devices in the same VLAN must be in the same subnet.
• Devices in different VLANs must be in different subnets.
• So routing between VLANs is just routing between subnets — a Layer 3 job. A pure switch cannot do it.

The three methods

Router-on-a-stick, precisely

1. On the switch: make the link to the router a trunk.
2. On the router: bring the physical interface up with no shutdown — subinterfaces inherit its state.
3. Create one subinterface per VLAN. encapsulation dot1q {vlan-id} first, then the IP address.
4. That IP becomes the default gateway for every host in that VLAN.

The subinterface number (e.g. G0/0.1010) is only a label — the dot1q number is what actually matches the tag. Naming them after the VLAN just keeps you sane.

! ===== ROUTER-ON-A-STICK =====
interface G0/0
 no shutdown
interface G0/0.1010
 encapsulation dot1q 10
 ip address 192.168.10.1 255.255.255.0
 ipv6 address CAFE:1::1/64
 ipv6 address FE80::FACE:10 link-local
 ipv6 enable
interface G0/0.2020
 encapsulation dot1q 20
 ip address 192.168.20.1 255.255.255.0

! on the switch side
interface Gi0/1
 switchport mode trunk

! ===== LAYER 3 SWITCH =====
ip routing
interface vlan 30
 ip address 192.168.30.1 255.255.255.0
 no shutdown

show ip route
show vlan brief

Isolation inside a single VLAN, without new subnets.

The problem

Normally every host in a VLAN receives every broadcast and can reach every other host. To separate, say, 200 customers you could give each their own VLAN — but that means:

• A huge number of L3 interfaces and subnets, most of them nearly empty (wasted address space).
• A far more complicated Spanning Tree.
• Dozens of ACLs to maintain (management complexity).

The alternatives are a VACL (filter inside the VLAN) or a Private VLAN, which partitions the VLAN into subdomains.

The vocabulary

Configuration order (it matters)

1. Put the switch in VTP transparent mode — VTP does not carry private VLANs.
2. Create every secondary VLAN and label it isolated or community.
3. Create the primary VLAN and associate the secondaries to it.
4. Host ports: private-vlan host + host-association primary secondary.
5. Router/server port: private-vlan promiscuous + mapping primary secondary-list.
6. For routing, map the secondaries onto the primary's SVI.

You only ever need one isolated secondary per primary (isolated hosts are separate from each other anyway), but one community VLAN per group.

vtp mode transparent

vlan 201
 private-vlan isolated
vlan 202
 private-vlan community
vlan 100
 private-vlan primary
 private-vlan association 201,202
 ! later: private-vlan association add|remove {list}

interface Fa0/1                      ! a customer/host port
 switchport mode private-vlan host
 switchport private-vlan host-association 100 201

interface Fa0/24                     ! router / shared server
 switchport mode private-vlan promiscuous
 switchport private-vlan mapping 100 201,202

interface vlan 100                   ! let the SVI route the secondaries
 private-vlan mapping 201,202

show vlan private-vlan
show interface Fa0/1 switchport

Redundant links create loops. STP blocks the minimum number of ports to break every loop.

Why a loop is fatal — walk it through

Two switches A and B both connect segment A to segment B. PC1 (segment A) sends one frame to PC4, and neither switch knows either MAC yet:

1. A and B both receive it on gi1/0/1 and record PC1 → port 1/0/1.
2. Both decide to flood it.
3. Both flood it onto segment B. PC4 gets two copies — and A hears B's copy while B hears A's.
4. Both now relearn PC1 → port 1/0/2. The MAC table has flipped.
5. Still nobody knows PC4, so both flood again — back onto segment A.
6. Relearn, reflood, forever. One frame becomes an infinite storm.

How switches recognise each other: the BID

Bridge ID = 8 bytes: a 2-byte priority field followed by the 6-byte system MAC. Lower is better, and priority is compared first — the MAC only breaks ties.

BPDUs — the messages

• Sent to the multicast address 01-80-C2-00-00-00, source = the switch's own MAC, every 2 seconds by default.
• Configuration BPDU — builds and maintains the tree.
• TCN BPDU — announces that something changed.

Those four highlighted fields are literally the tie-break sequence you use to solve any STP question.

The algorithm — three elections

1. One root bridge per VLAN (with PVST+). Every port on the root becomes designated.
2. One root port on each non-root switch — its best way back to the root.
3. One designated port per network segment — the end closer to the root.

Anything that is neither a root port nor a designated port is blocked.

Election 1 — the root bridge

Every switch boots believing it is the root and advertises itself. As better BPDUs arrive they defer. Winner = lowest priority, tie → lowest MAC. A new switch with a lower BID can preempt an existing root at any time, which is why you set priorities manually (lecture 11).

Election 2 — root ports, and how cost accumulates

1. The root sends BPDUs with root path cost 0.
2. A neighbour receives it and adds the cost of the port it arrived on.
3. It re-advertises with the new cumulative cost, and so on outward.

IEEE 2004 defines larger "long" values for faster links; enable them with spanning-tree pathcost method long.

Decision sequence (identical for root and designated ports):

1. Lowest root path cost.
2. Lowest sender BID.
3. Lowest sender port priority (default 128).
4. Lowest sender port number.

Election 3 — designated ports

Each segment elects one designated port using the same sequence. A root port can never also be designated. Everything left over blocks.

Port states

Timers

Three kinds of topology change

1 · Direct — the switch physically sees a link go down.

1. A and C both detect the link down.
2. C removes its stored best BPDU and tries to send a TCN out its root port — but that was the failed link.
3. A (the root) sends a BPDU with the TC flag set; every switch relays it.
4. B and C shorten their MAC ageing from 300 s to 15 s so stale entries die fast.
5. C's blocked port becomes its best path and walks blocking → listening → learning → forwarding.

Downtime = 2 × Forward Delay = 30 s

2 · Indirect — the link stays up but traffic silently stops (a one-way failure).

1. Both ends still show "up", so no failure is detected and no TCN is sent.
2. C keeps its stored BPDU until Max Age expires and flushes it.
3. C waits to hear from the root again, and gets a configuration BPDU on its blocked port.
4. That becomes the new best entry; the port walks blocking → listening → learning → forwarding.

Downtime = 20 + 2 + 15 + 15 = 52 s

3 · Insignificant — cosmetic, e.g. a user reboots their PC.

1. C sees the access port go down and sends a TCN to the root.
2. The root acknowledges and floods a TC-flagged BPDU to everyone.
3. Every switch shortens MAC ageing and flushes idle entries — for no reason at all.

The family

show spanning-tree
show spanning-tree vlan 10
spanning-tree pathcost method long

Kill the 20-second Max Age wait after an indirect failure — by asking upstream "can you still reach the root?"

What it is for

• BackboneFast exists only for indirect failures — a link that dies somewhere you cannot see.
• It removes the Max Age timeout (20 s).
• It does not remove Listening and Learning, so you still pay 15 + 15.
• Result: recovery drops from 52 s to about 30 s.

The inferior BPDU — where it comes from

When a switch loses its connection to the root, it does the only thing it can: it declares itself the new root and advertises that. Since its claim is worse than the information neighbours already hold, that message is called an inferior BPDU. It is not a lie — it is a cry for help, and BackboneFast is the mechanism that hears it.

Without BackboneFast — why it takes 20 extra seconds

1. The A–B link fails indirectly. A never notices, so A sends no topology change.
2. B notices it has lost the root, declares itself root, and sends an inferior BPDU out of e3 toward C's port e4.
3. C's e4 is a blocked port. C ignores the inferior BPDU and simply keeps waiting — until the good BPDU it stored from A expires after 20 s (Max Age). Only then does e4 begin Listening and the tree rebuilds.

With BackboneFast — the RLQ conversation

1. Same indirect failure at A–B; A still says nothing.
2. B still declares itself root and sends the inferior BPDU to C.
3. C receives an inferior BPDU on a blocked port — the trigger. C immediately sends a Root Link Query (RLQ) out of its other candidate ports.
4. An RLQ Reply (RLQ R) comes back, confirming C can still reach the real root.
5. C moves e4 straight to Listening. No 20-second wait.

RLQ rules — memorise these two lists

The worked example from the slides

Where this sits in the timeline

spanning-tree backbonefast        ! global — enable on EVERY switch

show spanning-tree backbonefast   ! counters: inferior BPDUs, RLQ sent/received
show spanning-tree summary

Put the root where you want it, converge faster, and stop users breaking the tree.

Verification first — you cannot tune what you cannot see

Why the automatic root is usually wrong

Left alone, the root is decided by MAC address — effectively random, and often the oldest, slowest switch. The slide's example shows the consequence: workstations on switch B must cross into the core (D), back down to access (A), and up to the core again (C) just to reach the server farm, while 1 Gbps links sit unused. Put the root on a distribution switch, and the secondary root on its pair.

Setting the root — two ways

Extended system ID

Enabled by default. The 16-bit priority field is split: 4 bits of configurable priority (hence the 4096 steps) and 12 bits carrying the VLAN ID. So the value you see is:

displayed priority = configured priority + VLAN ID

Configured 4096 → VLAN 1 shows 4097, VLAN 10 shows 4106, VLAN 50 shows 4146. In Lab 09, 20480 in VLAN 10 shows as 20490. Turn it off with no spanning-tree extend system-id.

Tuning the path — three levers

Port ID = 16 bits: 8 bits of priority (0–255, default 128) + 8 bits of port number (starts at 1 and increases across modules). Shown as 128.4 in the Prio.Nbr column.

The three convergence accelerators

PortFast in detail. When a workstation powers on, the port normally crawls Blocking → Listening → Learning → Forwarding: at least 30 s, plus up to 20 s more if PAgP is negotiating. The PC has often given up on DHCP by then. PortFast shortens listening and learning to nothing, so the port forwards immediately. If a loop is ever detected on that port it still drops back to blocking, so it is safe as long as the port faces a host. The macro switchport host sets access mode + PortFast + disables PAgP in one line.

UplinkFast in detail. The access switch keeps a functioning root port plus one blocked backup, and swaps instantly when the primary dies. To guarantee it never becomes the root or a transit path it also raises the switch priority to 49152 and adds +3000 to every local port cost. Because of that it is not allowed on the root bridge.

BackboneFast in detail. It reacts to an inferior BPDU — one advertising a worse root, or a longer distance to it. Normally the switch would sit through Max Age before responding; BackboneFast checks immediately whether an alternate path exists.

The edge guards

Filter beats Guard: if both are on the same interface, BPDU filtering takes precedence and Guard never fires. Globally-enabled filtering is safer — the port simply loses PortFast if a BPDU appears; per-interface filtering ignores BPDUs completely, which is genuinely risky.

spanning-tree vlan 10 priority 20480
spanning-tree vlan 10 root primary
spanning-tree vlan 10 root secondary
spanning-tree extend system-id

interface Gi0/1
 spanning-tree cost 10
 spanning-tree port-priority 64

spanning-tree portfast default              ! all non-trunk ports
interface Fa0/11
 spanning-tree portfast
 switchport host                            ! macro

spanning-tree uplinkfast                    ! not on the root!
spanning-tree backbonefast

spanning-tree portfast edge bpduguard default
spanning-tree portfast bpdufilter default
interface Fa0/5
 spanning-tree bpdufilter enable
interface Gi0/2
 spanning-tree guard root

show spanning-tree summary [total]
show spanning-tree inconsistentports
show spanning-tree interface Fa0/11 portfast
show spanning-tree uplinkfast
show spanning-tree backbonefast

The dangerous failure is not a broken link — it's a link that goes quiet.

First, the complete list of port roles

The silent-failure problem

STP trusts BPDUs completely. A blocked port that stops receiving them assumes the topology changed: after Max Age it flushes the stored BPDU, transitions through the states, and starts forwarding. If the BPDUs stopped because of a fault rather than a real change, that port has just closed a loop. Worse, it now believes it is designated and starts sending BPDUs downstream when it should be listening upstream.

Loop Guard

• Watches non-designated ports. If BPDUs stop arriving, the port goes to loop-inconsistent blocking instead of forwarding.
• Recovers by itself the moment BPDUs return — no manual reset.
• Safe to enable everywhere: the switch works out which ports are non-designated on its own.
• Layer 2 only.

SPANTREE-2-LOOPGUARDBLOCK: No BPDUs were received on port 3/2 in vlan 3. Moved to loop-inconsistent state.
SPANTREE-2-LOOPGUARDUNBLOCK: port 3/2 restored in vlan 3.

UDLD — proving the link works both ways

Fibre uses two strands, and SFP/GBIC modules fail one direction at a time. Both switches still see "link up", but traffic only flows one way. UDLD sends layer-2 frames carrying the sender's port identity; the far end must echo them back with its own identity added. If that round trip completes, the link is genuinely bidirectional.

• Enabled globally, it only actually runs on fibre ports.
• Both ends must have it — one-sided UDLD disables nothing.
• On an EtherChannel it monitors each member link independently.

Loop Guard vs UDLD — the comparison the slide draws

Flex Links — the no-STP alternative

• Define an active/standby pair on an access switch; the standby carries nothing until the active dies.
• Failover in under 50 ms — far faster than any STP mechanism.
• STP is disabled on those ports; the pair replaces it.
• Layer 2 ports and port-channels only — not VLANs, not L3 ports.
• One backup per active interface. Members cannot be inside an EtherChannel, though two port-channels can be a Flex Links pair.

spanning-tree loopguard default        ! global
interface Gi0/1
 spanning-tree guard loop              ! per port

udld {enable | aggressive}             ! global, fibre ports
interface Gi0/1
 udld {enable | aggressive | disable}

interface Gi0/1
 switchport backup interface Gi0/2     ! Flex Links
 no spanning-tree vlan 1-4094

show spanning-tree interface Gi0/1 detail
show spanning-tree summary
show udld [interface]
show interface switchport backup

Same tree, built by handshakes rather than by waiting out timers.

Where it came from

802.1w evolved 802.1D for faster convergence. Cisco combined it with PVST+ to get Rapid PVST+ (also written RPVST+ or PVRST+), configured as rapid-pvst. RSTP is also the foundation of 802.1s MST. Root bridge election is unchanged from 802.1D — same BID, same lowest-wins rule.

Port roles — two new ones

Alternate = "if my root port dies I'll use this to reach a different switch". Backup = "my second cable onto the same wire". Backup only exists with hubs or shared segments, so it is rare in practice.

Port states — five become three

Port types

RSTP treats convergence as a chain of handshakes across point-to-point links — which is exactly why the port type matters.

Faster failure detection

• Every switch sends its own BPDUs every hello interval, rather than only relaying the root's.
• Miss 3 in a row and the neighbour is presumed down; all information about that port is aged out immediately.
• That is ≈ 6 seconds, versus Max Age 20 seconds in 802.1D.

Synchronisation — the proposal/agreement handshake

After BPDU exchange identifies the root, a switch receiving a superior BPDU makes that port its root port. For each non-edge port it then runs this sequence:

1. The sender has a superior BPDU, so the local switch accepts it as the designated switch and makes its own port the new root port.
2. It synchronises itself with the topology.
3. All non-edge ports move to Discarding — the switch deliberately isolates itself.
4. It sends an agreement back, confirming the designated-port choice.
5. The root port moves to Forwarding; the sender's port can forward too.
6. For each non-edge port still discarding, it sends a proposal to that neighbour.
7. It expects and receives an agreement back.
8. That port moves to Forwarding.

Topology changes in RSTP

spanning-tree mode rapid-pvst

interface Gi0/1
 spanning-tree link-type point-to-point   ! force; auto if full-duplex

interface Fa0/5
 spanning-tree portfast                   ! makes it an edge port

spanning-tree mode pvst                   ! back to classic

The same event, told twice: 802.1D takes 30 seconds, RSTP takes a handshake.

Reading a port-role diagram

The slide labels every port R (root), D (designated), A (alternate) or B (backup). Practise until you can label a diagram without thinking:

1. Mark the root bridge — every port on it is D.
2. On each other switch mark exactly one R (best cost home).
3. On each link, the end closer to the root is D.
4. A leftover port facing another switch is A; a leftover second port onto the same segment is B.

The TC mechanism, step by step

When a bridge detects a change:

1. It starts the TC While timer (2 × hello) on all non-edge designated ports and, if needed, its root port. That timer is how long it actively advertises the change.
2. It flushes the MAC addresses associated with those non-edge ports.
3. While the timer runs, every BPDU it sends carries the TC bit — including out of its root port.

When a bridge receives a TC BPDU:

1. It clears MAC addresses on all its ports except the one the TC arrived on.
2. It starts its own TC While timer and sends TC-flagged BPDUs out all designated ports and its root port.

The result: propagation is a one-step flood from whoever noticed, instead of 802.1D's two-step "notify the root, root notifies everyone". No waiting on the root at all.

Case study — adding a link between the root and switch A

Hundreds of VLANs but only a couple of distinct topologies — so run only a couple of trees.

The three approaches compared

The insight: with a given physical layout there are usually only two or three sensible topologies. Running a separate instance for every VLAN computes the same answers over and over.

Designing an MST deployment

1. Decide how many instances you need — usually one per useful topology (often 2).
2. Decide which VLANs map to each instance.
3. Root a different switch for each instance, so every uplink carries traffic.

Example: instance 1 = VLANs 11, 21, 31 rooted on switch A · instance 2 = VLANs 12, 22, 32 rooted on switch B.

Priority in MST

system ID priority = configured priority + instance number

Default priority with instance 10 → 32768 + 10 = 32778. Same idea as the extended system ID in lecture 11, but keyed on the instance instead of the VLAN.

Regions — the part that breaks in practice

A switch running MST must work out which of its neighbours share its configuration. Two switches are in the same region only if all three of these match exactly:

A port sits at a region boundary if the designated bridge on its segment belongs to a different region, or if it receives legacy 802.1D BPDUs. Normally a single region is enough for a whole campus.

spanning-tree mode mst
spanning-tree mst configuration
 show current                    ! what is applied now
 name XYZ
 revision 1
 instance 1 vlan 11, 21, 31
 instance 2 vlan 12, 22, 32
 show pending                    ! preview before applying
 end                             ! this applies it

! root per instance, on different switches
A(config)# spanning-tree mst 1 root primary
B(config)# spanning-tree mst 2 root primary

show spanning-tree mst
show spanning-tree mst 1 [detail]
show spanning-tree mst interface Gi0/1
show spanning-tree mst configuration
show spanning-tree summary