Comprendre les

protocoles STP et
RSTP
U n d e r s t a n d i n g STP a n d RSTP Protocols

1 Introduction

2 Concepte fondamentaux

3 Fonctionnement détaillé ST P 802. 1D

4 Améliorations de RSTP 802.1w

5 Mécanismes d'optimisation et de
sécurité
6 Implémentation et
v é r i fi c a t i o n
 Introduction
Explorer les fondations des réseaux sans boucle
Introduction

Aperçu des réseaux commutés

EthernetDéfis

La redondance physique améliore la fiabilité mais crée des risques de boucles de couche 2
Les boucles non gérées inondent les commutateurs avec des trames de diffusion (tempêtes
réseau)Solutions

Protocol Solutions

STP RSTP
Élimine les boucles en créant un arbre Convergence plus rapide (quelques
logique (convergence en 30-50 sec) secondes) avec les mêmes principes
Critical Concepts
que STP (normalisé en 2001)
Redondance : Assure la tolérance aux pannes mais nécessite une prévention
des boucles
Technical Focus Role STP/RSTP : Bloque dynamiquement les chemins redondants tout en
maintenant des routes de secours
BPDU (Bridge Protocol Data Unit): messages de contrôle pour le
Broadcast Storms: Les boucles non contrôlées dégradent les
calcul de topologie
performances ; STP les atténue en désactivant les liens redondants

"« Prévenir une boucle sauve un réseau » —

Introduction

Objectif du Spanning-Tree Protocol

Prévient les boucles de couche 2 Crée une topologie sans boucle Assure la stabilité du réseau
Élimine les tempêtes de diffusion Construit un chemin actif unique en bloquant Maintient la connectivité en recalculant
causées par les chemins redondants logiquement les liens redondants. automatiquement les chemins si un lien
dans les réseaux commutés. principal tombe en panne.

STP (802.1D) RSTP (802.1w)

Un mécanisme basé sur des temporisateurs entraînant une récupération
lente après des changements de topologie. Une évolution avec une convergence plus rapide grâce à un
processus actif de poignée de main.

Blocking → Listening → Learning → Forwarding

Propose / Agree Handshake

CONVERGENCE TIME

30-50s CONVERGENCE TIME

1-2s

"« Prévenir une boucle sauve un réseau

»
Introduction

Evolution a Rapid-STP
De secondes à sub-secondes : Le saut de convergence Amélioration Port Statut
STP (802.1D) Path
Blocking Listening Learning Forwarding

Visualiser le gain de performance de STP à RSTP. RSTP (802.1w) Path

Discarding
Learning Forwarding
(Replaces Blocking/Listening)

Core Enhancements
Handshake Mechanism
Propose/Agree Une séquence Proposer/Approuver sur les liaisons
point à point permet une transition immédiate du port vers l'état de
transmission, contournant les temporisateurs.

Enhanced Port Roles

Alternate & Backup Les ports Alternatif et de Secours fournissent des
chemins de secours pré-calculés pour un basculement instantané.

Active BPDU Processing

Les BPDU agissent comme des keepalives ; trois BPDU
manqués déclenchent une reconvergence rapide,
Fo n d a m e n t a u x P r i n c i p e s d e
base du protocole Spanning
Tr e e
Fundamental Concepts

Ponts, domaines de diffusion et

bouclesConcepts
Principe de conception Prévention des boucles

Ponts (Commutateurs)
Segmentent les domaines de collision mais créent un seul Root Bridge
domaine de diffusion, nécessitant une prévention des boucles.
Root Port Root Port

Domaines de diffusion
STP/RSTP assure qu'un seul chemin actif existe pour prévenir les
Switch A Switch B
tempêtes de diffusion paralysant le ré[Link] Blocked Port

Boucles de couche Termes critiques

Se produisent à partir de chemins redondants ; STP bloque des Messages de contrôle pour élire un pont racine
ports pour former une topologie logique sans [Link] BPDU
et calculer les chemins.

Identifiant de pont (Priorité + MAC) ; le BID le

BID
plus bas gagne l'élection du pont racine.Rôles
Impact des boucles

Les boucles non contrôlées provoquent des tempêtes de diffusion et une Définit la fonction : Racine, Désigné ou Bloqué
Port Roles
congestion du réseau. STP atténue cela, tandis que RSTP accélère la pour la prévention des [Link]
convergence..
Fundamental Concepts

Key Definitions: BPDU, BID, & Port ID

BPDU
A control message used by STP/RSTP to exchange network topology
Election Logic
information, containing root ID, path cost, and port roles.
1 Root Bridge
Switch with the lowest Bridge ID (BID) is elected.

BID
A unique switch identifier composed of Priority + MAC . The lowest BID 2 Root Port
wins the root bridge election. On non-root switches, the port with the lowest path
Example: 32768.d4c9.ef12.3456 cost to the root bridge.

3 Designated Port
Port ID One per network segment, determined by the best
A port-specific value made of Priority + Interface # , used as the BPDU received on that segment.
final tie-breaker in STP elections.

4 Blocked Ports
All other ports (Alternate/Backup) are blocked to
prevent loops.
Critical Values

Default STP Timers Path Cost Examples

Fundamental Concepts

STP Timers and Formulas

Key Timers in STP Operational Impact: Convergence Timeline

Hello Timer: 2 sec

Interval for sending BPDU configuration messages.
20 sec 15 sec 15 sec
Blocking (Max Age) Listening Learning
Forward Delay: 15 sec
Duration of Listening & Learning states before forwarding.
Total Convergence Time: ~50 seconds

Max Age: 20 sec

Time a switch stores a BPDU before discarding it as stale.
Example: Root & Cost
Default 100 Mbps link cost is 19. The root bridge is elected based on the
lowest Bridge ID (Priority + MAC Address).
Critical Formula

Configuration Note
Default timers are conservative. Adjust them carefully based on network size,
Max Age ≥ 2 × (Forward Delay + 1) topology, and specific Service Level Agreement (SLA) requirements.

Ensures stale BPDUs expire before a loop can be re-established on

a latent path.
STP 802.1D Detailed Operation
Exploring the Mechanics of Spanning Tree Protocol
STP 802.1D Detailed Operation

Port States and Timers

State Transition Flow (Total Convergence: 50s)

Disabled Blocking Listening Learning Forwarding

(Max Age: 20s) (15s) (15s)

Port States Explained Key Timers

Blocking: Does not forward data. Listens for BPDUs to determine the Hello Time: 2 seconds (Interval between BPDU transmissions).
network topology.
Forward Delay: 15 seconds (Time spent in Listening and
Listening: Prepares to forward data. Processes BPDUs to establish its Learning states).
role in the spanning tree.
Max Age: 20 seconds (Time a BPDU is considered valid before
Learning: Builds its MAC address table but still does not forward user being discarded).
data frames.

Forwarding: Fully operational. Forwards data and processes BPDUs.

STP 802.1D Detailed Operation

Root Bridge Election Algorithm

Election Example
Key Determinants: Bridge ID

Priority MAC Address

(Default: 32768) (Unique Value)
S1 (Root)
MAC: 0001...

Comparison Logic:
1. Lowest Priority value wins.
2. If priorities are equal, the lowest MAC address wins.

Process Flow
S2 S3 S4
1 Claim Root MAC: 0002... MAC: 0003... MAC: 0004...

All switches initially claim to be the root by sending Result: S1 wins root due to the lowest MAC address (assuming default priority 32768 for all).
Root Port: Direct link to Root. Blocked Port: Redundant path.
BPDUs.

2 Compare BIDs
Switches exchange and compare Bridge ID (BID) values Optimization Tip
from received BPDUs.
To ensure a specific switch becomes the root, manually configure its priority to

3 Elect Root a lower value. A common practice is setting it to 4096 , making its election
The switch with the lowest overall BID is elected as the deterministic and predictable.
STP 802.1D Detailed Operation

Example Calculation with Costs

Calculation Steps
Topology Scenario Root Bridge Selection: The switch with the lowest Bridge ID (BID) is
1
elected. (S1 in this case)

Root Port Selection: On non-root switches, the port with the minimal
S1 (Root Bridge) 2
BID: [Link] cumulative path cost to the root is chosen.
Cost: 200,000 Cost: 200,000
Designated Port Assignment: On each network segment, the port that
3
S2 S3 sends the best BPDU is assigned as designated.

Blocking Ports: All other ports that are not root or designated are put into
4
a blocking state to prevent loops.
S4

Key Formula
Port Roles & States
Root Ports: S2-F0/1, S3-F0/1, S4-F0/1
Cumulative Cost = Sum of individual link costs from the switch to the root
bridge. Link cost is inversely proportional to its bandwidth.
Designated
All ports on S1
Ports:
Blocked S2-F0/2, S3-F0/2 (on redundant link)
Ports:
Refer to Annex A for the complete cost table and detailed topology
diagram.
RSTP 8 0 2 . 1 w E n h a n c e m e n t s
Accel er ati ng Network C o n v e rg e n c e a n d
Stability
RSTP 802.1w Enhancements

New Port States: A Streamlined Approach

STP (802.1D) STATES NEW RSTP (802.1w)

STATE

Blocking Listening Discarding

Faster Convergence State Comparison: 802.1D vs. 802.1w

RSTP achieves sub-second convergence, a massive
improvement over STP’s 30–50 second delay, by STP 802.1D RSTP 802.1w
Action & Purpose
introducing new mechanisms and state transitions. State State

Blocking / Port discards data frames and does not learn MAC
Rapid Handshake Discarding
Listening addresses.
A Proposal/Agreement mechanism allows point-
to- point ports to quickly transition to forwarding, Port discards data frames but learns MAC
bypassing the traditional timer-based delays. Learning Learning
addresses to populate the CAM table.

Port is fully operational, learning MACs and

Forwarding Forwarding
forwarding data frames.
RSTP 802.1w Enhancements

Port Roles (Root, Designated, Alternate)

Example Topology
Root Port FORWARDING

Elected on non-root switches, this port provides the lowest cumulative path cost
to
the root bridge. It is the single best path towards the ROOT
root.
BRIDGE
S1
D D
Designated Port FORWARDING

Selected for each network segment. It forwards BPDUs and traffic onto
the segment. All ports on the root bridge are designated ports.

BLOCKED
A

S2 R R S4 D

Alternate Port DISCARDING

A backup for the root port. It provides a redundant path to the root bridge
but remains in a discarding state until the primary path fails. D R
S3

Operational Insights
New Discarding State: RSTP merges STP’s Blocking/Listening into a single Discarding
state.
Roles ensure a loop-free topology while enabling rapid
Role Determination: Roles are decided via BPDU comparison (Bridge ID, path cost, Port
failover.
ID).
RSTP 802.1w Enhancements

Handshake Mechanism (Proposal/Agreement)

Process Flow: Rapid Transition

Impact: Convergence Time Comparison
1. Proposal Sent
RSTP's handshake eliminates timer-based delays, dramatically reducing
A designated port sends a Proposal BPDU downstream to initiate a network reconvergence time after a topology change.
rapid transition.

2. Agreement Returned
If conditions are met, the receiving port blocks all other ports and
returns an Agreement BPDU.

3. Immediate Forwarding
The link immediately transitions to the Forwarding state, bypassing the
traditional 30-second Listen/Learn delay.

Conditions & Limitations

Point-to-Point Link
The handshake mechanism requires a direct connection between two switch ports.

Full-Duplex Operation
The link must be operating in full-duplex mode to prevent collisions.
Convergence time is reduced from 30–50 seconds in STP
Optimization a n d Security
MechanisE nm
h a ns
c i n g Network St abi l i t y a n d
Protection
Optimization and Security Mechanisms

PortFast and BPDU Guard

PortFast: Accelerate Port Activation BPDU Guard: Protect the Edge
Bypasses STP listening/learning states on edge ports (connected to A security feature that protects PortFast-enabled ports. It shuts down
end devices) for immediate transition to the forwarding state. the port by putting it in an `err-disable` state if any BPDU is received.

STP State Transition without PortFast: (~30s) Protection Mechanism:

Listening Learning Forwarding

With PortFast: (Immediate)

Edge Port BPDU Received err-disable
Forwarding

Command Examples: Command Examples:

Cisco: spanning-tree portfast Cisco: spanning-tree bpduguard enable

Huawei/HP: stp edged-port enable Huawei/HP: stp bpdu-protection

Best Practice & Security Impact

Always combine PortFast with BPDU Guard on edge ports to mitigate risks from rogue switches. This is critical for environments with
workstations, printers, and VoIP phones.

Monitor for alerts, such as Cisco's STP-2-BLOCK_BPDUGUARD log messages.

Optimization and Security Mechanisms

Root Guard and Loop Guard

Root Guard Loop Guard

Purpose: Prevents unauthorized switches from becoming the root Purpose: Mitigates loops from unidirectional link failures.
bridge.
Mechanism: Blocks ports if expected BPDUs are no longer received.
Mechanism: Blocks superior BPDUs on designated ports.

Result: Port enters a loop-inconsistent state, with auto-recovery.

Result: Port enters a root-inconsistent state (blocked) until the
threat resolves.
CLI Commands:
CLI Commands: Cisco: spanning-tree guard loop
Cisco: spanning-tree guard root HPE: stp loop-protection
Huawei: stp root-protection

Comparative Summary

Feature Trigger Condition Action Recovery

Root Guard Receives a superior BPDU Blocks the port Manual (threat removal)

Loop Guard Stops receiving BPDUs Blocks the port Automatic (BPDUs resume)
Optimization and Security Mechanisms

UDLD and Bridge Assurance

UDLD (Unidirectional Link Detection) Bridge Assurance
Detects physical fiber faults causing one-way traffic (Rx/Tx mismatch) to prevent An RSTP-specific feature ensuring bidirectional BPDU flow on all point-to-
Layer 2 loops by shutting down the affected port. point links, blocking ports if BPDUs cease to prevent silent failures.

Tx Rx BPDU

Switch A Rx Tx (Fault) Switch B

Switch A Switch B
BPDU

Operational Modes
Key Function
Aggressive: Automatically attempts to re-establish the link; if it fails, the
port is shut down. Scope: Applies to all STP/RSTP ports, including designated and root
ports.
Normal: Marks the port as unidirectionally linked but requires manual
Action: Blocks ports if BPDUs are no longer received, preventing
intervention to resolve.
stale topology information from causing loops.

Deployment Best Practices Command Syntax (Cisco IOS)

Enable UDLD on all fiber optic uplinks (core/distribution).
> udld aggressive
Combine with Loop Guard for comprehensive loop prevention.
Bridge Assurance is RSTP-specific; verify vendor compatibility. > spanning-tree bridge assurance
Both features require full-duplex links.
Implementation and Verification
Configuring and Validating Network Redundancy
Implementation and Verification

Configuration on Cisco, Huawei, & HPE

Key Commands Comparison

Cisco IOS-XE Huawei VRP HPE Comware 7

PortFast PortFast (Edged Port) PortFast (Edged Port)

spanning-tree portfast stp edged-port enable stp edged-port enable

BPDU Guard BPDU Guard BPDU Guard

spanning-tree bpduguard enable stp bpdu-protection stp bpdu-protection

Root Guard Root Guard Root Guard

spanning-tree guard root stp root-protection Not directly available

Loop Guard Loop Guard Loop Guard

spanning-tree guard loop stp loop-protection stp loop-protection

Verification Best Practices

Cisco: Enable BPDU Guard on all edge ports to prevent unauthorized
show spanning-tree vlan [ID] switches.

Use Root Guard on uplinks to maintain a predictable root bridge

Implementation and Verification

Interpreting `show spanning-tree` Output

Key Components in Output Sample Output Analysis (VLAN 10)

Bridge ID
Port Gi1/0/2: Role=Root, Cost=20000, State=Forwarding
A unique identifier composed of Priority + MAC address.
Port Gi1/0/3: Role=Designated, Cost=20000, State=Forwarding (PortFast)
E.g.,
Port Gi1/0/4: Role=Alternate, Cost=20000, State=Discarding (LoopGuard)
32768.d4c9.ef12.3456
Port Roles
Root: Lowest cost path to Root Bridge.
Designated: Forwards BPDUs on a segment.
Fields to Verify Troubleshooting Tips
Alternate/Backup: Blocked redundant path. Root Port:Optimal path to root. Check for BPDU
PortFast:
reception.
No superior BPDU
Port States (RSTP) Designated:
seen. Root Flap:Check BID conflicts.
Forwarding: Active & forwarding traffic.
Learning: Building the MAC table. LoopGuard:Active protection. Root Guard:Look for triggers.
Discarding: Not forwarding; prevents loops.
Implementation and Verification

Common Debugging and Log Analysis

Key Log Entries & Interpretation Critical Analysis Steps

STP-2-BLOCK_BPDUGUARD 1 Verify root bridge consistency across the network using show
PortFast enabled port received a BPDU, triggering an err-disable state spanning-tree root.
to prevent potential loops.
2 Check port roles and states, looking for any unexpected blocking
STP-4-LOOP_GUARD or forwarding behavior.
A potential loop is detected due to a unidirectional link failure or
BPDU timeout on a non-designated port. 3 Correlate log timestamps with known topology changes (e.g.,
fiber cuts, new switch additions).

Debugging Commands
Cisco IOS-XE: Example & Action
show spanning-tree vlan [ID]: Displays port roles, costs, and Sample Log Indicating LoopGuard Action:
states.
debug spanning-tree events: Provides real-time BPDU exchange Bridge ID 32768.d4c9.ef12.3456
Port Gi1/0/4: Role: Alternate | State: Reject (LoopGuard)
monitoring.

Huawei VRP / HPE Comware: Action Required:

display stp abnormal: Lists ports with violations like loop-guard or Investigate the physical path for BPDU loss or potential unidirectional link
BPDU guard. failures on the blocked port (Gi1/0/4).
Design Strategies and Best Practices
Building Resilient and Efficient Network Topologies
Design Strategies and Best Practices

Core/Distribution/Access Topology
Best Practices
Root Placement
Set Core switches as primary/backup roots for optimal
Core Layer
pathing (BID optimization). High-Speed
Backbone
Link Protection Priority: 4096 (Primary Root)
Use UDLD & Loop Guard on critical fiber links (Core- Example: 10G Links (Cost: 2000 )
Distribution).

Uplink Security
Enable Root Guard on uplinks from Access to
Distribution layers.

Distribution Layer
Convergence
Aggregation & Policy
RSTP Enabled Control
Priority: 8192 (Backup Root)
Achieve sub-second failover on point-to-point links. Example: 1G Links (Cost: 20000 )

Avoid Legacy Segments

Eliminate shared media/hubs in critical network paths.

Command Snippet
Access Layer
Design Strategies and Best Practices

VoIP and Data Center Scenarios

VoIP Environments Data Center Environments

Requires sub-second convergence to maintain call quality. RSTP is the High-speed links demand rapid failover and precise path cost
preferred protocol. configuration.

Best Practices: Best Practices:

Enable PortFast + BPDU Guard on all user-facing access ports. Set core switch priority to 4096 and backups to 8192 for deterministic
topology.
Apply Root Guard on distribution switches to protect root
bridge integrity. Use RSTP's Proposal/Agreement for instant convergence on point-
to-point links.
Use BPDU Filter cautiously on edge ports to prevent loops
while using PortFast. Enforce Loop Guard + UDLD on all redundant fiber uplinks.

Key Risks & Mitigations Command Examples

Cisco IOS
Risk: Hypervisor BPDU Filtering
Virtual switches may inadvertently drop BPDUs, causing loops. spanning-tree portfast bpduguard default
Mitigation: Selectively enable BPDU Filter on trusted hypervisor ports.
HPE Comware/ArubaOS

stp loop-protection enable

Risk: Unidirectional Fiber Failure
Practical E x er c i s e s a n d Quiz
Test Your U n d e r s t a n d i n g of S p a n n i n g Tree
Protocols
Practical Exercises and Quiz

Measuring Convergence Time

Typical Recovery Time: Typical Recovery Time:

STP (802.1D)
~50s RSTP (802.1w)
<1s
Sequentially passes through Listening and Learning Uses rapid Propose/Agree handshake to bypass
states upon link failure. intermediate states.

Metric: Packet Loss During Convergence Verification Commands

Cisco: show spanning-tree vlan

[ID]
display stp brief
Huawei:
display stp
HPE:

Testing Prerequisite
Ensure UDLD and Loop Guard are disabled for
accurate baseline convergence measurements.
Practical Exercises and Quiz

Handling Rogue Switches

Key Risks Detection Methods Mitigation Steps

Unauthorized switches disrupt
STP/RSTP by illegitimately becoming the BPDU Guard 1 Enable BPDU Guard on Edge Ports
Root Bridge. Blocks ports receiving
Cisco: spanning-tree bpduguard enable
unexpected BPDUs. Enabled
Causes: Incorrect BPDU ads, network Huawei: stp bpdu-protection
on user-facing edge ports.
loops, or traffic blackholing.

Root Guard 2 Deploy Root Guard on Uplinks

Impact if Ignored Prevents connected switches Cisco: spanning-tree guard root

from claiming the root role by
Network instability and prolonged blocking superior BPDUs.
3 Audit Logs Regularly
convergence.
Review logs to identify sources of
Creation of broadcast storms, leading to
Log Monitoring unauthorized BPDUs and other security
severe performance degradation. Alerts on events like err- events.
disable or
BLOCK_BPDUGUARD .
Practical Exercises and Quiz

Self-Assessment Questions
1. STP Basics 3. RSTP Mechanisms
What is the primary purpose of the Spanning Tree Protocol (STP) in Describe the "Propose/Agree" handshake process in RSTP and
a switched Ethernet network? its impact on convergence time.

Define BID (Bridge ID) and explain how it influences root bridge What are the roles of Backup and Alternate ports in RSTP
election. topology?

4. Configuration & Troubleshooting

2. Port States & Timers
Which command verifies STP/RSTP port roles and states on
Compare the port states in STP with RSTP. Cisco IOS-XE devices?
STP States: RSTP States: What action does BPDU Guard take when a BPDU is received on
Blocking Discarding a PortFast-enabled port?
Listening Learning
Learning Forwarding
5. Design Best Practices
Forwarding
Why is Root Guard recommended for uplink ports in a core-
What is the recommended formula for STP timers: Max Age ≥ 2 ×
distribution-access topology?
Forward Delay − 1 ?
When should UDLD (Unidirectional Link Detection) be avoided in
copper-based networks?

* Answers should reference STP/RSTP principles, timer settings, and security mechanisms. *