Lab Manual: Spanning Tree Protocol (STP)
1. Objectives
By the end of this lab, students will be able to:
Understand the operation and purpose of Spanning Tree Protocol (STP).
Configure and verify STP on multiple switches.
Select and verify Primary and Secondary Root Bridges using switch priority.
Implement PortFast, BPDU Guard, and Root Guard for loop prevention.
Observe port roles (root, designated, blocked) and redundant link behavior
2. Network Topology
Use five switches with redundant links as shown below:
SW1 → Primary Root Bridge
SW2 → Secondary Root Bridge
SW3, SW4, SW5 → Access Switches
Optionally connect PCs to access ports on SW3–SW5 for testing.
3. Devices Required
Device Type Quantity
Cisco Switch (2960/3560) 5
PCs (optional) 4–6
Ethernet Cables As required
4. Basic Configuration
Apply to all switches before enabling STP features:
Switch> enable
Switch# configure terminal
Switch(config)# hostname SWx # Replace x with switch number (for example SW1)
Switch(config)# spanning-tree mode pvst
Switch(config)# end
Switch# write memory
5. Configure Primary and Secondary Root Bridges
Primary Root Bridge (SW1):
SW1(config)# spanning-tree vlan 1 root primary
Secondary Root Bridge (SW2):
SW1(config)# spanning-tree vlan 1 root secondary
Verify:
SW2# show spanning-tree
6. Configure STP Protection Features
a. PortFast (Enable on Access Ports Only)
Enable on ports connected to end devices (not switches):
SW3(config)# interface range fa0/1 - 2
SW3(config-if-range)# spanning-tree portfast
PortFast allows ports to move directly to forwarding state without delay
b. BPDU Guard (Protect PortFast Ports)
Enable BPDU Guard on the same access ports:
SW3(config-if-range)# spanning-tree bpduguard enable
If a BPDU is received on these ports, the port will automatically disable (err-disable) to
prevent loops.
c. Root Guard (Prevent Unauthorized Root Bridges)
Apply on designated ports facing downstream switches:
SW1(config)# interface fa0/5
SW1(config-if)# spanning-tree guard root
Root Guard ensures SW1 remains the Root Bridge even if another switch sends superior
BPDUs.
7. Verification Commands
Purpose Command
Show general STP information show spanning-tree
Display current root bridge show spanning-tree root
View port roles and states show spanning-tree interface
Check detailed port info show spanning-tree interface detail
Verify BPDU Guard status show errdisable recovery
8. Testing Redundancy
1. Verify normal operation:
o Use show spanning-tree on all switches.
o Observe Root Ports and Blocked Ports.
2. Simulate a link failure:
o On any switch, shut down an uplink interface:
o SW3(config)# interface fa0/24
o SW3(config-if)# shutdown
o Observe that STP recalculates and unblocks alternate ports.
3. Reconnect the link:
o Bring the port back up:
o SW3(config-if)# no shutdown
o STP automatically restores redundancy.
9. Expected Results
SW1 is the Root Bridge, and SW2 is Secondary Root Bridge.
Each non-root switch has one Root Port and one or more Blocked Ports.
When a redundant link fails, STP reconverges and traffic continues.
PortFast ports transition instantly to forwarding.
BPDU Guard disables any port receiving BPDUs from unauthorized devices.
Root Guard prevents other switches from taking over as the root.