Training Cisco 200-125 CCNA v3.0. Day 37. STP: Root Bridge selection, PortFast and BPDU guard features. Part 2

Suppose STP is in a state of convergence. What happens if I take the cable and connect switch H directly to root switch A? Root Bridge “sees” that it has a new enabled port, and sends a BPDU over it.







Switch H, having received this frame with zero cost, will determine the cost of the route through the new port as 0 + 19 = 19, while the cost of its root port is 76. After that, the port of the switch H, which previously was disabled, will go through all stages of transition and switches to transfer mode after only 50 seconds. If other devices are connected to this switch, then all of them will lose the connection with the root switch and with the network as a whole for 50 seconds.



Switch G behaves in the same way, receiving a BPDU frame with a price notification 19 from switch H. It changes the value of its assigned port to 19 + 19 = 38 and reassigns it as a new root port, because the value of its old Root Port is 57, which more than 38. At the same time, all stages of port reassignment lasting 50 seconds begin again, and, ultimately, the entire network collapses.







Now let's look at what will happen in a similar situation when using RSTP. The root switch will also send the BPDU switch H connected to it, but immediately after that it will block its port. Having received this frame, switch N will determine that this route has a lower cost than its root port, and will immediately block it. After that, N will send the root switch Proposal with a request to open a new port, because its cost is less than the cost of the existing root port. After the root switch accepts the request, it unlocks its port and sends the Agreement to the switch H, after which the latter will make the new port its root port.







At the same time, thanks to the Proposal / Agreement mechanism, the reassignment of the root port will occur almost instantly, and all devices connected to the switch H will not lose connection with the network.

By assigning a new Root Port, switch H will turn the old root port into an alternate port. The same thing will happen with switch G - it will exchange Proposal / Agreement messages with switch H, assign a new root port and block the other ports. Then the process will continue in the next network segment with switch F.







Switch F, having analyzed the costs, will see that the route to the root switch through the lower port will cost 57, while the existing route through the upper port costs 38, and leaves everything as it is. Upon learning this, the G switch will block the port facing F and will forward traffic to the root switch along the new GHA route.



Until switch F receives a Proposal / Agreement from switch G, it will keep its lower port blocked to prevent loops. Thus, you see that RSTP is a very fast protocol that does not create the problems typical of STP on the network.

Now let's move on to reviewing the teams. You need to go into the global configuration mode of the switch and select the PVST or RPVST mode using the spanning-tree mode <pvst / rpvst> command. Then you need to decide how to change the priority of a particular VLAN. To do this, use the spanning-tree vlan <VLAN number> priority <value> command. From the last video tutorial, you should remember that the priority is a multiple of 4096, and by default this number is 32768 plus the VLAN number. If you select VLAN1, then the default priority will be 32768 + 1 = 32769.







Why might you need to change the priority of networks? We know that a BID consists of a numerical priority value and a MAC address. The MAC address of the device cannot be changed, it has a constant value, so you can only change the priority value.



Assume that there is a large network where all Cisco devices are connected in a circular pattern. In this case, PVST is activated by default, so the root switch will be selected by the system. If all devices have the same priority, then the switch with the oldest MAC address will have an advantage. However, it may be a 10-12 year old legacy switch, which does not even have the power and performance to “lead” such an extensive network.

At the same time, your network may have the latest switch for several thousand dollars, which, due to the larger MAC address, is forced to "obey" the old switch at a price of a couple of hundred dollars. If the old switch becomes the root switch, this indicates a serious network design error.



Therefore, you must go into the settings of the new switch and assign it a minimum priority value, for example 0. When using VLAN1, the total priority value will be 0 + 1 = 1, and all other devices will always consider it the root switch.



Now imagine such a situation. If for some reason the root switch becomes unavailable, you might want the new root switch to be not just any switch with the lowest priority, but some specific switch with the best network features. In this case, in the Root Bridge settings, a command is used that assigns the primary and secondary root switches: spanning-tree vlan <VLAN network number> root <primary / secondary>. The priority value for the primary switch Primary will be 32768 - 4096 - 4096 = 24576. For the secondary switch Secondary, it is calculated by the formula 32768 - 4096 = 28672.



You can not enter these numbers manually - the system will do this for you automatically. Thus, the root switch will be with priority 24576, and if it is unavailable, the switch with priority 28672, while the priority of all other switches is at least 32768 by default. This should be done if you do not want the system to automatically assign the root switch.



If you want to see the settings of the STP protocol, you need to use the show spanning-tree summary command. Let’s now take a look at all the topics we’ve learned today with Packet Tracer. I use the network topology from 4 switches model 2690, it does not matter, since all models of Cisco switches support STP. They are connected to each other so that the network forms a vicious circle.



By default, Cisco devices operate in PSTV + mode, that is, each port will require no more than 20 seconds for convergence. The simulation panel allows you to display traffic sending and view the operation parameters of the created network.







You see what the STP BPDU frame is. If you see the designation version 0, then you have STP, because version 2 is used for RSTP. Here is also the Root ID value, consisting of the priority and MAC address of the root switch, and the Bridge ID value equal to it.







These values ​​are equal, since the cost of the route to the root switch for SW0 is 0, therefore, it is itself the root switch. Thus, after switching on the switches due to the use of STP, the Root Bridge was automatically selected and the network worked. You see that in order to prevent a loop, the upper port of the Fa0 / 2 switch SW2 was set to Blocking, but this indicates the orange color of the marker.







Let's go to the SW0 switch settings console and use a couple of commands. The first is the show spanning-tree command, after entering which we will be shown on the screen information about the PSTV + mode for VLAN1. If we use several VLANs, another block of information for the second and subsequent used networks will appear at the bottom of the window.







You can see that STP is available under the IEEE standard, which means using PVSTP +. Technically, this is not a .1d standard. Root ID information is also provided here: priority 32769, MAC address of the root device, cost 19, etc. The following is Bridge ID information, in which the priority value 32768 +1 is decrypted, and a different MAC address follows. As you can see, I was mistaken - the switch SW0 is not a root switch, the root switch has a different MAC address given in the Root ID parameters. I think this is due to the fact that SW0 received a BPDU frame with information that some switch on the network has good reason to play the role of the root. Now we will consider it.



(translator's note: Root ID is the identifier of the root switch that is the same for all devices of the same VLAN running over STP, Bridge ID is the identifier of the local switch as part of Root Bridge, which can be different for different switches and different VLANs).



Another circumstance that indicates that SW0 is not a root switch is that the root switch does not have a Root Port, and in this case there is both a Root Port and Designated Port, which are in the forwarding state. You also see the type of connection p2p, or point-to-point. This means that the ports fa0 / 1 and fa0 / 2 are directly connected to neighboring switches.

If a port were connected to the hub, the connection type would be designated as shared, we will consider this later. If I enter the command to view the summary information of the show spanning-tree summary, we will see that this switch is in PVSTP mode, then the list of inaccessible port functions is listed.







The following shows the status and number of ports serving VLAN1: blocking 0, listening 0, learning 0, in the forwarding state in STP mode there are 2 ports.

Before proceeding to switch SW2, let's look at the settings of switch SW1. To do this, we use the same show spanning-tree command.







You see that the MAC address of the Root ID for switch SW1 is the same as for SW0, because all devices on the network get the same Root Bridge device address when converging, because they trust the choice made by the STP protocol. As you can see, SW1 is the root switch, because the Root ID and Bridge ID addresses are the same. In addition, there is a message "this switch is the root."



Another sign of the root switch is that it does not have Root ports, both ports are designated as Designated. If all ports are shown as Designated and are in forwarding state, then you have the root switch.



The SW3 switch contains similar information, and now I am switching to SW2 because one of its ports is in the Blocking state. I use the show spanning-tree command and we see that the Root ID information and priority value are the same as the rest of the switches.

The following indicates that one of the ports is Alternative. It doesn’t bother you, the 802.1d standard calls it the Blocking Port, and in PVSTP the blocked port is always indicated as Alternative. So, this alternative Fa0 / 2 port is in a blocked state, and the Fa0 / 1 port acts as a Root Port.



The blocked port is located in the network segment between switch SW0 and switch SW2, so that we do not form a loop. As you can see, the switches use a connection like p2p, because no other devices are connected to them.







We have a network that converges using the STP protocol. Now I will take the cable and connect the switch SW2 directly with the switch SW1. After that, all SW2 ports will be indicated by orange markers.







If we use the show spanning-tree summary command, we will see that at first the two ports are in the Listening state, then go into the Learning state and after a few seconds into the Forwarding state, with the marker color changing to green. If you now enter the show spanning-tree command, it can be seen that Fa0 / 1, which used to be a Root port, now went into a blocking state and became known as an Alternative port.







The Fa0 / 3 port, to which the root switch cable is connected, became the Root port, and the Fa0 / 2 port turned into the designated Designated port. Let's take another look at the convergence process in progress. I will disconnect the SW2-SW1 cable and return to the previous topology. You see that the SW2 ports are first blocked and again turn orange, then sequentially go through the Listening and Learning states and end up in the Forwarding state. In this case, one port turns green, and the second, connected to the switch SW0, remains orange. The convergence process took quite a long time, these are the costs of the STP.







Now let's look at how RSTP works. Let's start with the SW2 switch and enter the spanning-tree mode rapid-pvst command in its settings. This command has only two options: pvst and rapid-pvst, I use the second. After entering the command, the switch goes into RPVST mode, you can verify this with the show spanning-tree command.







At the beginning, you see a message that we now have the RSTP protocol running. Everything else remains unchanged. Then I have to do the same for all the other devices, and that's where the RSTP setup is done. Let's look at how this protocol works like we did for STP.



I reconnect the SW2 switch directly with the root switch SW1 with a cable — let's see how quickly the convergence happens. I type the show spanning-tree summary command and see that two switch ports are in Blocking state, 1 in Forwarding state.







You can see that the convergence happened almost instantly, so you can judge how much faster RSTP than STP. Next, we can use the spanning-tree portfast default command, which puts all switch ports in portfast mode by default. This is true if most switch ports are Edge ports that are directly connected to hosts. If we have some kind of port that is not Edge, we configure it back to spanning-tree mode.



To configure work with VLAN, you can use the spanning-tree vlan <number> command with priority parameters (sets the switch priority for the spanning-tree) or root (sets the switch as root). We use the spanning-tree vlan 1 priority command, specifying as a priority any number that is a multiple of 4096, in the range from 0 to 61440. Thus, you can manually change the priority of any VLAN.



You can type the spanning-tree vlan 1 root command with primary or secondary parameters to configure the primary or secondary root port for a particular network. If I use spanning-tree vlan 1 root primary, this port will be the main root port for VLAN1.



I will enter the show spanning-tree command, and we will see that this switch SW2 has priority 24577, the MAC addresses of the Root ID and Bridge ID are the same, which means that now it has become the root switch.







You see how quickly the convergence and change of role of switches occurred. Now I will cancel the main switch mode with the command no spanning-tree vlan 1 root primary, after which its priority will return to the previous value 32769, and the role of the root switch will again go to SW1.



Let's see how portfast works. I will enter the int f0 / 1 command, go into the settings of this port and use the spanning-tree command, after which the system will display hints for the parameter values.







Next, I use the spanning-tree portfast command, which can be entered with the disable parameters (disables the portfast function for this port) or trunk (enables the portfast function for this port even in trunk mode).



If you enter spanning-tree portfast, then the function will simply turn on on this port. To activate the BPDU Guard function, you need to use the spanning-tree bpduguard enable command, the spanning-tree bpduguard disable command disables this function.



I’ll quickly tell you one more thing. If for VLAN1 the interface of the switch SW2 in the direction of SW3 is blocked, then with other settings for another VLAN, for example, VLAN2, the same interface can become the root port. Thus, a traffic load balancing mechanism can be implemented in the system - in one case, this network segment is not used, in the other - it is used.



I will show what happens when a shared interface arises when a hub is connected. I will add a hub to the circuit and connect it to the SW2 switch with two cables.







The show spanning-tree command will reflect the following picture.







Fa0 / 5 (the lower left port of the switch) becomes the backup port, and the Fa0 / 4 port (the lower right port of the switch) becomes the designated designated port. The type of both ports is shared, or shared. This means that the hub switch interface segment is a common network.



Thanks to the use of RSTP, we got the separation of alternative and backup ports. If we switch the SW2 switch to pvst mode using the spanning-tree mode pvst command, we will see that the Fa0 / 5 interface is again in the Alternative state, because now there is no difference between the backup port and the alternative port.







It was a very long lesson, and if you do not understand something, I advise you to review it again.





Thank you for staying with us. Do you like our articles? Want to see more interesting materials? Support us by placing an order or recommending it to your friends, a 30% discount for Habr users on a unique analogue of entry-level servers that was invented by us for you: The whole truth about VPS (KVM) E5-2650 v4 (6 Cores) 10GB DDR4 240GB SSD 1Gbps from $ 20 or how to divide the server? (options are available with RAID1 and RAID10, up to 24 cores and up to 40GB DDR4).



Dell R730xd 2 times cheaper? Only we have 2 x Intel TetraDeca-Core Xeon 2x E5-2697v3 2.6GHz 14C 64GB DDR4 4x960GB SSD 1Gbps 100 TV from $ 199 in the Netherlands! Dell R420 - 2x E5-2430 2.2Ghz 6C 128GB DDR3 2x960GB SSD 1Gbps 100TB - from $ 99! Read about How to Build Infrastructure Bldg. class c using Dell R730xd E5-2650 v4 servers costing 9,000 euros for a penny?



All Articles