Differences

This shows you the differences between two versions of the page.

--- networking:stp [2025/12/03 15:20] – v1ctor
+++ networking:stp [2025/12/03 16:11] (current) – [Root Guard] v1ctor
@@ Line 1: / Line 1: @@
 ====== STP ======
+==== Algorithm ====
 How it works:
@@ Line 11: / Line 13: @@
   - All non-Root switches will elect a **Root** port - port closest to the Root switch
     - Root port is having the smallest **Cost** to the Root switch (cost is based on the speed)
     - If there are parallel links, port with the smallest number wins
+  - On all non-Root switches, elect //Designated// port and define //Blocked// ports
+    - //Designated// port is the port closest (cost-wise) to the Root
+    - If cost is the same - the port on the switch with lowest System-MAC becomes a //Designated// port
+==== Port States ====
+  - Disabled
+  - Listening - switch sends and receives BPDUs. It lasts 15 seconds and it's where Root is elected
+  - Learning - switch is building MAC address table. Also lasts 15 seconds
+  - Forwarding
+    - Root Port
+    - Designated Port
+==== During Failure ====
+Root port sends BPDUs every 2 seconds. If non-root switch stops receiving BPDUs over Root port for 20 seconds, it starts the //Listening// and //Learning// process on the //Blocked// port. Failover time is 50 seconds.
+==== RSTP ====
+RST improves convergence time. Instead of having a //Blocked// port and spending too much time in //Listening// and //Learning//, we have **Alternate** port. Basically it's a second best port if Root port fails. When Root port fails, switch waits **max time out** (20 seconds) and starts forwarding traffic over the new Root port
+==== PORT-FAST ====
+When port flaps, switch sends TCN (topology change notification) message, which forces all switches to re-calculate the root switch. This is not very efficient when port towards the client flaps. In order to mitigate that, customer facing port is configured with **spanning-tree portfast**. This port will be always on (forwarding).
+==== BPDU Guard ====
+We should not receive BPDUs on the customer facing ports. There is a feature which sets the port to **err-disabled** state if switch receives a BPDU on that port.
+==== Root Guard ====
+Configuration on the Root switch to protect hijacking the Root role. Configured on the ports.
+==== MSTP ====
+Instead of sending BPDU for each VLAN, MSTP aggregates VLANs into the instances and send a single BPDU for that group.
+On Arista, by default MST instance 0 is created and all VLANs belong to that instance.