Configuring Interface STP Attributes

Real World Application & Core Knowledge

Now that you are familiar with the basic operation of PVST, Rapid-PVST and MST its time to take another step down the sidewalk of complex avenue. There are several interface configuration commands specific to spanning tree on the Cisco Catalyst Series switches. This lab will discuss and demonstrate the following features; STP bpdufilter, STP interface cost, STP interface link-type and STP interface port-priority.

Lets first started with Spanning-Tree BPDUFilter. This feature is quite useful in some scenarios where you do not want send or process received BPDU’s out a particular port on a Cisco switch. The use of this command can however be very dangerous as a wrongful configuration can result in a layer two switching loop until spanning-tree re-converges based on the new information.

An example scenario for using BPDUFilter could be that your corporate policy mandates that host ports on the network should never receive BPDU’s from the access switches. To abide by this policy BPDUFilter must be enabled. This prevents the sending and processing received BPDU’s. Take not that in a policy requirement like this you want to ensure that no rouge switches are connected to the network which is done by BPDU Guard as previously discussed in Lab 4-17 – Configuring Switchport BPDU Guard.

The spanning-tree cost interface configuration will statically set the cost of the interface so that it modifies the spanning-tree root port election process. On a switch with multiple equal cost links to the root bridge, setting the cost statically on a switchport can be the tie breaker to determine which port becomes the root port.

The spanning-tree link-type interface configuration statically configures the link-type on a per interface basis. The Rapid in Rapid Spanning Tree Protocol makes this concept quite simplistic. By default the link type is derived from a ports duplex. Full duplex is considered a point to point link whereas half duplex is considered a “shared” medium. So why is Rapid, rapid on rapid-spanning-tree? The old 802.1d standard took up to 45 seconds to set the port in forwarding mode, whereas 802.1s now transitions the port to designated (forwarding) very quickly. If a link-type is set to p2p then the RSTP does its think and quickly transitions the port into forwarding however if the link-type is half-duplex or configured as “shared” in interface configuration mode by using the spanning-tree link-type shared then the switch does not transition the port quickly. It goes through the entire process of determining rather or not a port poses a potential layer two network loop.

Configuring spanning-tree port-priority in interface configuration mode statically configures the port-priority used as a tie breaker for switches with multiple redundant links to a particular network segment where the root bridge can be reached.. So the question is, is if you have multiple links to a root bridge from a single switch and each link has the exact same cost, how does the switch know which link to use as the “root” port? The tie breaker is done by port-priority. If you do a show spanning-tree vlan # you’ll notice that Prio.Nbr is between cost and type. The priority is by default set to 128 on all Catalyst series switches and the Nbr is the port number. For example SW1 and SW2 are connected via Fa0/10, Fa0/11 and Fa0/12. All ports have the same cost so the port-priority will determine which port becomes the root, which in this case Port Fa0/10 will be the root port, Fa0/11 and Fa0/12 will be alternate ports (blocking).

Now that you have a basic understanding of some of the STP interface specific configurations you need to familiarize yourself with the following commands below;

Lab Prerequisites

Lab Objectives

Lab Instruction

Step 1. – Configure BPDUFilter on SW2 interface Fa0/10 then verify it by using BPDU Guard on SW1 Fa0/10. Once completed remove the BPDUFilter and BPDUGuard before proceeding.

To configure bpdufilter you’ll use the spanning-tree bpdufilter enable command in interface configuration mode as shown below;

SW2 con0 is now available



Press RETURN to get started.



SW2>enable
SW2#configure terminal
Enter configuration commands, one per line.  End with CNTL/Z.
SW2(config)#interface fa0/10
SW2(config-if)#spanning-tree bpdufilter enable

To verify that BPDUFilter is operating properly you can enable BPDUGuard on SW1 interface Fa0/10 then bounce the interface. As previously stated in the lab BPDUFilter prevents transmitting and processing received BPDU’s on a particular port. Since no BPDU’s will be sent out SW2 interface Fa0/10 then SW1 Fa0/10 will not shut down as BPDU’s wont be detected as shown below;

SW1 con0 is now available



Press RETURN to get started.



SW1>enable
SW1#configure terminal
Enter configuration commands, one per line.  End with CNTL/Z.
SW1(config)#interface fa0/10
SW1(config-if)#spanning-tree bpduguard enable
SW1(config-if)#shutdown
SW1(config-if)#
%LINK-5-CHANGED: Interface FastEthernet0/10, changed state to
administratively down
%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/10, changed
state to down
SW1(config-if)#no shut
SW1(config-if)#
%LINK-3-UPDOWN: Interface FastEthernet0/10, changed state to up
SW1(config-if)#
%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/10, changed
state to up
SW1(config-if)#exit
SW1(config)#exit

As shown above you can see that the interface Fa0/10 did not go into err-disabled state as no BPDU’s were received since Fa0/10 on SW2 is configured to filter BPDU’s (Not send them).

But however if you check over on SW3, you’ll notice that all interfaces have been shutdown into Err-Disabled state as SW3 has detected a loop in the network. Ethernet by default sends a loopback keepalive out each interface every ten seconds. If this keepalive is received back on the same interface the the interface goes into Err-Disabled mode as a physical topology loop has been detected.

This occurs due to spanning-tree not blocking that interface and forwarding all traffic out the interface. Since this happens frames loop back around in the network and SW3 detects it.

You’ll need to remove BPDUGuard off SW1 Fa0/10 and BPDUFilter off SW2 Fa0/10, then bounce interfaces fa0/10, fa0/11, fa0/13 and fa0/14 on SW3 as shown below before proceeding as they are in Err-Disabled state;

SW1(config)#interface fa0/10
SW1(config-if)#no span bpduguard enable
SW1(config-if)#end
SW1#

SW2(config)#interface fa0/10
SW2(config-if)#no span bpdufilter
SW2config-if)#end
SW2#

SW3 con0 is now available



Press RETURN to get started.



SW3>enable
SW3#configure terminal
Enter configuration commands, one per line.  End with CNTL/Z.
SW3(config)#interface range fa0/10 , fa0/11 , fa0/13, fa0/14
SW3(config-if-range)#shutdown
SW3(config-if-range)#
%LINK-5-CHANGED: Interface FastEthernet0/10, changed state to administratively down
%LINK-5-CHANGED: Interface FastEthernet0/11, changed state to administratively down
%LINK-5-CHANGED: Interface FastEthernet0/13, changed state to administratively down
%LINK-5-CHANGED: Interface FastEthernet0/14, changed state to administratively down
SW3(config-if-range)#no shutdown  
SW3(config-if-range)#
%LINK-3-UPDOWN: Interface FastEthernet0/10, changed state to up
%LINK-3-UPDOWN: Interface FastEthernet0/11, changed state to up
%LINK-3-UPDOWN: Interface FastEthernet0/13, changed state to up
%LINK-3-UPDOWN: Interface FastEthernet0/14, changed state to up
SW3(config-if-range)#end
SW3#

Step 3. – SW3 Interface Fa0/10 is connected to a 10/100Mbps hub then the hub is connected to SW1. Configure the link type accordingly and verify your configuration.

As discussed in the Lab core knowledge section; link-type on Rapid Spanning Tree Protocol determines rather or not the interface is rapidly transitioned into forwarding state or not. To configure link type on a particular interface use the spanning-tree link-type command followed by the link type point-to-point or shared as shown below;

SW3#configure terminal
Enter configuration commands, one per line.  End with CNTL/Z.
SW3(config)#int fa0/10
SW3(config-if)#spanning-tree link-type shared 
SW3(config-if)#end
SW3#
%SYS-5-CONFIG_I: Configured from console by console
SW3#

To verify the link-type of a particular interface use the show spanning-tree vlan # command as shown below;

SW3#show spanning-tree vlan 1

VLAN0001
  Spanning tree enabled protocol rstp
  Root ID    Priority    24577
             Address     0014.f2d2.4180
             Cost        19
             Port        10 (FastEthernet0/10)
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec

  Bridge ID  Priority    32769  (priority 32768 sys-id-ext 1)
             Address     0014.a964.2e00
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec
             Aging Time  300 sec

Interface           Role Sts Cost      Prio.Nbr Type
------------------- ---- --- --------- -------- ---------------------------
Fa0/10              Root FWD 19        128.10   Shr 
Fa0/11              Altn BLK 19        128.11   P2p 
Fa0/13              Desg FWD 19        128.13   P2p 
Fa0/14              Desg FWD 19        128.14   P2p 


SW3#

Step 4. – Assuming SW2’s interface Fa0/10 and Fa0/11 are configured with their defaults for spanning tree, the root port will become Fa0/10. Influence spanning-tree to use interface Fa0/11 and do not use the cost command.

To complete this objective you’ll need to change the port priority number as cost cannot be changed. the lowest priority number port wins the root port election if all costs on the redundant links to the root bridge are equal as shown below;

SW1#configure terminal
Enter configuration commands, one per line.  End with CNTL/Z.
SW1(config)#interface fa0/11
SW1(config-if)#spanning-tree port-priority 64
SW1(config-if)#end
SW1#
%SYS-5-CONFIG_I: Configured from console by console
SW1#

To verify that the priority does manipulate the root port selection on SW2 to Fa0/11 instead of Fa0/10 use the show spanning-tree vlan # command as shown below;

SW2#show spanning-tree vlan 1

VLAN0001
  Spanning tree enabled protocol rstp
  Root ID    Priority    24577
             Address     0014.f2d2.4180
             Cost        19
             Port        13 (FastEthernet0/11)
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec

  Bridge ID  Priority    32769  (priority 32768 sys-id-ext 1)
             Address     001c.57d8.9000
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec
             Aging Time  300 sec

Interface           Role Sts Cost      Prio.Nbr Type
------------------- ---- --- --------- -------- ---------------------------
Fa0/10              Altn BLK 19        128.12   P2p 
Fa0/11              Root FWD 19        128.13   P2p 


SW2#

Keep in mind that the port-priority is propagated from switch to switch via BPDU’s. So when you want influence a traffic transit path you must configure the port-priority on the advertising switch. In this case, SW1 is advertising two traffic paths to the root bridge, but interface Fa0/11 is now advertising a better port priority and therefore will be selected as the root port on SW2.