CCNA Rapid PVST+: Root Bridge Election, Port Roles, PortFast and the Three Spanning-Tree Guards

Spanning tree questions reward a fixed routine. Elect the root, give every other switch a root port, give every link a designated port, and whatever is left discards. Most mistakes come from skipping a step or from mixing up which guard goes on which port.

What CCNA v2.0 objective 2.5 covers on spanning tree

The v2.0 exam topics, which apply from February 3, 2027, list objective 2.5: "Configure operations of the Rapid Per VLAN Spanning Tree Protocol (Rapid PVST+)," with four sub-items: root port, root bridge (primary/secondary) and other port names; port states and roles; PortFast; and root guard, loop guard and BPDU guard.

The v1.1 outline, in use through February 2, 2027, has the same sub-items under "interpret basic operations," and it also names BPDU filter. So v2.0 asks for configuration, not just recognition, and drops BPDU filter from the list.

Rapid PVST+ is what you'll meet on current Cisco switches: Cisco's Catalyst 9300 spanning-tree guide lists it as the default mode. It runs a separate spanning-tree instance for each VLAN, so the root and the port roles can differ from VLAN to VLAN.

How the root bridge is elected

Every switch has a bridge ID for each VLAN. Cisco's guide describes its parts: a priority, an extended system ID equal to the VLAN number, and the switch's MAC address. The election rules:

• Lowest bridge ID wins. In practice that means the lowest priority, and if priorities tie, the lowest MAC address.
• The default priority is 32768. Because the VLAN number is added through the extended system ID, a switch with default settings shows 32778 for VLAN 10.
• Priority moves in steps of 4096, from 0 to 61440. Cisco's guide says other values are rejected.

Two ways to choose the root yourself:

spanning-tree vlan 10 root primary
spanning-tree vlan 10 root secondary
spanning-tree vlan 10 priority 4096

Cisco's guide says root primary sets the priority to 24576 if that value makes the switch root for the VLAN, and root secondary sets 28672, so that switch takes over if the primary fails while the others keep 32768. Setting priority directly is the alternative; Cisco recommends the primary and secondary commands for most situations.

Root ports, designated ports and alternate ports

After the root is known, roles follow in a fixed order:

1. Root port: each non-root switch picks the one port with the lowest total path cost to the root. Ties go to the neighbor with the lowest bridge ID, then the neighbor's lowest port ID.
2. Designated port: each link gets one, on the switch with the lowest path cost to the root from that link. Ties go to the lower bridge ID. All of the root bridge's own ports are designated.
3. Everything else is an alternate port, or a backup port if the switch has two ports on the same shared segment.

Cisco's RSTP document defines the roles in one line each. A root port receives the best BPDU on the bridge. A designated port can send the best BPDU on its segment. An alternate port receives more useful BPDUs from another bridge and is blocked. A backup port receives more useful BPDUs from the same bridge and is blocked.

Path costs come from link speed, and two scales are in use:

The Catalyst 9300 guide for IOS XE 17.12 says the short method is the default yet shows long-method values in its defaults table, so check show spanning-tree summary on your own switch. On the exam, use the costs a question gives or shows. The comparison works the same way on either scale.

Port states in Rapid PVST+

Rapid PVST+ is built on IEEE 802.1w. Cisco's RSTP document says the older 802.1D disabled, blocking and listening states merge into a single discarding state, which leaves three:

The same document explains why RSTP converges quickly: rapid transition to forwarding happens on edge ports and point-to-point links. A full-duplex port is treated as point-to-point, and a half-duplex port as shared, by default. Edge ports are what Cisco configures with PortFast.

Roles and states are worth drilling until they're automatic. 200 Switching and Network Access questions are planned for launch, covering spanning tree alongside the rest of the domain.

PortFast, BPDU guard, root guard and loop guard

Cisco's optional spanning-tree features guide describes each feature. The table is Passy's summary of where each one belongs:

The commands, with notes from Cisco's guide:

• PortFast: spanning-tree portfast on an access port, spanning-tree portfast trunk on a trunk to a server, or spanning-tree portfast default globally for all nontrunking ports. Cisco warns to use it only toward a single end station, because on a link to a switch or hub it can hide a loop. Configuring a voice VLAN turns PortFast on automatically.
• BPDU guard: spanning-tree portfast bpduguard default enables it globally on PortFast ports, or spanning-tree bpduguard enable on one interface, which works even without PortFast.
• Root guard: spanning-tree guard root on the interface.
• Loop guard: spanning-tree loopguard default globally, or spanning-tree guard loop on an interface, as Cisco's loop guard document shows. Cisco says loop guard and root guard can't be enabled together on the same port.

If you're testing on v1.1, BPDU filter is still in your outline. Cisco's guide warns that enabling it on an interface is the same as disabling spanning tree there.

Original CCNA spanning-tree practice: three switches, one VLAN

Written by Passy for practice; not taken from any Cisco exam. Three switches connect in a triangle with 1 Gbps links, all carrying VLAN 10:

• SW1: priority 32768, MAC 0011.1111.1111. G1/0/1 to SW2, G1/0/2 to SW3.
• SW2: priority 32768, MAC 0022.2222.2222. G1/0/1 to SW1, G1/0/2 to SW3.
• SW3: priority 28672, MAC 0033.3333.3333. G1/0/1 to SW1, G1/0/2 to SW2.

Question 1: Which switch is root, and what is each port's role in VLAN 10?

• Root: SW3, the lowest priority. The MAC addresses don't matter because the priorities differ.
• Root ports: SW1 G1/0/2 and SW2 G1/0/2, the direct links to SW3. The path through the other switch costs two links instead of one.
• SW3's ports: both designated, as on any root bridge.
• The SW1–SW2 link: both switches are one link from the root, so the lower bridge ID wins the designated role. Priorities tie, and SW1 has the lower MAC address. SW1 G1/0/1 is designated; SW2 G1/0/1 is alternate and discarding.

Question 2: An engineer enters spanning-tree vlan 10 root primary on SW1. What changes?

• SW1's priority becomes 24576, which is lower than SW3's 28672, so SW1 becomes root.
• SW2 and SW3 now use their direct links to SW1 as root ports: SW2 G1/0/1 and SW3 G1/0/1.
• On the SW2–SW3 link, both are one link from the root. SW3's priority, 28672, is lower than SW2's 32768, so SW3 G1/0/2 is designated and SW2 G1/0/2 is alternate.

Verify a lab version with show spanning-tree vlan 10, which lists the root ID, the local bridge ID and each port's role, state and cost. Numbers like 32768, 24576 and 28672 are worth memorizing outright, and flashcards sorted by domain, planned for full CCNA prep, are meant for that kind of quick recall.

Building spanning-tree confidence for the CCNA

1. Draw before you configure. For any topology, write down root, root ports, designated ports and alternates, then check with show spanning-tree vlan.
2. Move the root on purpose with root primary, root secondary and priority, and predict every role change first.
3. Trigger each guard in a lab: connect a switch to a BPDU guard port, send a superior BPDU into a root guard port, and watch show interfaces status err-disabled and show spanning-tree. The CCNA lab practice guide compares Packet Tracer and Cisco Modeling Labs for this.

The 20 free CCNA practice questions include a BPDU guard item with an explanation of why root guard and loop guard don't fit. For mixed review once the rules feel automatic, a No-Miss Run challenge, planned for launch, is one of the focused challenges built into full prep. Checkout isn't open yet.