Skip to content

Lab 08 — Spanning Tree and Layer 2 Redundancy

Item Details
Lab 08
Lab Name Spanning Tree and Layer 2 Redundancy
Track CompTIA Network+
Difficulty Intermediate
Estimated Time 120–150 minutes
Primary Role Network Technician / Junior Network Administrator
Environment Network+ Redundant Switching Lab
Primary Systems NETPLUS-ADMIN, NETPLUS-CLIENT01, NETPLUS-SERVER01, NETPLUS-SW01, NETPLUS-SW02, NETPLUS-SW03
Primary Tools Managed Switch CLI, Wireshark, ping, MAC-table inspection
Skills STP, RSTP Concepts, Root Bridge, Root Port, Designated Port, Alternate/Blocked Port, Path Cost, Redundancy, Loop Prevention, Reconvergence

Mission Objective: Build a redundant Layer 2 topology and use Spanning Tree Protocol to maintain resiliency without creating Ethernet loops or broadcast storms.

GHC Enterprise wants to improve network availability.

The existing topology contains a single switch path.

That creates a risk:

Switch Failure
Network Outage
The network team wants redundant links.

You build:

NETPLUS-SW01
/ \
/ \
/ \
NETPLUS-SW02-----NETPLUS-SW03

Endpoints connect to the switches:

CLIENT01
|
SW02
SERVER01
|
SW03
ADMIN
|
SW01

This improves redundancy, but creates another problem.

The three switch links form a:

Layer 2 Loop

Without loop prevention, Ethernet frames could circulate indefinitely.

Your mission is to configure, observe, and troubleshoot:

Redundant Links
Spanning Tree
Logical Blocking
Loop-Free Topology
Automatic Failover

By completing this lab, you will be able to:

  • explain why Layer 2 loops are dangerous

  • understand broadcast storms

  • understand MAC-table instability

  • explain Spanning Tree Protocol

  • identify the root bridge

  • understand bridge ID

  • understand bridge priority

  • identify root ports

  • identify designated ports

  • identify alternate or blocked paths

  • understand STP path cost

  • verify the active forwarding topology

  • observe STP convergence

  • test redundant-link failure

  • observe reconvergence

  • understand Rapid Spanning Tree concepts

  • troubleshoot incorrect root-bridge selection

  • troubleshoot blocked and forwarding ports

  • document a loop-free redundant topology

Create:

NETPLUS-SW01
/ \
/ \
/ \
NETPLUS-SW02-----NETPLUS-SW03

Connect endpoints:

NETPLUS-ADMIN
|
|
NETPLUS-SW01
NETPLUS-CLIENT01
|
|
NETPLUS-SW02
NETPLUS-SERVER01
|
|
NETPLUS-SW03

For simplicity, place the lab devices in the same test VLAN.

Example:

VLAN 10 — USERS/LAB

Use:

NETPLUS-ADMIN
10.10.10.10/24
NETPLUS-CLIENT01
10.10.10.20/24
NETPLUS-SERVER01
10.10.10.30/24

All switch-to-switch links should carry VLAN 10.

Configure the switch-to-switch interfaces as trunks where required.

Cisco-like example:

interface <uplink>
switchport mode trunk
switchport trunk allowed vlan 10
no shutdown

Repeat for each inter-switch connection.

Check:

show interfaces status

Confirm all three inter-switch links are:

Up

At this point, the physical network contains a loop.

Do not disable STP.

The topology contains:

SW01
SW02
SW03
SW01

An Ethernet frame could theoretically circulate:

Frame
SW01
SW02
SW03
SW01
SW02
...

Ethernet frames do not have a Layer 2 TTL field equivalent to IP TTL.

This is why loops are dangerous.

Consider an ARP broadcast:

ff:ff:ff:ff:ff:ff

A switch floods broadcasts.

With a loop:

Broadcast
SW01
↙ ↘
SW02 SW03
↘ ↙
Broadcast returns

Copies can multiply rapidly.

This can cause:

High Bandwidth Usage
High Switch CPU
Packet Loss
Network Instability
Complete Layer 2 Outage

Suppose the same source frame appears through multiple loop paths.

A switch may observe:

MAC-A → Port 1

then:

MAC-A → Port 2

then:

MAC-A → Port 1

repeatedly.

This can create:

MAC Flapping

or unstable forwarding behavior.

Spanning Tree Protocol creates a:

Loop-Free Logical Topology

while preserving:

Physical Redundancy

Conceptually:

Physical:
Triangle
Logical:
Tree

One redundant path is placed into a non-forwarding role.

STP performs:

Elect Root Bridge
Calculate Best Paths to Root
Select Root Ports
Select Designated Ports
Block Redundant Paths

On each switch, run a platform-appropriate command.

Cisco-like:

show spanning-tree

Record:

Root ID
Bridge ID
Priority
Root Port
Port Roles
Port States
Path Cost

STP identifies switches using a:

Bridge ID

Conceptually based on:

Bridge Priority
+
MAC Address

Modern implementations may include VLAN-related extended system ID values, but for Network+ focus on:

Priority
+
MAC

The switch with the:

Lowest Bridge ID

wins root-bridge election.

The comparison is:

Lowest Priority
If Tie
Lowest MAC Address

Run:

show spanning-tree vlan 10

or equivalent on each switch.

Identify:

This bridge is the root

or compare:

Root ID

with:

Bridge ID

Record:

Current Root Bridge:
<switch>

Create:

Switch Priority Bridge MAC Root?
SW01 <value> <MAC> Yes/No
SW02 <value> <MAC> Yes/No
SW03 <value> <MAC> Yes/No

The root bridge becomes the logical reference point for STP.

Think of it as:

Root Bridge
All other switches calculate
their best path toward it

Every non-root switch selects one:

Root Port

The root port is the switch’s best path toward the root bridge.

Conceptually:

Non-Root Switch
Best Path to Root
Root Port

The root bridge is already:

The Root

Therefore it does not need a root port.

Its relevant active ports generally become designated for their respective segments.

On SW02:

show spanning-tree vlan 10

Find the port role:

Root

Record:

SW02 Root Port:
<interface>

Repeat on SW03.

Record:

SW03 Root Port:
<interface>

Each network segment needs one forwarding port selected as:

Designated Port

Conceptually:

Segment
Best Path Toward Root
Designated Port

On the root bridge, ports are usually designated ports.

On the link between SW02 and SW03, one side may become:

Alternate

or a classic STP:

Blocking

role/state.

That prevents the loop.

Suppose SW01 is root.

STP may logically create:

SW01
/ \
/ \
SW02 SW03
\ /
\ X /
Redundant Path
Blocked

Physical link:

Still Connected

Logical forwarding:

Disabled on One Side

Create:

Switch Interface Connected To STP Role State
SW01 <port> SW02 Designated Forwarding
SW01 <port> SW03 Designated Forwarding
SW02 <port> SW01 Root Forwarding
SW03 <port> SW01 Root Forwarding
SW02/SW03 <port> Peer Designated/Alternate Forwarding/Discarding

Use your actual results.

Classic STP uses states including:

Blocking
Listening
Learning
Forwarding
Disabled

Rapid STP simplifies these operational states into:

Discarding
Learning
Forwarding

Network+ expects familiarity with both concepts.

A forwarding port can:

Receive User Frames
Send User Frames
Learn MAC Addresses
Process STP Control Traffic

A blocked/discarding redundant port does not normally forward user data.

But it continues participating in:

Spanning Tree

so it can become active if topology changes.

During transition, a port may learn:

Source MAC Addresses

without yet forwarding normal user traffic.

This helps prepare the forwarding table before the port fully transitions.

STP switches exchange:

Bridge Protocol Data Units

or:

BPDUs

These carry information about:

Root Bridge
Path Cost
Bridge Identity
Topology

If your environment permits Wireshark access to the switch link, apply:

stp

You may observe BPDUs.

Inspect fields such as:

Root Identifier
Root Path Cost
Bridge Identifier
Port Identifier

BPDUs allow switches to agree on:

Who Is Root?
What Is the Best Path?
Which Links Must Be Blocked?

Without this information exchange, STP cannot create a consistent loop-free topology.

STP uses:

Path Cost

to determine the preferred path toward the root.

Generally:

Higher-Speed Link
Lower Cost

and:

Lower-Speed Link
Higher Cost

Exact cost values depend on STP implementation/version.

A non-root switch prefers the path with the:

Lowest Total Root Path Cost

Conceptually:

Path A
Cost 4
Path B
Cost 19

The switch chooses:

Path A

When path costs tie, STP uses additional tie-breakers.

At Network+ level, remember factors can include:

Lower Sender Bridge ID
Lower Sender Port ID
Lower Local Port ID

depending on where the tie occurs.

34. Verify Connectivity While a Link Is Blocked

Section titled “34. Verify Connectivity While a Link Is Blocked”

From ADMIN:

Terminal window
ping -c 3 10.10.10.20

Then:

Terminal window
ping -c 3 10.10.10.30

Both should work even though one redundant inter-switch path is not forwarding.

This proves:

Blocked Redundant Path
Broken Network

On each switch:

show mac address-table

Generate traffic between:

ADMIN ↔ CLIENT01
ADMIN ↔ SERVER01
CLIENT01 ↔ SERVER01

Observe which ports are used.

If the SW02–SW03 link is blocked, CLIENT01 to SERVER01 may travel:

CLIENT01
SW02
SW01
SW03
SERVER01

instead of directly:

SW02
SW03

because STP has logically blocked that redundant link.

Now safely simulate failure of one active uplink.

Example:

SW01 ↔ SW02

Disable one side of the link.

Cisco-like:

interface <uplink>
shutdown

Start a continuous ping before disabling the link.

Linux:

Terminal window
ping 10.10.10.20

Windows:

Terminal window
ping -t 10.10.10.20

Observe:

Temporary Packet Loss

followed by:

Connectivity Restoration

depending on STP mode and timers.

After the active path fails:

Old Forwarding Link
Failure
STP Recalculates
Previously Blocked Path
Transitions to Forwarding

This is:

Reconvergence

Run:

show spanning-tree vlan 10

on all switches.

Compare:

Before Failure

versus:

After Failure

Identify which port changed role/state.

Create:

Item Before After
Root Bridge <switch> <switch>
SW02 Root Port <port> <port>
SW03 Root Port <port> <port>
Blocked Port <port> <port>
Active Path <path> <path>

Re-enable:

interface <uplink>
no shutdown

Observe STP reconverge again.

The previously restored link may return to forwarding or a redundant role depending on topology.

Convergence means:

All Switches Agree
on
Loop-Free Topology

During topology changes:

Old Topology
Change Detected
STP Calculation
New Stable Topology

Traditional STP convergence can be relatively slow.

Rapid Spanning Tree Protocol:

RSTP

was designed for faster convergence.

Common standard:

IEEE 802.1w

Classic STP:

IEEE 802.1D
Feature STP RSTP
Standard 802.1D 802.1w
Convergence Slower Faster
Port states 5 major states 3 operational states
Alternate role Less explicit Explicit alternate role
Modern preference Legacy Common modern approach

Common RSTP roles include:

Root
Designated
Alternate
Backup

For Network+, understand especially:

Root
Designated
Alternate

Run a platform-specific command such as:

show spanning-tree summary

Determine whether your lab uses:

STP
RSTP
Rapid-PVST-like implementation
MST

For this lab, focus on STP/RSTP concepts.

48. Understand Per-VLAN Spanning Tree Concept

Section titled “48. Understand Per-VLAN Spanning Tree Concept”

Some switch platforms maintain a separate STP instance per VLAN.

Conceptually:

VLAN 10
Spanning Tree A
VLAN 20
Spanning Tree B

This can allow different VLANs to use different root bridges or active paths.

The root bridge should normally be:

Intentionally Selected

not:

Whichever Switch Has Lowest MAC

by accident.

Core/distribution switches are commonly preferred.

Inside the lab, lower SW01’s STP priority for VLAN 10.

Cisco-like example:

spanning-tree vlan 10 priority 24576

or a platform shortcut such as:

spanning-tree vlan 10 root primary

Verify command syntax for your lab platform.

Run:

show spanning-tree vlan 10

on all switches.

Confirm:

SW01
=
Root Bridge

Many classic STP implementations use priority increments such as:

0
4096
8192
12288
16384
20480
24576
28672
32768

The exact displayed value may also incorporate extended system ID information.

Lower priority is preferred.

In enterprise design, another switch may be configured with the second-lowest priority.

Example:

SW01
Primary Root
SW02
Secondary Root

If SW01 fails:

SW02
likely becomes Root

This creates predictable topology behavior.

54. Troubleshooting Scenario 1 — Unexpected Root Bridge

Section titled “54. Troubleshooting Scenario 1 — Unexpected Root Bridge”

Suppose SW03 unexpectedly becomes root.

Investigate:

show spanning-tree

Check:

Bridge Priorities
MAC Addresses
Configuration

Possible cause:

SW03 has lower Bridge ID

Configure the intended root with a lower priority.

Then verify:

Root ID
=
Intended Core Switch

56. Troubleshooting Scenario 2 — Unexpected Blocked Port

Section titled “56. Troubleshooting Scenario 2 — Unexpected Blocked Port”

A port is blocking, and an administrator believes it should forward.

Do not immediately enable or force forwarding.

First determine:

Is This Link Redundant?
What Is Root Bridge?
What Is Path Cost?
Which Port Is Root?
Which Port Is Designated?

The blocked port may be functioning exactly as designed.

57. Troubleshooting Scenario 3 — High-Cost Path Selected

Section titled “57. Troubleshooting Scenario 3 — High-Cost Path Selected”

Suppose traffic is taking an unexpected slower path.

Review:

STP Cost
Interface Speed
Configured Cost
Root Bridge Position

A lower path cost should normally be preferred.

58. Troubleshooting Scenario 4 — Link Up but Not Forwarding

Section titled “58. Troubleshooting Scenario 4 — Link Up but Not Forwarding”

You see:

Interface:
Up

but:

STP State:
Discarding / Blocking

This means:

Layer 1:
Working
STP:
Intentionally Preventing Forwarding

Do not misdiagnose this as a failed physical link.

59. Troubleshooting Scenario 5 — Redundant Link Fails to Activate

Section titled “59. Troubleshooting Scenario 5 — Redundant Link Fails to Activate”

After an active link fails, connectivity does not recover.

Check:

Alternate Link Physical State
VLAN Allowed on Link
Trunk Configuration
STP State
Port Configuration
Topology

A backup path cannot help if the VLAN is not actually carried across it.

60. Troubleshooting Scenario 6 — VLAN Missing on Redundant Trunk

Section titled “60. Troubleshooting Scenario 6 — VLAN Missing on Redundant Trunk”

Remove VLAN 10 from the backup trunk’s allowed list.

Then fail the primary path.

Expected:

STP Path May Activate

but:

VLAN 10 Traffic Still Fails

because the trunk itself does not carry VLAN 10.

This demonstrates:

Redundancy requires both Layer 2 topology and correct VLAN configuration.

Re-add:

VLAN 10

to the trunk.

Verify:

show interfaces trunk

and:

show spanning-tree vlan 10

Ports connected directly to endpoints are sometimes configured as:

Edge Ports

or platform-specific:

PortFast

This allows them to transition to forwarding more quickly.

Use only on ports that should not connect to another switch.

63. Understand Why Edge Configuration Matters

Section titled “63. Understand Why Edge Configuration Matters”

A user workstation does not normally create a Layer 2 switching loop.

Therefore waiting through full STP convergence may unnecessarily delay:

DHCP
Login
Network Access

Edge-port features address this.

Never configure an inter-switch link as an edge/PortFast port without understanding the consequences.

Doing so can weaken loop-prevention behavior.

BPDU Guard is commonly used on edge ports.

Conceptually:

Edge Port
Unexpected BPDU Received
Port Disabled / Protected

This can help protect against accidental switch connections.

Root Guard can help prevent an unexpected downstream switch from becoming STP root.

Conceptually:

Unexpected Better BPDU
Do Not Allow Root Change

These are important Layer 2 protection concepts.

Loop Guard helps protect against certain situations where STP BPDUs unexpectedly stop arriving and a blocked link might otherwise become forwarding.

At Network+ level, understand it as an additional STP loop-protection mechanism.

Feature Purpose
PortFast / Edge Faster endpoint forwarding
BPDU Guard Protect edge ports from switch BPDUs
Root Guard Prevent unexpected root bridge
Loop Guard Help prevent forwarding during BPDU-loss conditions
1. Elect Root Bridge
2. Each Non-Root Selects Root Port
3. Each Segment Selects Designated Port
4. Redundant Ports Become Alternate/Blocked
5. Forwarding Topology Becomes Loop-Free

Switches have:

SW01
Priority 32768
MAC 00:00:00:00:00:30
SW02
Priority 32768
MAC 00:00:00:00:00:20
SW03
Priority 32768
MAC 00:00:00:00:00:10

Which becomes root?

Answer:

SW03

because all priorities tie and SW03 has the lowest MAC address.

71. Mission Challenge — Priority Election

Section titled “71. Mission Challenge — Priority Election”

Now:

SW01
Priority 24576
SW02
Priority 32768
SW03
Priority 32768

Which becomes root?

Answer:

SW01

because it has the lowest priority.

SW02 has two possible paths:

Direct to Root
Cost 4
Through SW03
Cost 8

Which port becomes root port?

Answer:

Direct path
Cost 4

73. Mission Challenge — Identify the Loop-Free Topology

Section titled “73. Mission Challenge — Identify the Loop-Free Topology”

Given:

SW01 = Root
SW02 → SW01 = Root Port
SW03 → SW01 = Root Port

The SW02–SW03 link must have:

One Designated Side
One Alternate/Blocked Side

to prevent the loop.

If:

SW01 ↔ SW02

fails, explain how CLIENT01 can still reach the network.

Expected path:

CLIENT01
SW02
Previously Blocked SW02–SW03 Link
SW03
SW01

after STP reconvergence.

75. Mission Challenge — Diagnose the Problem

Section titled “75. Mission Challenge — Diagnose the Problem”

Symptoms:

All interfaces show UP
CLIENT01 cannot reach SERVER01
One trunk shows VLAN 10 missing
STP shows alternate path forwarding after primary link failure

Likely cause:

Backup topology exists,
but VLAN 10 is not allowed across the active alternate trunk.

On NETPLUS-ADMIN:

Terminal window
mkdir -p ~/NetworkPlus-Labs/LAB08/{Captures,Screenshots,Configs,Notes}

Create:

Terminal window
touch ~/NetworkPlus-Labs/LAB08/Notes/lab08-notes.md

Capture outputs from all switches:

show spanning-tree
show spanning-tree vlan 10
show mac address-table
show interfaces status
show interfaces trunk

Store them under:

~/NetworkPlus-Labs/LAB08/Configs/

If available, save:

LAB08-STP-BPDU.pcapng

If you capture topology-change behavior, save:

LAB08-STP-FAILOVER.pcapng

Use:

# LAB08 — Spanning Tree and Layer 2 Redundancy
## Topology
SW01 connections:
SW02 connections:
SW03 connections:
## VLAN
VLAN:
10
## Bridge Information
### SW01
Priority:
MAC:
Bridge ID:
Root:
Yes / No
### SW02
Priority:
MAC:
Bridge ID:
Root:
Yes / No
### SW03
Priority:
MAC:
Bridge ID:
Root:
Yes / No
## Root Bridge
Switch:
Reason:
## Port Roles
### SW01
Port:
Role:
State:
Cost:
### SW02
Port:
Role:
State:
Cost:
### SW03
Port:
Role:
State:
Cost:
## Blocked / Alternate Path
Interface:
Reason:
## Initial Forwarding Path
CLIENT01 → SERVER01:
## Failover Test
Failed Link:
Connectivity Impact:
New Root Port:
New Forwarding Path:
Reconvergence Result:
## Root Bridge Configuration
Original Root:
Configured Root:
Priority:
## Troubleshooting
### Unexpected Root
Problem:
Root Cause:
Fix:
### Missing VLAN on Backup Path
Problem:
Root Cause:
Fix:
## Final Assessment
Summarize how STP maintained a loop-free redundant topology.

Capture:

01-redundant-switch-topology.png
02-switch-interface-status.png
03-switch-trunks.png
04-initial-stp-sw01.png
05-initial-stp-sw02.png
06-initial-stp-sw03.png
07-root-bridge.png
08-root-port-sw02.png
09-root-port-sw03.png
10-alternate-blocked-port.png
11-port-role-table.png
12-stp-bpdu.png
13-mac-address-tables.png
14-connectivity-before-failure.png
15-primary-link-shutdown.png
16-stp-reconvergence.png
17-new-forwarding-port.png
18-connectivity-after-failover.png
19-link-restored.png
20-root-priority-config.png
21-root-election-verified.png
22-missing-vlan-backup-trunk.png
23-redundancy-restored.png
24-final-stp-topology.png
  • SW01 created/configured

  • SW02 created/configured

  • SW03 created/configured

  • Redundant triangle topology built

  • Endpoint connectivity established

  • Inter-switch links verified

  • VLAN 10 allowed on required trunks

  • Layer 2 loop understood

  • Broadcast storm understood

  • MAC-table instability understood

  • Reason Ethernet loops are dangerous understood

  • STP purpose understood

  • BPDU concept understood

  • Bridge ID understood

  • Bridge priority understood

  • Root bridge identified

  • Root election logic understood

  • Root ports identified

  • Designated ports identified

  • Alternate/blocked port identified

  • STP path cost understood

  • Lowest-cost path concept understood

  • Tie-breaking concept reviewed

  • Active forwarding topology documented

  • Forwarding understood

  • Learning understood

  • Blocking/discarding understood

  • Classic STP states understood

  • RSTP states understood

  • Connectivity verified with redundant link blocked

  • Active link failure simulated

  • Temporary convergence impact observed

  • Alternate path transitioned correctly

  • New forwarding path documented

  • Failed link restored

  • STP reconvergence observed

  • Original root identified

  • Preferred root configured

  • Root election verified

  • Secondary-root concept understood

  • Edge/PortFast concept understood

  • BPDU Guard understood

  • Root Guard understood

  • Loop Guard understood

  • Unexpected root scenario understood

  • Blocked port correctly interpreted

  • High-cost path considered

  • Link-up-but-discarding state understood

  • Backup-link failure investigated

  • VLAN-on-backup-trunk problem completed

  • Bridge table completed

  • Port role table completed

  • Initial forwarding path documented

  • Failover path documented

  • STP packet capture saved where available

  • Evidence screenshots captured

  • Lab notes completed

In this mission, you learned that redundancy introduces both:

Resilience

and:

Loop Risk

Without STP:

Redundant Ethernet Links
Layer 2 Loop
Broadcast Storm
MAC Instability
Network Failure

With STP:

Redundant Ethernet Links
Root Bridge Election
Best Paths Calculated
Redundant Path Blocked
Loop-Free Forwarding

When an active path fails:

Link Failure
Topology Change
STP Reconvergence
Alternate Path Activates
Connectivity Restored

The key lesson is:

Spanning Tree allows Ethernet networks to keep redundant physical links while maintaining only one loop-free logical forwarding path at a time.

After completing this mission, you should be able to:

  • explain Layer 2 loops

  • explain broadcast storms

  • explain MAC flapping

  • describe STP operation

  • identify bridge IDs

  • determine root-bridge election

  • identify root ports

  • identify designated ports

  • recognize alternate and blocked paths

  • interpret STP path cost

  • understand STP port states

  • explain BPDU operation

  • verify spanning-tree state

  • design a preferred root bridge

  • understand RSTP

  • test link redundancy

  • observe reconvergence

  • troubleshoot STP behavior

  • understand common STP protection mechanisms

You now have resilient Layer 2 networking.

The next mission moves into Layer 3 routing.

You will build multiple IP networks and configure routers to move packets between them using static routes.

You will work with:

  • routing tables

  • directly connected networks

  • static routes

  • default routes

  • next-hop addresses

  • exit interfaces

  • longest prefix match

  • administrative distance concepts

  • packet forwarding

  • router ARP behavior

  • multi-router paths

  • traceroute

  • route failure

  • incorrect next-hop troubleshooting

  • missing route troubleshooting

The progression becomes:

Layer 2 Switching
VLANs
Redundancy
Multiple IP Networks
Routers
Routing Tables
Static Routes
End-to-End Connectivity

➡️ Next: Lab 09 — Static Routing Fundamentals