The spanning-tree bpdu tx hold-count command specifies the maximum number of BPDUs per second that the switch can send from an interface. Valid settings range from 1 to 10 BPDUs with a default of 6 BPDUs.

The no spanning-tree bpdu tx hold-count and default spanning-tree bpdu tx hold-count commands restore the transmit hold count default of 6 BPDUs by removing the spanning-tree bpdu tx hold-count command from running-config.

The spanning-tree bpduguard rate-limit default command configures the global BPDU rate limit setting. The global BPDU rate limit setting provides the default for individual ports whose configuration does not include a spanning-tree bpduguard rate-limit enable / disable command. The default global setting is enabled.

BPDU rate limiting restricts the number of BPDUs that ports with BPDU guard or BPDU filter disabled can process during a specified interval. Ports discard BPDUs it receives in excess of the specified limit. BPDU rate limits are established by spanning-tree bpduguard rate-limit count (global) commands.

The no spanning-tree bpduguard rate-limit default sets the global BPDU rate limit setting to disabled. The spanning-tree bpduguard rate-limit default and default spanning-tree bpduguard rate-limit default commands restore the default global rate limit setting to enabled by removing the no spanning-tree bpduguard rate-limit default command from running-config.

The spanning-tree bpduguard rate-limit count command sets the maximum BPDU reception rate (quantity per interval) for ports that are not covered by a spanning-tree bpduguard rate-limit count (interface) command.

BPDU rate limiting restricts the number of BPDUs that ports with BPDU guard or BPDU filter disabled can process during a specified interval. Ports discard BPDUs they receive in excess of the specified limit. BPDU rate limiting is enabled or disabled by spanning-tree bpduguard rate-limit enable / disable commands.

The no spanning-tree bpduguard rate-limit count and default spanning-tree bpduguard rate-limit count commands restore the global setting to its default value by removing the spanning-tree bpduguard rate-limit count command from running-config.

The spanning-tree edge-port bpdufilter default command configures the global BPDU filter setting as enabled. Ports not covered by a spanning-tree bpdufilter command use the global BPDU filter setting.

The spanning-tree edge-port bpduguard default command sets the global BPDU guard setting as enabled. Ports not covered by a spanning-tree bpduguard command use the global BPDU guard setting.

The spanning-tree forward-time command configures the forward delay timer. Forward delay is the time that a port is in learning state before it begins forwarding data packets.

The switch inserts the forward delay timer value in BPDU packets it sends as the root bridge. The forward delay value ranges from 4 to 30 seconds with a default of 15 seconds.

The no spanning-tree forward-time and default spanning-tree forward-time commands restore the forward delay timer default of 15 seconds by removing the spanning-tree forward-time command from running-config.

The spanning-tree guard loop default command configures the global loop guard setting as enabled. Ports not covered by a spanning-tree guard command use the global loop guard setting. Loop guard prevents blocked or root ports from becoming a designated port due to failures resulting in a unidirectional link. The spanning-tree guard interface configuration statement overrides the global setting for a specified interface. The default global loop guard setting is disabled.

The no spanning-tree guard loop default and default spanning-tree guard loop default commands restore the global loop guard setting of disabled by removing the spanning-tree guard loop default command from running-config.

The spanning-tree hello-time command configures the hello time, which specifies the transmission interval between consecutive bridge protocol data units (BPDU) that the switch sends as a root bridge. The hello time is also inserted in outbound BPDUs.

This hello time ranges from 0.2 seconds to 10 seconds with a default of 2 seconds. The no spanning-tree hello-time and default spanning-tree hello-time commands restore the hello time default of 2 seconds by removing the spanning-tree hello-time command from running-config.

The spanning-tree max-age command configures the switch’s max age timer, which specifies the max age value that the switch inserts in outbound BPDU packets it sends as a root bridge. The max-age time value ranges from 6 to 40 seconds with a default of 20 seconds.

Max age is the interval, specified in the BPDU, that BPDU data remains valid after its reception. The bridge recomputes the spanning tree topology if it does not receive a new BPDU before max age expiry.

The no spanning-tree max-age and default spanning-tree max-age commands restore the max-age default of 20 seconds by removing the spanning-tree max-age command from running-config.

The spanning-tree max-hops command specifies the max hop setting that the switch inserts into BPDUs that it sends out as the root bridge. The max hop setting determines the number of bridges in an MST region that a BPDU can traverse before it is discarded. The max-hop value ranges from 1 to 40 with a default of 20.

The no spanning-tree max-hops and default spanning-tree max-hops commands restore the max-hops setting to its default value of 20 by removing the spanning-tree max-hops command from running-config.

The spanning-tree mode command specifies the spanning tree protocol version that the switch runs. The default mode is Multiple Spanning Tree (mstp).

The no spanning-tree mode and default spanning-tree mode commands restore the default spanning tree protocol version.

Caution: The spanning-tree mode command may disrupt user traffic. When the switch starts a different STP version, all spanning-tree instances are stopped, then restarted in the new mode.

The spanning-tree mst configuration command places the switch in MST-configuration mode, which is the group change mode where MST region parameters are configured.

Changes made in a group change mode are saved by leaving the mode through the exit command or by entering another configuration mode. To discard changes from the current edit session, leave the mode with the abort command.

The spanning-tree mst pvst border command configures MSTP PVST border feature to automatically detect border ports facing PVST+ regions. By default, spanning-tree mst pvst border is disabled.

The no spanning-tree mst pvst border and default spanning-tree mst pvst border commands restore the default MST configuration.

The spanning-tree portchannel guard misconfig command enables the switch to detect misconfigured port channels that may cause network loops by monitoring inbound BPDUs. When a port channel receives 75 inconsistent BPDUs within 30 seconds, the switch error disables the port. When a port channel receives 5 BPDUs with the same source BPDU during the 30 second measurement interval, the error counter is reset and the port continues normal port channel operation. Misconfigured port channel detection is disabled by default.

The no spanning-tree portchannel guard misconfig and default spanning-tree portchannel guard misconfig commands disables the detection of misconfigured port channels by removing the spanning-tree portchannel guard misconfig statement from running-config

The spanning-tree priority command configures the bridge priority number. The bridge priority is the four most significant digits of the bridge ID, which is used by spanning tree algorithms to select the root bridge and choose among redundant links. Bridge ID numbers range from 0 to 65535 (16 bits); bridges with smaller bridge IDs are elected over other bridges.

Because bridge priority sets the four most significant bits of the bridge ID, valid settings include all multiples of 4096 between 0 and 61440. Default value is 32768.

The spanning-tree priority command provides a mode option:

•RST instance priority is configured by not including a mode.

•MST instance 0 priority is configured by not including a mode or with the mst mode option.

•MST instance priority is configured with the mst mode option.

•Rapid-PVST VLAN priority is configured with the vlan mode option.

The no spanning-tree priority and default spanning-tree priority commands restore the bridge priority default of 32768 for the specified mode by removing the corresponding spanning-tree priority command from running-config.

Another method of adding spanning-tree priority commands to the configuration is through the spanning-tree root command. Similarly, the no spanning-tree root command removes the corresponding spanning-tree priority command from running-config.

The spanning-tree root command configures the bridge priority number by adding a spanning-tree priority command to the configuration. Parameter settings set the following priority values:

•primary sets the bridge priority to 8192.

•secondary sets the bridge priority to 16384.

The bridge priority is the four most significant digits of the bridge ID, which is used by spanning tree algorithms to select the root bridge and choose among redundant links. Bridge ID numbers range from 0 to 65535 (16 bits); bridges with smaller bridge IDs are elected over other bridges.

When no other switch in the network is similarly configured, assigning the primary value to the switch facilitates its selection as the root switch. Assigning the secondary value to the switch facilitates its selection as the backup root in a network that contains one switch with a smaller priority number.

The spanning-tree root command provides a mode option:

•RST instance priority is configured by not including a mode.

•MST instance 0 priority is configured by not including a mode or with the mst mode option.

•MST instance priority is configured with the mst mode option.

•Rapid-PVST VLAN priority is configured with the vlan mode option.

The no spanning-tree root and default spanning-tree root commands restore the bridge priority default of 32768 by removing the corresponding spanning-tree priority command from running-config. The no spanning-tree root, no spanning-tree priority, default spanning-tree root and default spanning-tree priority commands perform the same function.

The spanning-tree transmit active command enables bridge assurance globally, which enables bridge assurance on all ports with a port type of network. Bridge assurance protects against unidirectional link failure, other software failure, and devices that quit running a spanning tree algorithm.

Bridge assurance is available only on point-to-point links on spanning tree network ports. Both ends of the link should ideally have bridge assurance enabled. Bridge assurance-enabled ports will not necessarily be blocked when they link to a port where bridge assurance is not enabled, but if they do not receive periodic BPDUs from the other side of the link the show spanning-tree transmit active command will show a bridge assurance status of “inconsistent” (blocking) for that port.

The no spanning-tree transmit active command disables bridge assurance. The spanning-tree transmit active and default spanning-tree transmit active commands restore the default behavior by removing the no spanning-tree transmit active command from running-config.

The spanning-tree vlan-id command enables Spanning Tree Protocol (STP) on specified VLANs by removing any corresponding no spanning-tree vlan-id statements from running-config. Spanning-tree is enabled on all VLANs by default.

The no spanning-tree vlan-id command disables STP on the specified interfaces. The default spanning-tree vlan-id enables STP on the specified interfaces.

Warning: Disabling STP is not recommended, even in topologies free of physical loops; STP guards against configuration mistakes and cabling errors. When disabling STP, ensure that there are no physical loops in the VLAN.

Important! When disabling STP on a VLAN, ensure that all switches and bridges in the network disable STP for the same VLAN. Disabling STP on a subset of switches and bridges in a VLAN may have unexpected results because switches and bridges running STP will have incomplete information regarding the network's physical topology.

The disabled-time command sets the time for which the port remains disabled after a loop is detected by loop protection. The no disabled-time and default disabled-time commands reset the disabled time to the default of 604800 seconds (seven days).

Note: If this value is changed, interfaces that are already disabled by loop protection will remain disabled for the previously configured period.

The loop-protection command enables loop protection on the configuration mode interface. All interfaces in a VLAN under loop protection have loop protection enabled by default. The no loop-protection and default loop-protection commands disable loop protection on the interface.

When loop protection is disabled (at the VLAN or interface level), the computed state of the interface is forgotten and packets queued to be sent are dropped. If an interface is err-disabled by loop protection, disabling loop protection removes the err-disable.

The monitor loop-protection command places the switch in loop-protection configuration mode.

The protect vlan command specifies which VLANs will participate in loop protection. The no protect vlan and default protect vlan commands remove loop protection from the specified VLANs.

The rate-limit command sets the maximum number of loop detection frames which can be sent by the switch per second. The no rate-limit and default rate-limit commands return the rate limit to the default value of 1000.

The shutdown (Loop-protection) command disables loop protection globally. The feature is disabled by default, and is enabled by using the no shutdown (Loop-protection) command.

Note: To function, loop protection must also be enabled on a per-VLAN basis using the protect vlan command.

The transmit-interval command sets the interval at which loop detection packets are transmitted. The no transmit-interval and default transmit-interval commands restore the transmission interval to the default of 5 seconds.

The spanning-tree bpdufilter command controls bridge protocol data unit (BPDU) filtering on the configuration mode interface. BPDU filtering is disabled by default.

•spanning-tree bpdufilter enabled enables BPDU filtering.

•spanning-tree bpdufilter disabled disables BPDU filtering by removing the spanning-tree bpdufilter command from running-config.

The BPDU filter default setting for portfast ports is configured by the spanning-tree edge-port bpdufilter default command; BPDU filter is disabled by default on all non-portfast ports.

The no spanning-tree bpdufilter and default spanning-tree bpdufilter commands restore the global BPDU filter setting on the configuration mode interface by removing the corresponding spanning-tree bpdufilter command from running-config.

The spanning-tree bpduguard command controls BPDU guard on the configuration mode interface. A BPDU guard-enabled port is disabled when it receives a BPDU packet.

The BPDU guard default setting for portfast ports is configured by the spanning-tree edge-port bpduguard default command; BPDU guard is disabled by default on all non-portfast ports.

The no spanning-tree bpduguard and default spanning-tree bpduguard commands restore the global BPDU guard setting on the configuration mode interface by removing the corresponding spanning-tree bpduguard command from running-config.

The spanning-tree bpduguard rate-limit count command configures the maximum BPDU reception rate for the configuration mode interface. The default rate limit is specified by the spanning-tree bpduguard rate-limit count (global) command.

BPDU rate limiting restricts the number of BPDUs that ports with BPDU guard or BPDU filter disabled can process during a specified interval. Ports discard BPDUs it receives in excess of the specified limit. BPDU rate limiting is enabled or disabled by spanning-tree bpduguard rate-limit enable / disable commands.

The no spanning-tree bpduguard rate-limit count and default spanning-tree bpduguard rate-limit count commands restore the interface value to the global setting by removing the corresponding spanning-tree bpduguard rate-limit count command from running-config.

These commands enable and disable BPDU rate limiting on the configuration mode interface:

•spanning-tree bpduguard rate-limit enable enables BPDU rate limiting.

•spanning-tree bpduguard rate-limit disable disables BPDU rate limiting.

The spanning-tree bpduguard rate-limit default command enables BPDU rate limiting on all ports not configured with a spanning-tree bpduguard rate-limit command.

BPDU rate limiting restricts the number of BPDUs that ports with BPDU guard or BPDU filter disabled can process during a specified interval. Ports discard BPDUs it receives in excess of the specified limit. BPDU rate limits are established by spanning-tree bpduguard rate-limit count (interface) commands.

The no spanning-tree bpduguard rate-limit and default spanning-tree bpduguard rate-limit commands restore the global rate limit setting on the configuration mode interface by removing the corresponding spanning-tree bpduguard rate-limit command from running-config.

The spanning-tree cost command configures the path cost of the configuration mode interface. Cost values range from 1 to 200000000 (200 million). The default cost depends on the interface speed:

•1 gigabit interface: cost = 20000

•10 gigabit interface: cost = 2000

The spanning-tree cost command provides a mode option:

•RST instance cost is configured by not including a mode.

•MST instance 0 cost is configured by not including a mode or with the mst mode option.

•MST instance cost is configured with the mst mode option.

•Rapid-PVST VLAN cost is configured with the vlan mode option.

The no spanning-tree cost and default spanning-tree cost commands restore the default cost on the configuration mode interface by removing the corresponding spanning-tree cost command from running-config.

The spanning-tree guard command enables root guard or loop guard on the configuration mode interface. The spanning-tree guard loop default command configures the global loop guard setting.

•Root guard prevents a port from becoming a root or blocked port. A root guard port that receives a superior BPDU transitions to the root-inconsistent (blocked) state.

•Loop guard protects against loops resulting from unidirectional link failures on point-to-point links by preventing non-designated ports from becoming designated ports. When loop guard is enabled, a root or blocked port transitions to loop-inconsistent (blocked) state if it stops receiving BPDUs from its designated port. The port returns to its prior state when it receives a BPDU.

The no spanning-tree guard and default spanning-tree guard commands sets the configuration mode interface to the global loop guard mode by removing the spanning-tree guard statement from running-config. The spanning-tree guard none command disables loop guard and root guard on the interface, overriding the global setting.

The spanning-tree link-type command specifies the configuration mode interface’s link type, which is normally derived from the port’s duplex setting. The default setting depends on a port’s duplex mode:

•full-duplex ports are point-to-point.

•half-duplex ports are shared.

The no spanning-tree link-type and default spanning-tree link-type commands restore the default link type on the configuration mode interface by removing the corresponding spanning-tree link-type command from running-config.

The spanning-tree port-priority command specifies the configuration mode interface’s port-priority number. The switch uses this number to determine which interface it places into forwarding mode when resolving a loop. Valid settings are all multiples of 16 between 0 and 240. Default value is 128. Ports with lower numerical priority values are selected over other ports.

The no spanning-tree port-priority and default spanning-tree port-priority commands restore the default of 128 for the configuration mode interface by removing the spanning-tree port-priority command from running-config.

The spanning-tree port-priority command provides a mode option:

•RST instance port-priority is configured by not including a mode.

•MST instance 0 port-priority is configured by not including a mode or with the mst mode option.

•MST instance port-priority is configured with the mst mode option.

•Rapid-PVST VLAN port-priority is configured with the vlan mode option.

The spanning-tree portfast command programs configuration mode ports to immediately enter forwarding state when they establish a link. PortFast ports are included in spanning tree topology calculations and can enter discarding state. This command overrides the spanning-tree portfast auto command.

The no spanning-tree portfast and default spanning-tree portfast commands remove the corresponding spanning-tree portfast command from running-config.

The spanning-tree portfast auto command enables auto-edge detection on the configuration mode interface. When auto-edge detection is enabled, the port is configured as an edge port if it does not receive a new BPDU before the current BPDU expires. Auto-edge detection is enabled by default. The spanning-tree portfast command, when configured, has priority over this command.

The no spanning-tree portfast auto command disables auto-edge port detection. This command is removed from running-config with the spanning-tree portfast auto and default spanning-tree portfast auto commands.

The spanning-tree portfast <port-type> command specifies the STP port mode for the configuration mode interface. Default port mode is normal.

Port modes include:

•Edge: Edge ports connect to hosts and transition to the forwarding state when the link is established. An edge port that receives a BPDU becomes a normal port.

•Network: Network ports connect only to switches or bridges and support bridge assurance. Network ports that connect to hosts or other edge devices transition to the discarding state.

•Normal: Normal ports function as normal STP ports and can connect to any type of device. The no spanning-tree portfast <port-type> and default spanning-tree portfast <port-type> commands restore the default port mode of normal by removing the corresponding spanning-tree portfast <port-type> command from running-config.

The switchport backup-link command establishes a primary-backup configuration for forwarding VLAN traffic between the command mode interface and a specified interface. The show interfaces switchport backup-link command displays

the state of backup interface pairs on the switch:

•the primary interface is the command mode interface.

•the backup interface is the interface specified in the command.

The following guidelines apply to primary and backup interfaces.

•Ethernet and Port Channels can be primary interfaces.

•Ethernet, Port Channel, Management, Loopback, and VLANs can be backup interfaces.

•The primary and backup interfaces can be different interface types.

•Interface pairs should be similarly configured to ensure consistent behavior.

•An interface can be associated with a maximum of one backup interface.

•An interface can back up a maximum of one interface.

•Any Ethernet interface configured in an interface pair cannot be a port channel member.

•The STP mode is backup.

•Static MAC addresses should be configured after primary-backup pairs are established.

When load balancing is not enabled, the primary and backup interfaces cannot simultaneously forward VLAN traffic. When the primary interface is forwarding VLAN traffic, the backup interface drops all traffic. If the primary interface fails, the backup interface forwards VLAN traffic until the primary interface is functional.

The prefer vlan option balances the load across the primary and backup interfaces. When the command includes the prefer vlan option, each interface is the primary for a subset of the vlans carried by the pair. When both interfaces are up, prefer option vlans are forwarded on the backup interface and all other configured vlans are carried by the primary interface.

The no switchport backup-link and default switchport backup-link commands remove the primary-backup configuration for the configuration mode interface.

The abort command, in MST-configuration mode, discards pending changes to the MST region configuration, then returns the switch to global configuration mode.

The exit (mst-configuration mode) command saves MST region changes to running-config before returning the switch to global configuration mode.

The exit command, in MST-configuration mode, saves changes to the MST region configuration, then returns the switch to global configuration mode. MST region configuration changes are also saved by entering a different configuration mode.

The instance command inserts an entry into the VLAN-to-instance map that associates a set of VLANs to an MST instance. In addition to defining the MST topology, the VLAN-to-instance map is one of three parameters, along with the MST name and revision number, that identifies the switch’s MST region.

The no instance command removes specified entries from the VLAN-to-instance map. If the command does not provide a VLAN list, all entries are removed for the specified instance. The no instance and default instance commands function identically.

The name command configures the MST region name. The name is one of three parameters, along with the MST revision number and VLAN-to-instance map, that identifies the switch’s MST region.

The name has up to 32 characters. The default name is an empty string. The name string accepts all characters except the space.

The no name and default name commands restore the default name by removing the name command from running-config.

The revision command configures the MST revision number. The revision number is one of three parameters, along with the MST name and VLAN-to-instance map, that identifies the switch’s MST region. Revision numbers range from 0 to 65535. The default revision number is 0.

The no revision and default revision commands restore the revision number to its default value by removing the revision command from running-config.

The show command displays the current and pending MST configuration:

Exiting MST configuration mode stores all pending configuration changes to running-config.

The show command displays the current and pending MST configuration:

Exiting MST configuration mode stores all pending configuration changes to running-config.

The show spanning-tree command displays spanning tree protocol (STP) data, organized by instance.

The show spanning-tree bridge detail command displays detailed MST information including MSTP-Rapid PVST+ interoperation status.

The show spanning-tree blockedports command displays the list of blocked (discarding) ports.

The show spanning-tree counters command displays the number of BPDU transactions on each interface running spanning tree.

The show spanning-tree instance command displays spanning tree protocol bridge configuration settings for each instance on the switch. The display includes Bridge ID, Hello Time, Max Age, and Forward Delay times.

The command also displays the restartability of the STP agent when the detail option is selected. A switch can continue support of MLAG operation when its peer is offline and the STP agent is unavailable.

The show spanning-tree interface command displays spanning tree protocol information for the specified interface.

The show spanning-tree mst command displays configuration and state information for Multiple Spanning Tree Protocol (MST) instances.

The show spanning-tree mst configuration command displays information about the MST region’s VLAN-to-instance mapping. The command provides two display options:

•default displays a table that lists the instance to VLAN map.

•digest displays the configuration digest.

The configuration digest is a 16-byte hex string calculated from the md5 encoding of the VLAN-to-instance mapping table. Switches with identical mappings have identical digests.

The show spanning-tree mst interface command displays Multiple Spanning Tree Protocol (MSTP) information for a specified interface on the specified MST instances.

The show spanning-tree mst test information displays diagnostic spanning tree protocol information.

The show spanning-tree root command displays the Bridge-ID, cost to the root bridge, root port, and the root bridge timer settings for all instances.

The show spanning-tree topology status command displays the forwarding state of ports on the specified VLANs.

The show spanning-tree transmit active command displays spanning tree protocol bridge assurance information for network ports or for all ports. Bridge assurance-enabled ports will not necessarily be blocked when they link to a port where bridge assurance is not enabled, but if they do not receive periodic BPDUs from the other side of the link the show spanning-tree transmit active command will show a bridge assurance status of “inconsistent” (blocking) for that port.

The clear spanning-tree counters command resets the BPDU counters for the specified interfaces to zero in all CLI sessions.

The clear spanning-tree counter session command resets the BPDU counters to zero on all interfaces in the current CLI session. Counters in other CLI sessions are not affected.

The clear spanning-tree detected-protocols command restarts the spanning tree protocol (STP) migration state machine on the specified interfaces. The switch is reset to running rapid spanning tree protocol on an interface where it previously detected a bridge running an old version of the protocol.

— Humberto Villanueva 2020/11/11 02:10