Cisco Certified Network Associate (CCNA) 200-301 · Free study guide

Objective 2.5 — Interpret Rapid PVST+ operation

Spanning tree prevents Layer 2 loops by selecting one active logical topology for each VLAN while retaining alternate paths. Rapid PVST+ runs a rapid spanning-tree instance per VLAN, so root placement and port roles can differ between VLANs.

Root election and path selection

The bridge with the lowest bridge ID becomes root. Priority is compared before the MAC-based portion. Every non-root switch selects one root port offering its best path toward that root. Each segment selects a designated port. Redundant paths can become alternate ports.

On the root bridge, active ports toward segments are designated; the root has no root port. Configure primary and secondary root intent deliberately rather than letting an arbitrary access switch win by address.

Roles and states

Roles explain why a port exists in the topology: root, designated, alternate, or another specialized role. Rapid states describe current forwarding behavior: discarding, learning, or forwarding. An alternate port can remain discarding until a failure makes it the best path.

Learning populates the MAC table without forwarding user frames. Rapid transition depends on link type, proposal/agreement behavior, and edge assumptions.

PortFast and edge protection

PortFast marks an endpoint-facing edge so it can transition quickly. It does not disable spanning tree. BPDU guard protects that assumption by err-disabling or otherwise shutting an edge port that receives a BPDU. Use it where another switch should never appear.

Root guard prevents a port from accepting superior BPDUs that would move the root behind it. Loop guard protects a non-designated path when expected BPDUs stop, reducing the chance it incorrectly forwards. BPDU filter suppresses BPDUs and can remove loop detection; it is not interchangeable with BPDU guard.

Worked scenario

An access port configured with PortFast connects to an unmanaged switch, creating a loop. Without protection, the topology may reconverge or melt down under broadcast replication. BPDU guard on the intended edge provides a fail-closed response when BPDUs arrive. Root guard would address a different threat: an unexpected downstream device trying to become root.

Verification

For the affected VLAN, identify the root ID, local bridge ID, root path cost, port roles and states, and protection settings. Compare neighboring ports and confirm intended root placement. An interface can forward in one VLAN and block in another, so always include the VLAN context.

Common traps

• Saying the root bridge has a root port.
• Confusing a port role with a state.
• Saying PortFast disables STP.
• Using BPDU filter as safe edge protection.
• Reading one VLAN's topology as universal.

Readiness checklist

• I can elect a root and select root/designated roles.
• I can distinguish discarding, learning, and forwarding.
• I can choose root guard, loop guard, or BPDU guard from a failure mode.
• I always verify per-VLAN context.