Spanning Tree Protocol (STP) stops Ethernet loops from crashing your network. If you connect two switches with two cables for redundancy, without STP those frames will circulate forever and bring the network down. For the JNCIA-JUNOS exam, you must understand both STP and its faster cousin Rapid Spanning Tree Protocol (RSTP) because Juniper switches use them by default.
Jump to a section
A simple way to picture Junos Spanning Tree Protocol (STP, RSTP)
A department store has a single main entrance and a single emergency exit in the back. This works fine for most shoppers. But during a major sale, the store managers worry about a fire or a stampede. They decide to open a second emergency exit on the side wall. Now, if an alarm sounds, shoppers can leave through the main door, the back exit, or the new side exit. This creates a problem of its own. A shopper at the perfume counter sees the back exit and the side exit and cannot decide which way to run. In a panic, they run in a loop — out the back door, around the building, in through the side door, and back to the perfume counter. They are trapped in a loop.
The store manager solves this by designating one exit as the root exit. All other exits are exits you can use, but you must only run in a direction that leads you away from the root exit. If two exits lead to the same place, the manager blocks one of them so there is only one active path to any location in the store. This is exactly what Spanning Tree Protocol does for a network. Ethernet switches are like corridors in the store. The root bridge is the designated root exit. The protocol blocks certain connections — like locking a door — so that data frames never travel in a loop. If the best exit fails, the protocol unblocks a backup door automatically.
A network switch is a device that connects computers, printers, and servers so they can send data to each other. When a device sends a data frame (a packet of information), the switch learns which port that device is on and forwards frames only to that port when needed. This works beautifully in a simple layout where every switch connects to exactly one other switch. But in real office networks, reliability matters. If one cable breaks, you want a second path to keep traffic moving. So network engineers add redundant cables between switches.
This creates a physical loop in the topology. Imagine switch A connected to switch B with two cables. A data frame from a computer on switch A meant for a server on switch B arrives at switch A. Switch A sees the destination and sends the frame out both cables to switch B. Switch B receives the frame on port 1 and forwards it out port 2 back to switch A. Switch A receives it and sends it back out both cables again. This cycle repeats infinitely, saturating the switch processors and the cables. This is called a broadcast storm, and it causes the network to stop working entirely within seconds.
Spanning Tree Protocol, originally defined in IEEE 802.1D, solves this problem by turning a physical loop into a logical tree. The tree has no loops. STP forces every switch to elect one root bridge. The root bridge is the single reference point for the entire network. All other switches calculate the shortest path to the root bridge. If multiple paths exist, STP places some ports into a blocking state, meaning they do not forward data traffic. They stay as standby paths.
The election of the root bridge happens through Bridge Protocol Data Units (BPDUs). Every switch sends BPDU frames out all its ports. The BPDU contains the switch's bridge priority (a number) and its MAC address. The switch with the lowest bridge priority becomes the root. If priorities are equal, the switch with the lowest MAC address wins. Once the root is elected, every other switch calculates its root port — the port with the best path to the root bridge. On each network segment (a cable connecting two switches), one designated port is chosen to forward traffic. All other ports on that segment become blocked.
The transition from blocking to forwarding is slow. STP uses five port states: blocking, listening, learning, forwarding, and disabled. A port starts in blocking, moves to listening (where it listens for BPDUs), moves to learning (where it learns MAC addresses but does not forward data), and finally moves to forwarding. This process takes 30 to 50 seconds. That is an eternity in a modern network where users expect instant connections.
Rapid Spanning Tree Protocol (RSTP), defined in IEEE 802.1w, dramatically speeds this up. RSTP uses only three port states: discarding, learning, and forwarding. It also introduces port roles: root port, designated port, alternate port, and backup port. An alternate port is a ready replacement for the root port. A backup port is a ready replacement for a designated port. RSTP can fail-over a link in one to two seconds because it proactively negotiates the alternative paths before a failure occurs.
In Junos, you configure STP or RSTP at the [edit protocols] hierarchy. On Juniper EX series switches, RSTP is enabled by default under the name rstp. You can verify the STP topology with the command show spanning-tree. This displays the root bridge, the local bridge ID, the port roles, and the port states. You can also use show spanning-tree interface to see the state of a specific port.
To summarise: STP and RSTP are essential for preventing loops in redundant Ethernet networks. STP is the original standard with slow convergence. RSTP is the modern replacement with fast failover. Junos implements both, and RSTP is the default on most platforms.
Elect the Root Bridge
Every switch sends BPDU frames out all ports advertising its bridge priority and MAC address. The switch with the lowest bridge priority number wins the election and becomes the root bridge. If priorities are equal, the lowest MAC address breaks the tie.
Determine Root Port on Each Non-Root Switch
Once the root bridge is elected, every other switch calculates which of its ports has the lowest path cost back to the root bridge. That port becomes the root port, which is the switch's primary path to send traffic toward the root.
Select Designated Ports on Each Segment
On every network segment (the cable between two switches), the switch with the lowest path cost to the root bridge becomes the designated port for that segment. The designated port forwards traffic on that segment. The other switch on the same segment places its port into a blocking state.
Block Redundant Ports to Prevent Loops
Ports that are neither root ports nor designated ports become alternate ports (in RSTP) or move to the blocking state (in STP). These ports do not forward data traffic. They listen for BPDUs and act as standby paths in case the primary path fails.
Converge and Stabilise the Topology
STP waits through listening and learning states (about 30 seconds total) before moving blocked ports to forwarding. RSTP completes this in one to two seconds using a handshake mechanism between switches. Once converged, the network is loop-free and stable.
Respond to a Topology Change
If a link fails or a new switch is added, the affected switch sends a topology change notification. STP restarts the entire election process. RSTP immediately transitions an alternate port to the root port role and begins forwarding, minimising downtime.
Imagine you are the sole IT person for a mid-sized company called GreenLeaf Furniture. The office has 50 employees, a server room with three switches, and a VoIP phone system. The owner wants no downtime. You connect switch 1 to switch 2 with one cable, and switch 2 to switch 3 with another cable. That is a simple chain. But last week a user kicked a cable under a desk, and the whole sales floor lost network access for an hour. The owner demands redundancy.
You decide to add a second cable between switch 1 and switch 3. Now if the cable between switch 1 and switch 2 fails, traffic can flow from switch 1 to switch 3 to switch 2. You have created a physical loop, but you have also created a loop that will cause a broadcast storm if you do nothing. You need to enable a spanning tree protocol.
Step by step, you log into the Juniper switches using SSH. On each switch, you enter configuration mode. You type set protocols rstp. That is it — RSTP is now active. Junos automatically negotiates which switch becomes the root bridge. You check the result with the command show spanning-tree. You see that switch 3 has the lowest bridge priority because its MAC address happens to be the smallest. It becomes the root.
Now you want to make switch 1 the root because it is the central switch physically located in the server room. You configure a lower bridge priority on switch 1: set protocols rstp bridge-priority 4k. The default priority is 32k. Using 4k makes switch 1 the root. You verify with show spanning-tree again. Switch 1 is now listed as the root bridge.
You also want to ensure that certain ports become designated ports and others become alternate ports for fast failover. You connect a new file server to a port on switch 2. You want that port to be a designated port, not a root port. RSTP decides that automatically based on path cost. You check the port role with show spanning-tree interface ge-0/0/15. If it says role Designated, you are fine. If it says role Alternate, you know that port is blocked as a standby.
When a cable fails in the future, RSTP detects the loss of BPDU frames within three hello intervals (default 6 seconds). It then transitions the alternate port to forwarding in under two seconds. Users may experience a single missed ping and then everything resumes. You have successfully implemented loop-free redundancy using RSTP on Junos.
The JNCIA-JUNOS exam tests STP and RSTP heavily in the 'Layer 2 Switching' section. You will see multiple-choice questions, drag-and-drop ordering tasks, and scenario-based questions where you must interpret show command output. The exam expects you to know both the theory and the Junos configuration syntax.
Key topics the exam loves to test:
The difference between STP (802.1D) and RSTP (802.1w). They will ask which one converges faster. The answer is always RSTP.
The port states of STP (blocking, listening, learning, forwarding, disabled) compared to RSTP (discarding, learning, forwarding).
The port roles in RSTP: root port, designated port, alternate port, backup port.
How the root bridge is elected: lowest bridge priority wins, then lowest MAC address as tiebreaker.
The word 'bridge' in spanning tree refers to a switch in this context.
The default STP mode on Juniper EX switches is RSTP.
The configuration hierarchy: [edit protocols rstp] and [edit protocols stp].
The verification command: show spanning-tree and show spanning-tree interface.
The concept of BPDU protection: you can enable it on edge ports (ports connected to end devices) to prevent rogue BPDUs from affecting the topology.
Common traps in exam questions:
They might ask 'Which port role forwards traffic in STP?' and list Root, Designated, Alternate, Backup. The correct answers are Root and Designated. Alternate and Backup do not forward in steady state.
They might ask 'How long does STP take to converge?' The answer is 30-50 seconds. They might give a distractor of 5 seconds (that is RSTP).
They might present a show spanning-tree output and ask which switch is the root bridge. If the output shows 'Root ID: 0:00:00:00:00:00:00:01' and 'Bridge ID: 0:00:00:00:00:00:00:01', those IDs are identical, so that switch is the root. If they differ, the root is the switch with the lower ID shown in the Root ID field.
They might ask about the default bridge priority. The default is 32,768 (or 32k in Junos shorthand).
You must also know that BPDU frames are sent out all ports every 2 seconds by default (the hello time). If a switch stops receiving BPDUs on a root port for a certain number of hello intervals (default 3), it assumes the root bridge is unreachable and initiates a topology change.
The exam does not require you to memorise every detail of the IEEE standard, but you must understand the operational flow: root election, port role calculation, and convergence delay. Practise the configuration and verification commands in a lab or simulator before the exam.
STP (802.1D) prevents loops in Ethernet networks by blocking redundant links, but takes 30-50 seconds to converge after a change.
RSTP (802.1w) is the modern replacement for STP and converges in one to two seconds by proactively negotiating alternate paths.
The root bridge is elected based on the lowest bridge priority; if priorities are equal, the switch with the lowest MAC address becomes the root.
On Juniper EX series switches, RSTP is enabled by default under the 'rstp' protocol and can be verified with the command 'show spanning-tree'.
STP uses five port states (blocking, listening, learning, forwarding, disabled) while RSTP uses only three (discarding, learning, forwarding).
Alternate ports in RSTP are ready replacements for the root port and remain in a discarding state until the primary root port fails.
These come up on the exam all the time. Here's how to tell them apart.
STP (IEEE 802.1D)
Five port states: blocking, listening, learning, forwarding, disabled.
Convergence time of 30-50 seconds after a topology change.
Relies on timers for convergence; no proactive path negotiation.
RSTP (IEEE 802.1w)
Three port states: discarding, learning, forwarding.
Convergence time of one to two seconds.
Uses handshake between switches for rapid transition to forwarding.
Root Port
Exists on every non-root switch; one per switch.
Is the port with the lowest path cost to the root bridge.
Forwards traffic toward the root bridge.
Designated Port
Exists on every network segment; one per segment.
Is the port with the lowest path cost to the root bridge on that segment.
Forwards traffic away from the root bridge onto the segment.
Alternate Port
Provides a standby path to the root bridge.
Is in the discarding state in steady RSTP topology.
Takes over as root port if the current root port fails.
Backup Port
Provides a standby path for a designated port on the same segment.
Exists only when two ports on the same switch connect to the same segment.
Takes over as designated port if the current designated port fails.
BPDU
Special control frame used by STP/RSTP for topology information.
Sent every 2 seconds by default (hello time).
Contains bridge priority, MAC address, and path cost details.
Data Frame
Normal user traffic frame (e.g., from a computer to a printer).
Sent when a device communicates over the network.
Forwards based on MAC address table learned by the switch.
Mistake
STP and RSTP are the same thing, RSTP is just a marketing name.
Correct
RSTP is a completely different IEEE standard (802.1w) that converges much faster than the original STP (802.1D). RSTP uses different port states and roles and proactively negotiates alternate paths.
Both protocols share the word 'spanning tree' and perform the same fundamental loop prevention, so beginners assume they are interchangeable. The exam explicitly tests the differences.
Mistake
All ports on a switch running STP forward traffic at all times once the network is stable.
Correct
Alternate ports and backup ports remain in a blocking state permanently in a stable topology. They only start forwarding if the primary path fails.
People new to networking think stability means all ports are active. They do not realise that blocking ports are deliberately kept inactive to prevent loops, and that this is the core purpose of the protocol.
Mistake
The root bridge is always the most physically central switch.
Correct
The root bridge is elected based on the lowest bridge priority number (and MAC address as tiebreaker), not by physical location or performance. You can force any switch to become the root by setting a low priority.
Beginners apply real-world analogies of 'central hub' to the root bridge, assuming the network automatically chooses the switch that makes the most logical sense. The protocol has no concept of physical location.
Mistake
STP and RSTP only matter for large enterprises; small networks do not need them.
Correct
Any network with redundant links between switches needs STP or RSTP, regardless of size. Even two switches connected by two cables will create a broadcast storm without loop prevention.
People assume loop prevention is only for complex topologies. They do not realise that any physical loop, no matter how small, will cause immediate network failure. The exam tests this with small topology questions.
Mistake
If you configure RSTP, the network never experiences any delay during failover.
Correct
RSTP converges in one to two seconds, which is much faster than STP's 30-50 seconds, but there is still a brief interruption. Some applications may drop a single packet or require a retransmission.
The word 'rapid' leads people to expect instant zero-downtime failover. The exam occasionally asks about the exact convergence time of RSTP to trap candidates who think it is sub-second.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
Yes, if you have more than one switch and you connect them with more than one cable, you need STP or RSTP. Even in a home lab, a loop will crash the network. Juniper EX switches have RSTP enabled by default, so you are usually covered without extra configuration.
An alternate port is a standby replacement for the root port. It provides an alternative path to the root bridge if the current root port fails. A backup port is a standby replacement for a designated port on the same segment, which is rarer and only exists if two ports on the same switch connect to the same segment.
Use the command 'show spanning-tree'. In the output, look for the 'Root ID' line. It will show the bridge priority and MAC address of the root bridge. If the Root ID matches the Bridge ID on the local switch, that switch is the root.
You can, but it is not recommended. If a port running STP connects to a port running RSTP, both switches will revert to STP for that segment because they negotiate the highest common denominator protocol. This defeats the speed advantage of RSTP.
That creates a physical loop on the same switch. If STP or RSTP is enabled, the switch will detect the loop via its own BPDU and block one of the ports. Without STP, the loop will cause the switch to crash or become unresponsive due to broadcast storms.
No. On Juniper EX switches, you configure RSTP with the same command structure as STP. The default is RSTP. You only need to enter 'set protocols rstp' to enable it. The protocol handles the advanced features automatically.
You've finished Junos Spanning Tree Protocol (STP, RSTP). Continue through the JNCIA-JUNOS study guide to build a complete picture of the exam.
Done with this chapter?