# VLANs and Spanning Tree Protocol Concepts

> Chapter 3 of the Courseiva ENCOR curriculum — https://courseiva.com/learn/encor/vlan-and-stp-concepts

**Official objective:** 2.1 — Describe VLAN, trunking, and STP concepts including RSTP and MST

## Introduction

Exam objective 2.1 for the 350-401 ENCOR exam covers networking fundamentals that underpin how devices communicate in a business environment. VLANs and spanning tree protocols solve two critical problems: they let you split a single physical network into multiple separate virtual networks, and they prevent data from getting stuck in infinite loops when there are backup connections. Understanding these concepts is essential because they appear in both the written exam and practical configuration scenarios.

## The Office Building Renovation Analogy

A facilities manager for a large office building needs to let different departments use the same floor without interfering with each other. The sales team has a loud open-plan area, the developers have a quiet section with special power outlets, and the executives have private offices. Without any separation, noise and foot traffic from sales would disrupt developers, and executives would get annoyed by people walking past their doors.

The manager installs moveable glass partitions that create separate zones on the same floor. Each zone can have its own rules: sales can play music, developers require keycard access, and executives get soundproof glass. This is like creating VLANs (Virtual Local Area Networks) on a single physical network switch. The partitions are the VLANs—they logically separate traffic even though everyone shares the same physical space.

But there is a hidden problem: the floor has a loop in its corridor design, so when someone walks around, they could accidentally get confused and circulate endlessly. To prevent this, the manager designs a "director of flow" who blocks one corridor path, forcing all traffic to take a single, efficient route. If that route becomes blocked, the director instantly activates the backup path. This director is like the Spanning Tree Protocol, which prevents network loops by blocking redundant links and only activating them when needed.

## Core explanation

Let us start with the basics. In a simple office network, you might have one big switch (a device that connects computers so they can talk to each other) and many computers plugged into it. Without VLANs, every device sees every other device's traffic. That creates two huge problems: security and performance. A computer in accounting could accidentally see traffic from HR, and if one department sends lots of data, it slows down everyone else.

A VLAN (Virtual Local Area Network) solves this by creating a virtual boundary inside the switch. Think of a switch as a multi-story building where each floor is a different VLAN. Devices on VLAN 10 can only talk to other devices on VLAN 10 unless you intentionally allow them to communicate through a router. For example, you could put all the sales team's computers on VLAN 10 and all the engineering team's computers on VLAN 20. Even though they share the same physical switch, they cannot see each other's traffic.

How do devices know which VLAN they belong to? Each Ethernet frame (the packet of data sent between devices) can carry a tag, defined by the IEEE 802.1Q standard. When a computer sends data to the switch, the switch adds a tag with the VLAN ID. Other switches can read that tag and forward the frame only to ports in the same VLAN. This is called trunking—a connection between two switches that carries traffic for multiple VLANs. A trunk port is like a motorway that has lanes for each VLAN, allowing all virtual networks to travel between switches over a single cable.

Now, let us talk about the Spanning Tree Protocol (STP). In a network, you often add redundant links between switches so that if one cable breaks, traffic can use another path. But here is the problem: if there are loops in the network (multiple paths between switches), data frames can circulate forever, doubling and tripling until they flood the network and bring everything down. This is called a broadcast storm. STP prevents this by creating a loop-free logical topology.

STP works by electing a root bridge (one switch that acts as the reference point). Every other switch calculates the shortest path to the root bridge and blocks any redundant ports that would create a loop. If a primary link fails, STP automatically recalculates and unblocks a previously blocked port to restore connectivity. This process takes about 30 to 50 seconds, which can be too slow for modern networks.

That is why Rapid Spanning Tree Protocol (RSTP) was developed. RSTP speeds up convergence to about 1 to 3 seconds by introducing a more efficient handshake process between switches. Instead of waiting for timers to expire, RSTP uses proposal and agreement messages to quickly transition ports to the forwarding state.

Then there is Multiple Spanning Tree Protocol (MST). In a network with many VLANs, you might want different load-balancing behaviour: for example, VLAN 10 could use one path, while VLAN 20 uses a different path. MST lets you group VLANs into instances, and each instance can have its own spanning tree. This way you can use multiple links simultaneously (for different VLANs) while still avoiding loops. MST is standardised in IEEE 802.1s and is common in large enterprise networks.

To summarise: VLANs give you logical separation on a physical network. Trunking lets you carry multiple VLANs across a single link. STP, RSTP, and MST prevent loops and provide redundancy. Together, they form the foundation for building scalable, secure, and resilient networks.

## Real-world context

An IT engineer at a manufacturing company with 500 employees must set up the network for a new office building. The building has three floors: ground floor for sales and marketing, first floor for engineering, and second floor for HR and finance. Each floor has two network switches connected to each other and to a central distribution switch in the server room.

The engineer starts by configuring VLANs to separate the departments for security and performance. She creates VLAN 10 for sales, VLAN 20 for marketing, VLAN 30 for engineering, VLAN 40 for HR, and VLAN 50 for finance. On each switch, she assigns the appropriate ports to the correct VLAN. For example, all computers on the ground floor that belong to sales get assigned to VLAN 10. She configures the uplink ports (ports connecting switches to each other) as trunk ports so that traffic for all VLANs can flow between the floors and the central switch.

Next, she considers redundancy. If one of the trunk cables between the central switch and the first-floor switch breaks, the network for engineering must still work. She connects a second cable between the central switch and the first-floor switch. Now there are two physical paths. Without STP, this would create a loop and crash the network. The engineer enables Rapid Spanning Tree Protocol (RSTP) on all switches. Within seconds, RSTP elects the central switch as the root bridge. The central switch sends out Bridge Protocol Data Units (BPDUs) to tell other switches which paths to use. The first-floor switch calculates its shortest path to the root bridge and blocks one of its ports—keeping the second cable as a backup.

Now, the engineer tests the setup. She unplugs the primary cable. Immediately, the blocked port transitions to forwarding, and the engineering team's network stays up. She then decides to use MST to improve performance. Because VLAN 30 (engineering) generates the most traffic, she wants it to use a different path than VLAN 40 and 50. She configures MST instance 1 to include VLANs 10 and 20, MST instance 2 to include VLANs 30 and 40, and MST instance 3 to include VLAN 50. Each instance can have its own root bridge and path preferences. This way, traffic for different departments can use different redundant links simultaneously.

In her daily work, the engineer monitors the network using tools like SNMP and syslog to check for topology changes or port errors. She also documents the VLAN layout and STP configuration so that the help desk can troubleshoot issues. When a new employee joins the HR team, she simply plugs their computer into a port configured for VLAN 40, and the network automatically assigns the correct access. No physical rewiring is needed.

## Exam focus

The 350-401 ENCOR exam tests VLANs and spanning tree protocols extensively. You should expect multiple-choice questions that ask about the purpose and operation of each protocol, as well as scenario-based questions where you must choose the correct configuration or troubleshooting step.

Key concepts the exam loves to test:
- The difference between access ports and trunk ports. An access port belongs to a single VLAN and does not tag frames. A trunk port carries multiple VLANs and uses 802.1Q tagging.
- The default VLAN on Cisco switches is VLAN 1. Do not assume it is disabled. Exam questions often imply that VLAN 1 should not be used for user traffic due to security concerns.
- The native VLAN on a trunk port. Frames from the native VLAN are sent untagged. If the native VLAN does not match on both ends of a trunk, a VLAN mismatch can cause connectivity issues or a VLAN hopping attack.
- STP port states: blocking (no data forwarding, no BPDU processing), listening (only processing BPDUs), learning (building MAC table but not forwarding), forwarding (normal operation), and disabled (administratively down). RSTP reduces states to three: discarding, learning, and forwarding.
- The election of the root bridge. The switch with the lowest bridge ID (a combination of priority and MAC address) becomes the root. The default priority is 32768. Exam questions often ask: if two switches have the same priority, which one becomes root? Answer: the one with the lowest MAC address.
- Root port, designated port, and blocked port. The root port is the single port on a non-root switch that has the best path to the root bridge. A designated port is the single port on a network segment that forwards BPDUs and data. All other ports become blocked (alternate or backup in RSTP).

Common trap patterns:
- The exam may give a topology diagram and ask you to identify which port to block. Always find the root bridge first, then calculate the root port on each non-root switch, then identify the designated port on each segment. Any port that is not root or designated must be blocked.
- Questions often use "root bridge election" with manually set priorities. Remember that a lower priority value wins. If you see priority 4096 vs 8192, the one with 4096 wins.
- For MST, understand that a region is a set of switches with the same configuration name, revision number, and VLAN-to-instance mapping. Switches outside the region treat MST BPDUs as legacy STP BPDUs.
- RSTP convergence uses a proposal-agreement handshake. A common question asks: what happens if a switch receives a superior BPDU on a port that is already designated? Answer: the port transitions to discarding and negotiates with its neighbour.

Exam tips: memorise the bridge ID format (8 bytes: 2 bytes priority, 6 bytes MAC). Know the default timer values: hello time 2 seconds, max age 20 seconds, forward delay 15 seconds. Understand why STP timers exist: to ensure loops are broken before frames are forwarded. Also, be ready to identify when a port is in errdisable state due to a loop or BPDU guard violation.

## Step by step

1. **Planning VLAN Allocation** — Before touching any equipment, decide which departments or functions need separate VLANs. For example, assign VLAN 10 to Sales, VLAN 20 to Engineering. This step prevents reconfiguration later and ensures IP addressing aligns with each VLAN.
2. **Configuring VLANs on Each Switch** — On each switch, create the VLANs using the 'vlan' command (e.g., 'vlan 10'). Then assign switch ports to the correct VLAN with 'switchport access vlan 10'. This step physically separates the traffic at the port level.
3. **Setting Up Trunk Ports** — Identify the ports that connect switches together. Configure them as trunk ports using 'switchport mode trunk'. Specify allowed VLANs (e.g., 'switchport trunk allowed vlan 10,20') to restrict traffic. This ensures VLANs can span multiple switches.
4. **Enabling STP and Adjusting Priorities** — Enable STP (or RSTP) globally. Then choose which switch should be the root bridge for each VLAN or instance. Set its priority lower (e.g., 'spanning-tree vlan 10 priority 4096'). This step establishes a loop-free topology with predictable failover.
5. **Verifying the Topology** — Use 'show spanning-tree' to confirm the root bridge, root ports, and blocked ports. Check that no unexpected loops exist. For RSTP, verify port roles are 'Root', 'Designated', or 'Alternate'. This step catches misconfigurations before they cause outages.
6. **Testing Redundancy and Recovery** — Simulate a link failure by disabling a trunk port. Use 'show spanning-tree' again to see the blocked port transition to forwarding. Measure the convergence time. This step confirms that STP provides the expected redundancy without manual intervention.

## Comparisons

### STP (802.1D) vs RSTP (802.1w)

**STP (802.1D):**
- Converges in 30-50 seconds
- Uses four port states (blocking, listening, learning, forwarding)
- Relies on timers (max age, forward delay)

**RSTP (802.1w):**
- Converges in 1-3 seconds
- Uses three port states (discarding, learning, forwarding)
- Uses proposal-agreement handshake for fast transition

### Access Port vs Trunk Port

**Access Port:**
- Belongs to a single VLAN
- Does not tag frames (untagged)
- Used for end devices (PCs, printers)

**Trunk Port:**
- Carries multiple VLANs
- Tags frames with 802.1Q header
- Used for switch-to-switch connections

### VLAN 1 vs Custom VLAN (e.g., VLAN 10)

**VLAN 1:**
- Default VLAN on all Cisco switches
- Used for control traffic (CDP, VTP, STP)
- Security risk if left as native VLAN

**Custom VLAN (e.g., VLAN 10):**
- Created by administrator for user traffic
- Can be removed from trunk to prune traffic
- Better security by isolating user traffic

### Root Port vs Designated Port

**Root Port:**
- Single port on non-root switch with best path to root
- Forwards BPDUs and data
- Only one per switch (per instance)

**Designated Port:**
- Single port on each segment that forwards BPDUs
- Forwards data to all devices on that segment
- May exist on root switch or non-root switches

## Diagram

_Flowchart showing three switches with trunk links carrying VLANs 10 and 20, where STP blocks the direct link between Switch B and Switch C to prevent a loop._

```mermaid
flowchart TD
    A[Switch A - Root Bridge] -->|Trunk: VLANs 10,20| B[Switch B]
    A -->|Trunk: VLANs 10,20| C[Switch C]
    B -->|Trunk: VLANs 10,20| C
    B -->|Blocked by STP| C
    A -->|Root Port| B
    A -->|Root Port| C
    subgraph VLAN_10
        D[PC1 - VLAN 10]
        E[PC2 - VLAN 10]
    end
    subgraph VLAN_20
        F[PC3 - VLAN 20]
        G[PC4 - VLAN 20]
    end
    B --> D
    B --> E
    C --> F
    C --> G
```

## Common misconceptions

- **Misconception:** VLANs physically separate devices like different cables or switches. **Reality:** VLANs are logical separations created by tagging frames with a VLAN ID. Devices still share the same physical switch and cables. (People assume 'virtual' means 'not real', but in networking, virtual means implemented in software. The physical hardware is still shared.)
- **Misconception:** STP only prevents loops and does not provide any redundancy. **Reality:** STP provides redundancy by automatically unblocking a backup port when the primary path fails. The blocking state is temporary and dynamic. (Beginners see a blocked port and think it is wasted. They do not realise it becomes active when needed.)
- **Misconception:** All VLANs must be assigned to a single trunk for them to work. **Reality:** Only VLANs that need to pass between switches need to be allowed on a trunk. You can restrict which VLANs are permitted for security and performance. (The default 'allow all VLANs' behaviour leads people to think it is mandatory, but best practice is to prune unused VLANs.)
- **Misconception:** RSTP and STP are completely different protocols that cannot interoperate. **Reality:** RSTP is backward-compatible with STP. An RSTP switch can connect to an STP switch and falls back to STP mode on that interface. (The name 'Rapid' makes people think it is a separate standard, but it is actually an evolution of the same protocol (802.1D-2004).)
- **Misconception:** MST creates multiple independent spanning trees for each VLAN. **Reality:** MST groups multiple VLANs into a single spanning tree instance. You define which VLANs belong to which instance, and each instance runs one spanning tree. (The word 'multiple' suggests each VLAN has its own tree, but MST is designed to reduce the number of trees while providing load balancing.)
- **Misconception:** The native VLAN is always VLAN 1 and cannot be changed. **Reality:** The native VLAN can be changed on a per-trunk basis using the 'switchport trunk native vlan' command. Changing it improves security. (Default configurations stick in people's minds as unchangeable rules. Cisco configs often show VLAN 1 as native, so beginners think it is fixed.)

## Key takeaways

- A VLAN creates a logical broadcast domain that separates traffic on the same physical switch, improving security and performance.
- Access ports belong to a single VLAN and do not add tags; trunk ports carry multiple VLANs and use 802.1Q tagging to identify each frame.
- STP prevents loops by electing a root bridge and blocking redundant ports, but it takes 30-50 seconds to reconverge after a failure.
- RSTP reduces convergence time to under 3 seconds by using a proposal-agreement handshake instead of waiting for timers.
- MST allows grouping multiple VLANs into a single spanning tree instance, enabling load balancing and reducing CPU overhead on switches.
- Always match the native VLAN on both ends of a trunk to avoid VLAN hopping attacks and connectivity issues.
- The bridge ID consists of a 2-byte priority value and a 6-byte MAC address; the lowest bridge ID determines the root bridge.
- STP port states are blocking, listening, learning, and forwarding; RSTP simplifies these to discarding, learning, and forwarding.

## FAQ

**What is the default VLAN on a Cisco switch?**

The default VLAN is VLAN 1. All ports belong to VLAN 1 by default, and all control traffic like CDP and VTP uses VLAN 1. It is best practice to change the native VLAN on trunks to a non-default VLAN for security.

**Do I need a router for devices on different VLANs to communicate?**

Yes, because VLANs are separate broadcast domains. To communicate between VLANs, you need a Layer 3 device like a router or a multilayer switch with SVIs (Switch Virtual Interfaces) configured for each VLAN.

**Can I have more than one root bridge in a network with STP?**

No, there can only be one root bridge per spanning tree instance. If you have multiple VLANs, you can use MST to have a different root for each instance, but within a single instance there is only one root.

**What happens if I accidentally create a loop on a switch that has STP disabled?**

The network will experience a broadcast storm, causing high CPU utilisation on switches, duplicate frames, and eventual network failure. Switches may become unresponsive until the loop is physically broken.

**How do I choose between STP, RSTP, and MST?**

Use RSTP for most modern networks because it converges faster. Use MST if you have many VLANs and want to load-balance traffic across redundant links. Use legacy STP only if you have old switches that do not support RSTP.

**What is a BPDU and why is it important?**

A BPDU (Bridge Protocol Data Unit) is a frame that switches exchange to learn about topology changes and elect the root bridge. BPDUs contain priority, MAC address, and path cost information. They are essential for STP to function.

## Check your understanding

1. **What does 802.1Q do in the context of VLANs?**

   Answer: 802.1Q is the standard that defines how to insert a VLAN tag (with a VLAN ID) into an Ethernet frame, allowing trunk links to carry multiple VLANs.

2. **When two switches have the same STP priority, which switch becomes the root bridge?**

   Answer: The switch with the lowest MAC address becomes the root bridge, because the bridge ID consists of priority + MAC address and the lower value wins.

3. **What is the purpose of the native VLAN on a trunk port?**

   Answer: The native VLAN is a VLAN whose frames are sent untagged on a trunk. It must match on both ends to avoid connectivity issues or security vulnerabilities.

4. **How does RSTP achieve faster convergence than STP?**

   Answer: RSTP uses a proposal-agreement handshake that allows ports to transition to forwarding quickly without waiting for timers, converging in 1-3 seconds.

5. **What is the advantage of using MST over separate RSTP instances per VLAN?**

   Answer: MST reduces CPU overhead by grouping multiple VLANs into a single spanning tree instance, while still allowing load balancing across different paths.

---

Interactive version with quiz and diagrams: https://courseiva.com/learn/encor/vlan-and-stp-concepts