How to Configure Rapid Spanning Tree (RSTP) on Cisco (Step by Step)

Step 1 — Switch every switch to Rapid-PVST+ mode

Cisco switches default to PVST+, a per-VLAN version of the old 802.1D standard. One command per switch moves the whole box to Rapid-PVST+ — per-VLAN 802.1w — for every VLAN it knows about. There's no per-VLAN toggle for the mode; it's global to the switch.

Run this on every switch in the Layer 2 domain. RSTP and classic STP do interoperate — an RSTP port facing a legacy 802.1D switch quietly falls back to classic behavior on that one link — but you only get the sub-second convergence where both ends speak RSTP, so a single switch left in the default mode drags its corner of the topology back to 802.1D timers. Do all of them.

SW1(config)# spanning-tree mode rapid-pvst

Step 2 — Make root election deterministic

Left alone, every switch ships with bridge priority 32768, and the lowest bridge ID (priority first, then the MAC address as the tie-breaker) wins the root election. That means the oldest switch — often some access-layer box with the lowest MAC — becomes root by accident and your traffic takes a bad path. Pick the switch you want as root (usually a core or distribution switch) and give it a lower priority so it wins on purpose.

Set it per VLAN. Priority has to be a multiple of 4096; the value you configure is the base, and IOS adds the VLAN ID (the sys-id-ext) on top — so priority 24576 on VLAN 10 shows up as 24586. Give a second switch the next-lowest priority as a standby root so there's a deterministic backup if the primary fails. The spanning-tree vlan 10 root primary / root secondary macros do the same thing (24576 and 28672 respectively) if you'd rather not type the numbers.

SW1(config)# spanning-tree vlan 10 priority 24576

SW2(config)# spanning-tree vlan 10 priority 28672

Step 3 — Flag host ports as edge ports with PortFast

An edge port — one with a single end host on it, never another switch — has no way to form a loop, so RSTP can bring it straight to forwarding and skip the handshake entirely. On Cisco that's PortFast. Beyond the instant link-up, an edge port also doesn't generate a topology change when it goes up or down, which keeps a flapping PC from flushing MAC tables across the whole VLAN.

Set it only on ports that face end devices. Put PortFast on a switch-to-switch link and you've told RSTP to forward immediately on a port that can form a loop — exactly the thing STP exists to prevent. Pair it with BPDU Guard so that if a switch (or anything else sending BPDUs) ever gets plugged into that edge port, the port err-disables instead of becoming a loop. You can flag ports one at a time, or set spanning-tree portfast default globally to make every access port an edge port automatically.

SW1(config)# interface gi0/5
SW1(config-if)# switchport mode access
SW1(config-if)# spanning-tree portfast
SW1(config-if)# spanning-tree bpduguard enable

Step 4 — Confirm the switch-to-switch links are point-to-point

RSTP's fast convergence rides on the proposal/agreement handshake, and that handshake only runs on point-to-point links. IOS infers the link type from duplex: a full-duplex link is treated as point-to-point (P2p), a half-duplex link as shared — and on a shared link RSTP falls back to the slow listening/learning transition, throwing away the speed you switched modes for. Modern switch-to-switch links are full-duplex and auto-detect as P2p, so usually there's nothing to do here but confirm it.

If duplex negotiation is off or a link is hard-set to half duplex, force the classification with spanning-tree link-type point-to-point on the interface. And don't forget the peer: everything in Steps 1, 2, and 4 has to be configured on the other switch too, or the two ends won't agree on who's root or how fast to converge.

SW1(config)# interface gi0/1
SW1(config-if)# spanning-tree link-type point-to-point
SW1(config-if)# end

SW2(config)# spanning-tree mode rapid-pvst
SW2(config)# spanning-tree vlan 10 priority 28672

Step 5 — Verify the result

Confirm three things from show spanning-tree vlan 10: the protocol line reads rstp (not the default ieee/pvst), the right switch is root, and every port is in the role and state you expect. The role column shows Root (the one port pointing toward the root), Desg (a designated forwarding port), Altn (an alternate port blocking a redundant path to the root), or Back (a backup port); the state column shows FWD, LRN, or BLK.

On the root bridge specifically, the output names it — 'This bridge is the root', with the Root ID address matching the Bridge ID address — and every one of its ports is a Designated port in Forwarding. The root is the reference point of the topology, so it has no root port at all; a Root role only ever appears on a non-root switch (where the Root ID address would differ from the local Bridge ID). On a non-root switch you'd instead see exactly one Root port aimed at the root and the redundant links sitting as Altn/BLK. Here's a root bridge for VLAN 10 with three point-to-point links, all Designated and Forwarding as they must be:

SW1# show spanning-tree vlan 10

VLAN0010
  Spanning tree enabled protocol rstp
  Root ID    Priority    24586
             Address     0011.2233.4455
             This bridge is the root
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec

  Bridge ID  Priority    24586  (priority 24576 sys-id-ext 10)
             Address     0011.2233.4455
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec
             Aging Time  300 sec

Interface           Role Sts Cost      Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------------------
Gi0/1               Desg FWD 4         128.1    P2p
Gi0/2               Desg FWD 4         128.2    P2p
Gi0/3               Desg FWD 4         128.3    P2p

Common problems (and the fix)

Convergence is still slow, or ports crawl through listening/learning: a switch somewhere in the path is still in the default PVST+ mode, or a link came up half-duplex and RSTP is treating it as shared. Run spanning-tree mode rapid-pvst on every switch and confirm the switch links are full-duplex (or force spanning-tree link-type point-to-point).

The root bridge landed on the wrong switch: you left the default priority 32768 in place and the switch with the lowest MAC won the election. Set the priority explicitly on the switch you want as root — spanning-tree vlan 10 priority 24576, or the root primary macro — and give a second switch root secondary as the backup.

A PortFast port keeps triggering topology changes or got BPDU-Guard err-disabled: PortFast is on a port that isn't actually an edge port — either it faces another switch, or something on that segment is sending BPDUs. Remove PortFast from any switch-to-switch link; if BPDU Guard shut a legitimate edge port down, clear the offending device, then recover the port with shutdown / no shutdown (or errdisable recovery).

The role/state output doesn't match the diagram: read it against the root. Every port on the root is Desg FWD and the root has no root port; each non-root switch has exactly one Root port toward the root and blocks its redundant path as Altn. If you ever see a Root port on the very switch that prints 'This bridge is the root', the two halves of the output disagree — that isn't a valid state a switch can produce, it's a sign you're reading a stale or hand-edited capture rather than live output.

Watching these roles settle in real time on a live IOS topology — and seeing a link converge in under a second instead of half a minute — is what makes RSTP click; worth doing once against a graded config so your show spanning-tree output matches what a correct RSTP domain actually looks like.