20 hands-on STP scenarios you build in your own Cisco Modeling Labs instance and grade against the answer key. STP configuration and troubleshooting practice for CCNA and CCNP.
Included with a subscription
Daily CCNA troubleshooting lab focused on Spanning Tree root bridge selection. A fully working campus access/distribution triangle forwards traffic, but the wrong switch is root for VLAN 10 and VLAN 20, forcing an inefficient path. Diagnose with show commands and repair by influencing the election without creating a loop.
Bring together core campus redundancy skills in one focused day: elect a deterministic STP root on the intended distribution switch, form a working LACP EtherChannel between distribution and access, harden edge with PortFast/BPDU Guard, and stand up an HSRP virtual gateway that the VLAN 10 users actually use. The starter is intentionally mis-tuned across layers so you must build or repair it end-to-end.
Bundle two parallel switch uplinks into a single Port-Channel using LACP so that Spanning Tree no longer blocks one link. You will convert two existing 802.1Q trunks into one logical trunk, verify both member links are active in the Port-Channel, and confirm end-to-end host reachability.
Harden a small campus Layer-2 triangle so a downstream access switch cannot become root. You will verify DSW1 is already the STP root for VLAN 20, then apply Root Guard on each distribution switch’s access-facing trunk to the access layer. Confirm steady-state reachability between users and that a superior BPDU would put those ports into root-inconsistent instead of re-rooting the campus.
Harden the campus access edge by enabling PortFast and BPDU Guard only on host-facing access ports while keeping redundant switch-to-switch trunks loop-free with STP. Validate instant host link-up and demonstrate that a rogue BPDU errdisables the port instead of changing the topology.
Migrate a small campus from legacy PVST+ to Rapid-PVST+ across all switches, harden trunks, mark edge ports, and verify sub-second RSTP behaviours. A three-switch triangle with redundant trunks carries VLAN 10 to two hosts so you can validate end-to-end and observe convergence when a trunk flaps.
Build a redundant campus triangle with two distribution switches and one access switch. Implement PVST+ per-VLAN root tuning so VLAN 10 forwards over DSW1 while VLAN 20 forwards over DSW2. Verify that each VLAN chooses a different root and that the blocked uplink differs per VLAN, while end hosts in each VLAN can still reach their local SVI gateway IP.
Influence a downstream access switch’s STP root-port choice using per-interface path cost and port priority. You will make the access switch prefer the non-default uplink so that the intended link forwards while the other becomes the alternate/blocking path. Validate with show commands and end-to-end host pings.
Designate an intentional STP root bridge and backup for a campus user VLAN across a redundant three-switch triangle. You will verify correct root election and port roles and confirm end-to-end host connectivity while preventing Layer-2 loops.
Build an LACP Layer-2 EtherChannel between SW1 and SW2 so Rapid-PVST+ treats two parallel links as one logical Port-channel 7. Without EtherChannel, STP will block one of the two access links. With LACP active on both members and Port-channel 7 as an access port in VLAN 70, STP shows a single forwarding interface (Po7) and both physical links forward as one logical channel. Two hosts in VLAN 70 verify end-to-end connectivity.
Beginner CCNA lab on a redundant two-switch Layer-2 loop with two parallel uplinks. You will enable Rapid-PVST+, set a deterministic root-bridge priority so SW1 becomes the root for VLAN 1, and verify port roles (root/designated/alternate) and loop prevention. Two Alpine hosts in VLAN 1 validate end-to-end connectivity without any routing or SVIs.
Free with an account
Guide Rapid-PVST+ to prefer a specific parallel trunk by tuning the sender’s port priority on the root bridge. Two ioll2-xe switches (SW1, SW2) form a physical loop via two equal-speed trunks. A third L2 switch (SW3) extends the user VLAN to a second closet. One Alpine host attaches to SW1 and another to SW3 in VLAN 40 (10.1.40.0/24). You will: force SW1 to be the root for VLAN 40, lower the port priority on SW1’s Gi0/2 (Ethernet0/1) to break the tie so SW2 selects its Gi0/2 as the Root Port, enable PortFast and BPDU Guard on host-facing ports, and verify with show spanning-tree outputs and host pings.
Beginner CCNA STP lab on a three-switch triangle with two hosts in VLAN 20. You will deliberately control the Spanning Tree root election using the root primary/secondary macros so SW1 is the active root and SW2 is the standby. The baseline already provides VLANs and trunks; your job is to set root priorities deterministically and verify the resulting roles and port states without introducing any Layer-3.
Configure PortFast correctly on access ports in a triangle switch loop while maintaining normal STP protection on inter-switch trunks. Force SW1 as the root for VLAN 50 and verify that only edge ports are fast-tracked. Observe the difference in host convergence with and without PortFast.
Continue the STP series on a three-switch triangle with a real loop. SW1 is the deterministic root for VLAN 60, and access ports already use PortFast. In this lab you will harden the edge by enabling BPDU Guard on the two host-facing access ports on SW2 and SW3, while leaving the inter-switch trunks untouched. Verify with show commands that BPDU Guard is active only on the edge and that hosts still communicate normally.
Advanced Rapid-PVST+ and Root Guard implementation on a three-switch triangle with a real loop. SW1 is the intentional root for VLAN 90 and protects its designated ports with Root Guard to prevent root re-parenting. Two Alpine hosts on VLAN 90 verify end-to-end forwarding remains stable even if a superior BPDU appears downstream.
Advanced Rapid-PVST+ troubleshooting on a 3-switch triangle with a real Layer-2 loop. Two deliberate faults are seeded: an unintended root bridge wins VLAN 100 due to a mis-set/default priority, and PortFast/BPDU Guard are mistakenly applied on an inter-switch trunk. Two Alpine hosts in VLAN 100 verify user impact. Your job: use show commands to diagnose, then restore the correct root and remove edge features from the trunk while preserving them on access ports.
Engineer which trunk forwards by tuning STP path cost in a 3-switch triangle. Force SW1 as the VLAN 30 root at a deterministic priority, enable Rapid-PVST+, harden edge ports with PortFast and BPDU Guard, and raise the STP cost on SW3’s direct uplink to SW1 so SW3 prefers the longer, indirect path via SW2. Verify the resulting root port, alternate (blocked) port, and host reachability across the chosen path.
Migrate a three-switch triangle from legacy PVST to Rapid-PVST+ without changing the existing root or blocked port. SW1 remains the deterministic root for VLAN 70 (priority 4096). Verify protocol mode, link types (point-to-point vs edge), and end-to-end host reachability, then observe the faster reconvergence behavior of Rapid-PVST+.
Use Rapid-PVST+ to elect different root bridges per VLAN across two parallel trunks, spreading VLAN 80 and VLAN 81 across distinct physical links without modifying path cost or port priority. Validate independent per-VLAN trees and confirm hosts in VLAN 80 can communicate over the surviving path. Includes a drift-check to diagnose/restore trunk allow-lists.
Spanning Tree Protocol is the reason a campus network with redundant switch links does not melt down. Ethernet frames carry no TTL, so a single Layer 2 loop turns one broadcast into a storm that saturates every link and thrashes the MAC address table until nothing forwards. STP prevents that by electing a root bridge and blocking the redundant paths back to it. The catch is that the election is automatic but not automatically correct: leave the default priority of 32768 in place and the switch with the lowest MAC address wins, which is often an old access switch in a closet rather than your distribution pair. Recognizing that, and knowing which port should be Root, which should be Altn, and why, comes from reading show spanning-tree on a live topology rather than from memorizing the port states.
These labs give you real Cisco switches in Cisco Modeling Labs and make you take control of the tree. You will move the domain to Rapid-PVST+ with spanning-tree mode rapid-pvst, pin the root with spanning-tree vlan 10 priority 24576 (IOS adds the VLAN ID as the extended system ID, so it displays as 24586) or the spanning-tree vlan 10 root primary macro, designate a backup with root secondary, and steer paths by tuning spanning-tree cost and spanning-tree port-priority. Load-balancing labs make one switch root for VLAN 10 and the other root for VLAN 20 so both uplinks carry traffic. Edge-protection labs pair spanning-tree portfast with spanning-tree bpduguard enable on host ports, and apply spanning-tree guard root where a neighbor should never become root. Verify with show spanning-tree vlan 10, show spanning-tree root, and show spanning-tree interface detail. Break/fix scenarios hand you a root that landed on the wrong switch, PortFast on a switch-to-switch link, a BPDU Guard err-disabled port, and one switch left in PVST+ while the rest run Rapid-PVST. Every config is graded requirement by requirement against the answer key.
By the lowest bridge ID, which is the configured priority plus the extended system ID (the VLAN number) plus the switch MAC address. Every switch ships with priority 32768, so with no configuration the oldest switch, the one with the lowest MAC, usually wins. Priority is set per VLAN and must be a multiple of 4096, which is what makes the election deterministic in the labs.
PortFast brings an access port straight to forwarding instead of walking it through listening and learning, and stops a flapping host from generating topology changes. BPDU Guard is the protection that belongs with it: if any BPDU arrives on that port, the port is put into err-disabled rather than quietly becoming a normal spanning-tree port. Use both together on ports meant only for end hosts, and neither on a link to another switch.
Yes. Everything runs in your own Cisco Modeling Labs instance. The multi-switch topologies use CML free-tier switch images, so you can build a three-switch triangle with redundant links, watch a port go to blocking, and pull a cable to see convergence, all from a YAML package that imports in one click.
Study the theory behind these labs — the concept explainer and step-by-step guides.
Looking for something else? Browse the full lab archive, narrow it to self-standing labs, or see today's daily lab.