Rapid PVST+: Port Roles, Port States, and Fast Convergence

Rapid PVST+ (Per-VLAN Spanning Tree Plus) is Cisco’s proprietary per-VLAN implementation of IEEE 802.1w Rapid Spanning Tree Protocol. It runs one independent 802.1w instance for every VLAN on the switch, and it reaches a loop-free topology in a second or two instead of the 30 to 50 seconds that the original 802.1D timers required. You turn it on with one global command, spanning-tree mode rapid-pvst, and every VLAN instance converts at once.

Enabling the mode

Cisco IOS accepts exactly three spanning-tree modes, and the parser will not take anything else:

SW1(config)# spanning-tree mode ?
  mst         Multiple spanning tree mode
  pvst        Per-Vlan spanning tree mode
  rapid-pvst  Per-Vlan rapid spanning tree mode

SW1(config)# spanning-tree mode rapid-pvst

There is no rstp keyword, because the per-VLAN behavior is a Cisco addition on top of the IEEE standard and Cisco named the mode after its own protocol. Catalyst switches ship in pvst mode, which is the per-VLAN version of legacy 802.1D. Mode selection is switch-wide, so it belongs in global configuration and is not available under an interface.

Running one instance per VLAN also means each BPDU carries the VLAN it belongs to, which is how a switch detects that a trunk’s two ends disagree about the untagged VLAN and blocks the affected VLANs, the behavior described in native VLAN mismatch.

Rapid PVST+ interoperates with legacy neighbors on a per-port basis. If a port hears an 802.1D BPDU (bridge protocol data unit), that port falls back to legacy behavior and its timers, while the rest of the switch keeps running the fast protocol. The fallback is sticky until the link flaps or you clear the detected protocol.

The four port roles

Every port that participates in a given VLAN instance is assigned exactly one role, and the role is always the outcome of comparing BPDUs, never something you configure directly.

• Root port. The one port on a non-root switch with the best path back toward the root bridge. It forwards. Each non-root switch has exactly one per VLAN instance.
• Designated port. The forwarding port for a given collision domain or segment. Every segment has one, and every port on the root bridge is designated.
• Alternate port. A port that receives a better BPDU from another switch and therefore holds a backup path to the root. It discards traffic, and it is the port that takes over instantly when the root port fails.
• Backup port. A redundant connection to the same segment that a designated port already serves, which happens when two ports on the same switch land on one hub or shared segment. It discards.

The alternate and backup roles are the visible additions 802.1w made. Legacy 802.1D simply called both of them “blocking” and had no notion of a pre-computed replacement, which is exactly why it needed timers to recover.

The three port states

RSTP replaced the five-state 802.1D model with three. Disabled, blocking, and listening all collapse into a single discarding state, because from a data-plane perspective they are identical: the port neither forwards frames nor populates the MAC address table.

802.1D state	RSTP state	Forwards frames	Learns MAC addresses
Disabled	Discarding	No	No
Blocking	Discarding	No	No
Listening	Discarding	No	No
Learning	Learning	No	Yes
Forwarding	Forwarding	Yes	Yes

The Sts column in IOS output still prints BLK for a discarding port, LRN for learning, and FWD for forwarding. BLK on a switch running Rapid PVST+ means discarding.

Roles and states are separate properties. A port has a role because of what the BPDU comparison decided, and a state because of what it is allowed to do with frames right now. An alternate port is discarding; a root port that just came up may be discarding for a moment before it forwards.

Link types and edge ports

Fast convergence depends on knowing what is on the other end of the cable. Rapid PVST+ derives link type from duplex:

• Point-to-point is inferred from full duplex. This is the only link type that supports the fast handshake.
• Shared is inferred from half duplex, which implies a hub or a legacy collision domain, and forces the port to converge using timers.
• Edge is a port with PortFast configured, meaning a port that faces a host rather than a switch. An edge port comes up forwarding immediately and does not generate topology change notifications when it flaps.

A bundle of physical links negotiated into one logical interface counts as a single point-to-point port here, which is why EtherChannel with LACP or PAgP adds bandwidth without leaving redundant ports blocked.

You can override the inference when the duplex reading is misleading, for example across a media converter:

SW1(config)# interface GigabitEthernet1/0/24
SW1(config-if)# spanning-tree link-type point-to-point

An edge port loses that status the moment it receives a BPDU, and from then on it behaves like any other switch-facing port. Edge status is a performance optimization, not a security control, which is why it is paired with BPDU guard and the other STP protection features.

The port table from show spanning-tree vlan 20 shows all of this in one place:

Interface           Role Sts Cost      Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------------------
Gi1/0/3             Desg FWD 4         128.3    P2p Edge
Gi1/0/11            Root FWD 4         128.11   P2p
Gi1/0/12            Altn BLK 4         128.12   P2p
Fa0/24              Desg FWD 19        128.24   Shr

P2p Edge is a PortFast host port. Shr on Fa0/24 is a warning sign: something negotiated to half duplex, and that port will never converge quickly.

Proposal and agreement

The reason Rapid PVST+ converges in about a second on a new link is that it stops waiting and starts asking. When two switches bring up a point-to-point link, the switch with the better BPDU sends a proposal. The receiving switch performs a sync: it moves all of its non-edge designated ports to discarding, which guarantees no loop can exist while it answers, then returns an agreement. The proposing switch immediately transitions to forwarding. The sync then ripples outward one link at a time toward the edge of the network.

Two further mechanics:

• BPDUs are keepalives. Every switch originates its own BPDU every hello interval (2 seconds by default) rather than only relaying the root’s. Missing three consecutive BPDUs, so 6 seconds, ages out the stored information immediately instead of waiting the 20-second max age.
• Topology changes are handled differently. Only a non-edge port moving to forwarding raises a topology change. The switch that detects it floods a TC (topology change) directly and flushes MAC address table entries on all ports except the one that received the notification, rather than shortening the aging timer and asking the root to relay the news.

Forward delay (15 seconds) and max age (20 seconds) still appear in the output and are still used, but only in the fallback cases: shared links and legacy interoperation.

How the 200-301 exam tests this

• Mode selection syntax. A question gives a switch on the default and asks for the command that moves it to the rapid per-VLAN protocol. Recognize that the keyword is rapid-pvst, that it is global configuration, and that anything containing rstp is invented syntax.
• Role versus state. A scenario describes a redundant uplink that carries no traffic but is ready to take over, and the answer choices mix roles and states. The role is alternate, the state is discarding, and IOS shows it as BLK.
• State-list traps. A question lists 802.1D’s five states and asks which ones exist under the rapid protocol. Discarding, learning, and forwarding are the only three.
• Convergence conditions. A scenario has a link stuck at half duplex or an interface that shows Shr in the Type column, and asks why convergence takes 30 seconds on that link. The proposal and agreement handshake requires a point-to-point link type.

Role-versus-state confusion is the most common miss here, and it clears up fast under exam-style questions that force the distinction.

Quick reference

• Rapid PVST+ is Cisco’s per-VLAN implementation of IEEE 802.1w, enabled globally with spanning-tree mode rapid-pvst.
• The three IOS modes are pvst, rapid-pvst, and mst; Catalyst switches default to pvst.
• Roles: root, designated, alternate, backup. Alternate and backup are the pre-computed replacements that make fast failover possible.
• States: discarding, learning, forwarding. Discarding absorbs the legacy disabled, blocking, and listening states.
• IOS prints BLK in the Sts column for a discarding port.
• Link type comes from duplex: full duplex means point-to-point and enables proposal/agreement, half duplex means shared and falls back to timers.
• Each switch originates BPDUs every 2 seconds; three missed BPDUs age the information out in 6 seconds.
• Who becomes the root, and how the tiebreakers work, is covered in STP root bridge election.