> ## Content Index > Fetch the complete content index at: https://www.pinglabz.com/llms.txt > Use this file to discover other available public pages before exploring further. # How to Configure the STP Root Bridge on Cisco Switches - URL: https://www.pinglabz.com/configure-stp-root-bridge-cisco/ - Published: 2026-03-27T05:16:12.000Z - Updated: 2026-07-04T23:02:01.000Z - Description: The root bridge is the reference point for all STP calculations. Proper root bridge configuration is critical to predictable topology and optimal traffic flow. This article covers priority commands, macros, and design placement. - Author: Jaime - Tags: STP, #Import 2026-08-01 19:54 ## Understanding Root Bridge Role The root bridge is the elected reference point from which all spanning tree paths are calculated. Every bridge cost and path decision flows from the root. In multi-VLAN environments running PVST+ or Rapid PVST+, each VLAN has its own root bridge. If you want the bigger picture first, the [STP complete guide](https://www.pinglabz.com/spanning-tree-protocol/) covers the architecture this article plugs into. Proper root bridge placement is not optional - it's a design requirement. A misplaced root causes suboptimal forwarding paths, unnecessary link utilization, and unnecessary STP recalculations during network changes. ## Root Bridge Election and Priority STP elects the root bridge based on bridge priority and MAC address. The bridge with the lowest priority value wins. If priorities are equal, the bridge with the lowest MAC address becomes root. Default priority on all Catalyst switches is 32768\. The priority value must be a multiple of 4096, ranging from 0 (highest priority) to 61440 (lowest priority). For example: - Priority 0: Always root (unless another bridge has 0, then lowest MAC wins) - Priority 4096: Very likely root - Priority 8192: Likely root in most networks - Priority 32768: Default, rarely becomes root unless intentional ## Configuring Root Bridge: The Quick Way Cisco provides a macro command to automatically set appropriate priority on a switch and its backup: ``` SW1(config)# spanning-tree vlan 10 root primary SW1(config)# spanning-tree vlan 20 root primary SW1(config)# spanning-tree vlan 30 root primary ``` This command: - Sets the switch's priority to the lowest value required to make it root (typically 4096, but accounts for diameter if configured) - Should be configured on your intended root bridge - Works for single VLANs or ranges (e.g., `spanning-tree vlan 10-30 root primary`) Then configure a backup root bridge on a second switch in your topology: ``` SW2(config)# spanning-tree vlan 10 root secondary SW2(config)# spanning-tree vlan 20 root secondary SW2(config)# spanning-tree vlan 30 root secondary ``` The `root secondary` command sets priority to 16384, making it second-most-likely to become root if the primary fails. ## Manual Priority Configuration For more granular control, configure priority explicitly: ``` SW1(config)# spanning-tree vlan 10 priority 4096 SW1(config)# spanning-tree vlan 20 priority 8192 SW1(config)# spanning-tree vlan 30 priority 8192 ``` Use this approach when: - You need specific priority values for multiple VLANs - You're integrating with legacy switches that require different priorities - You need to document explicit design decisions in configuration Priority must be a multiple of 4096\. Catalyst switches automatically round invalid values to the nearest multiple. ## Designing Root Bridge Placement **Distribution Layer Placement (Recommended)** In a typical campus topology, place the root bridge on a distribution layer switch: ``` ┌─────────────────────────┐ │ Core Router │ └──────────┬──────────────┘ │ ┌──────────────────┼──────────────────┐ │ │ │ ┌──────┐ ┌──────┐ ┌──────┐ │ SW1 │ │ SW2 │ │ SW3 │ │(Root)│ │(Root)│ │(Root)│ │ Dist │ │ Dist │ │ Dist │ └──┬───┘ └──┬───┘ └──────┘ │ │ ┌─────┴──────┬───────────┴─────┬──────────┐ │ │ │ │ ┌──────┐ ┌──────┐ ┌──────┐ ┌──────┐ │ SW4 │ │ SW5 │ │ SW6 │ │ SW7 │ │Access│ │Access│ │Access│ │Access│ └──────┘ └──────┘ └──────┘ └──────┘ ``` Benefits: - Distribution switches have redundancy and are less likely to reboot - Paths from access layer to distribution are predictable (direct) - Core router doesn't participate in STP (different layer) - Easy to locate physical root for troubleshooting **Data Center Placement** In data center Spanning Tree designs, place the root bridge on a spine switch or core aggregation switch: ``` ┌──────────────────┬──────────────────┐ │ Spine 1 │ Spine 2 │ │ (Root) │ (Root) │ └────────┬─────────┴──────┬───────────┘ │ │ ┌───────┴────────┬───────┴────────┐ │ │ │ ┌─────────┐ ┌─────────┐ ┌─────────┐ │ Leaf 1 │ │ Leaf 2 │ │ Leaf 3 │ └────┬────┘ └────┬────┘ └────┬────┘ │ │ │ Servers & VMs ``` Data center typically uses MST (Article 14) rather than PVST+, but if using Rapid PVST+, spine placement ensures optimal East-West traffic flow. ## Real-World Configuration Example Lab topology: Catalyst 9300 switches (SW1, SW2, SW3, SW4) with VLANs 10, 20, 30. **SW1 (Distribution, Primary Root)** ``` SW1#configure terminal SW1(config)# spanning-tree mode rapid-pvst SW1(config)# spanning-tree vlan 10 root primary SW1(config)# spanning-tree vlan 20 root primary SW1(config)# spanning-tree vlan 30 root primary SW1(config)# end ``` **SW2 (Distribution, Backup Root)** ``` SW2#configure terminal SW2(config)# spanning-tree mode rapid-pvst SW2(config)# spanning-tree vlan 10 root secondary SW2(config)# spanning-tree vlan 20 root secondary SW2(config)# spanning-tree vlan 30 root secondary SW2(config)# end ``` **SW3 and SW4 (Access Layer)** ``` SW3#configure terminal SW3(config)# spanning-tree mode rapid-pvst SW3(config)# spanning-tree vlan 1 priority 32768 SW3(config)# end SW4#configure terminal SW4(config)# spanning-tree mode rapid-pvst SW4(config)# spanning-tree vlan 1 priority 32768 SW4(config)# end ``` Access layer switches don't explicitly configure priority - they remain at default (32768) and do not become root bridges. ## Verification Commands After configuring the root bridge, verify with: ``` SW1# show spanning-tree vlan 10 ``` Sample output: ``` VLAN0010 Spanning tree enabled protocol rstp Root ID Priority 4096 MAC-address 0022.55a6.5801 Bridge ID Priority 4096 (priority 4096 sys-id-ext 0) MAC-address 0022.55a6.5801 Aging Time 20 Role Sts Cost Prio.Nbr Type -------- --- --------- -------- ---- ``` The Bridge ID matches the Root ID, confirming SW1 is the root for VLAN 10. **Check All VLANs** ``` SW1# show spanning-tree summary ``` Output excerpt: ``` Switch is in rapid-pvst+ mode Root bridge for VLAN0010, VLAN0020, VLAN0030 Rapid PVST Instances VLAN IDs of instances running Rapid PVST 1, 10, 20, 30, 99 ``` **Verify from Non-Root Switch** ``` SW3# show spanning-tree vlan 10 root ``` Output: ``` Root Hello Max Fwd VLAN Root ID Priority Cost Port Time Age Dly ---- -------------------------------- -------- ----- -------- ---- ---- ---- 10 4096.0022.55a6.5801 4096 0 Gi1/0/1 2 20 15 ``` The cost of 0 indicates SW3 has a direct link to the root. ## Common Configuration Mistakes **Mistake 1: Forgetting to Configure Backup Root** Problem: Root bridge fails, and a random access switch becomes root, causing suboptimal forwarding. Fix: Always configure `spanning-tree vlan X root secondary` on a second distribution switch. **Mistake 2: Using Default Priority (32768)** Problem: Any switch can become root if lower priorities are not configured, leading to unpredictable topology. Fix: Explicitly configure primary and secondary roots. Do not rely on default priority. **Mistake 3: Configuring Root on Access Layer** Problem: Access layer switch becomes root, causing all upstream traffic to converge on that device, overwhelming its CPU and links. ``` ! DO NOT DO THIS: SW4(config)# spanning-tree vlan 10 root primary ! WRONG ``` Fix: Root bridges belong on distribution or core layer. Access switches should have default priority (32768). **Mistake 4: Inconsistent VLANs Across Switches** Problem: Different switches have different root bridges for the same VLAN, causing traffic blackholing. Solution: Configure the same switch as primary root for all managed VLANs. Use ranges: ``` SW1(config)# spanning-tree vlan 10-30,99 root primary ``` **Mistake 5: Not Accounting for Bridge Diameter** In very large networks, you can configure STP bridge diameter to optimize timers: ``` SW1(config)# spanning-tree vlan 10 root primary diameter 7 ``` This reduces convergence time on large topologies. If not set, defaults assume worst-case diameter (7). ## Priority Calculation in Catalyst Switches The full bridge priority is composed of: - Base priority (configured): 0-61440 in multiples of 4096 - System ID extension: VLAN ID (0-4095) - Full priority = base + VLAN ID When you configure `spanning-tree vlan 10 priority 4096`, the effective priority is 4096 + 10 = 4106. For VLAN 20: 4096 + 20 = 4116. This ensures each VLAN can have a different root while using the same base priority: ``` SW1# show spanning-tree summary VLAN0010 Root ID: 4106.0022.55a6.5801 VLAN0020 Root ID: 4116.0022.55a6.5801 VLAN0030 Root ID: 4126.0022.55a6.5801 ``` All derived from base priority 4096. ## Changing Root Bridge After Deployment If you need to change which switch is the root bridge (e.g., after a hardware upgrade), use: ``` SW1(config)# no spanning-tree vlan 10 root primary SW1(config)# spanning-tree vlan 10 root secondary SW3(config)# no spanning-tree vlan 10 root secondary SW3(config)# spanning-tree vlan 10 root primary ``` New root election happens immediately. During this transition, STP converges (typically 30-50 seconds in Rapid PVST+, less than 5 seconds in MSTP). Verify the change: ``` SW3# show spanning-tree vlan 10 Bridge ID Priority 4096 (priority 4096 sys-id-ext 0) MAC-address 0055.8844.2203 ``` ## Troubleshooting Root Bridge Issues ### Symptom: Random Switch Becomes Root After Reboot **Cause:** Root bridge was not configured explicitly, defaulting to 32768\. A different switch with lower MAC address becomes root. **Fix:** Configure explicit primary and secondary roots immediately: ``` config t spanning-tree vlan 1-4094 root primary ! or use ranges: spanning-tree vlan 10,20,30 root primary end ``` ### Symptom: Can't Reach Root Bridge from Access Layer **Cause:** Root bridge is isolated due to misconfigured STP timers or unidirectional links (UDLD disabled). **Fix:** 1. Verify root bridge is up: `show spanning-tree vlan 10 root` 2. Check root bridge configuration: `show running-config | include spanning-tree` 3. Enable UDLD on uplinks to detect unidirectional links 4. Verify link types are correct (point-to-point for fast convergence) ### Symptom: Slow Convergence After Root Bridge Failure **Cause:** Secondary root not configured, or STP timers are too conservative. **Fix:** ``` config t spanning-tree vlan 10 root secondary spanning-tree vlan 10 root primary diameter 4 end ``` Lower diameter = faster convergence. ## What's Next Root bridge configuration establishes the foundation of your STP topology. The next step is enabling **Rapid Spanning Tree Protocol (RSTP)**, which dramatically speeds convergence and introduces proposal/agreement mechanisms. Article 9 covers "Configuring Rapid PVST+ on Cisco Catalyst Switches," including edge ports, link types, and migration from PVST+ to Rapid PVST+. ## Related STP Articles - [How STP Works: Root Bridge Election, BPDUs, and the Spanning Tree Algorithm](https://www.pinglabz.com/how-stp-works-root-bridge-bpdus/) - [STP Path Cost and How Cisco Switches Calculate the Best Path](https://www.pinglabz.com/stp-path-cost-calculation/) - [Troubleshooting STP Root Bridge Issues: Wrong Root, Unexpected Topology Changes](https://www.pinglabz.com/troubleshoot-stp-root-bridge-issues/) - [STP Design Best Practices for Enterprise Campus Networks](https://www.pinglabz.com/stp-design-best-practices-enterprise/)