> ## Content Index > Fetch the complete content index at: https://www.pinglabz.com/llms.txt > Use this file to discover other available public pages before exploring further. # STP Configuration Checklist: Hardening Spanning Tree Before Go-Live - URL: https://www.pinglabz.com/stp-hardening-checklist-go-live/ - Published: 2026-03-27T05:16:14.000Z - Updated: 2026-07-04T23:02:06.000Z - Description: This is the capstone article: a comprehensive pre-deployment checklist covering all STP hardening requirements. Organized by switch role, this checklist ensures your campus network STP implementation is secure, predictable, and ready for production traffic. - Author: Jaime - Tags: STP, #Import 2026-08-01 19:54 ## Pre-Deployment STP Hardening Checklist This checklist guides you through configuring and verifying a production-grade STP topology. Follow it section by section during a maintenance window, testing at each step. (This article is part of the PingLabz STP series - the [full spanning-tree guide](https://www.pinglabz.com/spanning-tree-protocol/) maps the whole cluster in reading order.) ## 1\. Planning Phase Before any configuration, plan the topology carefully. Document: - Physical network topology (access, distribution, core layers) - Root bridge placement (primary and secondary) - Port priorities (primary uplinks vs backups) - Guard configuration (BPDU Guard on access, Root Guard on distribution downlinks, Loop Guard on inter-switch trunks) ## 2\. Core Switch Configuration ### 2.1 Set STP Mode ``` spanning-tree mode rapid-pvst ``` ### 2.2 Configure Root Bridge ``` spanning-tree vlan 1-4094 root primary spanning-tree vlan 1-4094 priority 4096 ``` ### 2.3 Enable PortFast ``` spanning-tree portfast default ``` ### 2.4 Enable BPDU Guard ``` spanning-tree portfast bpdu-guard default errdisable recovery cause bpduguard errdisable recovery interval 30 ``` ### 2.5 Enable Root Guard on Downlinks ``` interface range Gi1/0/3-24 spanning-tree guard root exit ``` ### 2.6 Enable Loop Guard on Trunks ``` interface range Gi1/0/1-2 spanning-tree guard loop exit ``` ## 3\. Distribution/Access Switch Configuration Repeat steps 2.1-2.6 on all distribution and access switches. ### 3.1 Secondary Root (if applicable) ``` spanning-tree vlan 1-4094 root secondary spanning-tree vlan 1-4094 priority 8192 ``` ### 3.2 Configure Uplink Port Priorities ``` interface Gi1/0/1 spanning-tree port-priority 0 exit interface Gi1/0/2 spanning-tree port-priority 32 exit ``` ## 4\. Verification Commands ### Check Root Election ``` show spanning-tree root ``` All switches should report the same root bridge. ### Check Port Roles ``` show spanning-tree ``` Expected: - One root port per switch (to root bridge) - Alternate ports (blocked backups) - Designated ports (to downstream switches) ### Check for Inconsistent Ports ``` show spanning-tree inconsistentports ``` Should be empty (no Root Guard or Loop Guard blocks in steady state). ### Check MAC Stability ``` show mac address-table dynamic ``` MAC addresses should be stable (not flapping between ports). ## 5\. Failover Testing ### Test Root Failover Shutdown the primary root's uplink. Verify: - Secondary root assumes root role within 2-3 seconds - All switches converge to new root within 5 seconds - No topology oscillations ### Test Access Port Failover Shutdown an access switch's primary uplink. Verify: - Alternate port becomes root port within 1-2 seconds (Rapid PVST+) - User devices reconnect automatically - No loops form ### Test BPDU Guard Connect a switch to an access port. Verify: - Port goes errdisable within 1-2 seconds ``` show interfaces status err-disabled ``` Port should show "err-disabled bpduguard". ## 6\. Production Sign-Off - \[ \] Document final STP topology - \[ \] Verify convergence tests pass - \[ \] Set up monitoring and alerts for STP events - \[ \] Create rollback plan - \[ \] Schedule maintenance window - \[ \] Deploy and monitor for 30 minutes post-deployment ## 7\. Long-Term Operations - Monthly: Review STP logs for anomalies - Quarterly: Simulate failover scenarios - Annually: Audit STP configuration against this checklist - When adding switches: Repeat full checklist - When adding VLANs: Explicitly configure their root priority ## Summary: STP Best Practices 1. **Explicit configuration:** Don't rely on defaults. 2. **Rapid PVST+ only:** Never use legacy 802.1D or PVST+. 3. **Root bridge in core:** Primary at core, secondary at distribution. 4. **Deterministic topology:** Use port priorities for predictability. 5. **Guards on every port:** BPDU Guard (access), Root Guard (distribution downlinks), Loop Guard (trunks). 6. **Monitor relentlessly:** Keep logs, alert on errdisable events. 7. **Document everything:** Topology documentation is critical. 8. **Test failover:** Verify convergence before production deployment. ## Related STP Articles - [STP Design Best Practices for Enterprise Campus Networks](https://www.pinglabz.com/stp-design-best-practices-enterprise/) - [BPDU Guard Configuration: Protecting Your STP Topology](https://www.pinglabz.com/bpdu-guard-configuration-cisco/) - [Root Guard and Loop Guard: STP Stability Features Explained and Configured](https://www.pinglabz.com/root-guard-loop-guard-cisco-configuration/) - [PortFast Configuration on Cisco Switches: When and How to Use It](https://www.pinglabz.com/portfast-configuration-cisco-switches/) - [STP Toolkit Reference: Every show and debug Command You Need](https://www.pinglabz.com/stp-show-debug-commands-reference/)