STP keeps blocking my ports — how do I troubleshoot?
I have a network with redundant links between switches and STP is blocking ports I need. I understand STP prevents loops but how do I control which ports get blocked? How do I check which switch is the root bridge? And should I use portfast on access ports?
- STP is doing its job — it blocks redundant paths to prevent broadcast storms. Check which switch is root with show spanning-tree. The switch with the lowest bridge priority (or lowest MAC if tied) wins. If the wrong switch is root, lower its priority with spanning-tree vlan 1 priority 4096. — Yaron,
- For access ports connecting to PCs, definitely use spanning-tree portfast. It skips the 30-second listening/learning delay so PCs get connectivity instantly. But NEVER put portfast on a port connected to another switch — it can cause temporary loops. Also add bpdu guard as a safety net. — itayitayy,
- I checked and SW2 was root because it had a lower MAC. Changed the priority on SW1 with spanning-tree vlan 1 priority 4096 and now the right switch is root and the ports I need are forwarding. Exactly what I needed, thanks. — ben31833,
1 Answer
First thing: a blocked port is usually STP doing its job, not a fault. On any redundant path one port goes to blocking so you don't get a loop. Start by confirming whether the blocked port is actually the redundant link.
Walk it in order:
show spanning-tree— note the root bridge and each local port's role (Root / Designated / Alternate). The Alternate is the one blocking.- Confirm the root is the switch you want as root. Root = lowest bridge ID (priority + MAC). If a random access switch won the election, pin it:
spanning-tree vlan 1 priority 4096. - Remember STP is per-VLAN, so check the right one:
show spanning-tree vlan 10. - Port cost comes from bandwidth — the higher-cost path is the one blocked. If the wrong link is blocking, adjust
spanning-tree vlan 10 costor fix the root so path costs make sense.
If it's an access port to a PC that's slow to come up, that's not a loop — enable spanning-tree portfast so it skips listening/learning.
In the lab, drop two switches with two links between them, watch one port land in blocking, then lower one switch's priority and see the topology recompute.
- The per-VLAN part got me too — I was staring at `show spanning-tree` and my VLAN 20 was blocking a totally different port than VLAN 1. Checking `vlan 20` explicitly cleared it up 🙂 — 22maya2n2,