Glossary

MSTP

Multiple Spanning Tree Protocol

What is MSTP

MSTP (Multiple Spanning Tree Protocol), standardized in IEEE 802.1s, is a spanning tree protocol built on top of STP and RSTP. It keeps everything that made STP and RSTP useful — eliminating Layer 2 loops — while fixing their biggest inefficiency: a single spanning tree instance blocks the same redundant links for every VLAN, no matter how traffic is actually distributed, leaving some perfectly good links sitting idle.

MSTP solves this by binding groups of VLANs to a small number of spanning tree instances instead of computing one tree for the whole network. Because each instance can converge on a different topology, MSTP builds multiple loop-free trees across the same physical network — resolving broadcast storms exactly like STP/RSTP does, but with load balancing between VLANs, since traffic from different VLANs can now take genuinely different paths.

How MSTP Works

MSTP's core computation is the same as STP and RSTP: prune a network with loops down to a loop-free tree by comparing priorities and connecting devices outward from the highest-priority root. What's new in MSTP is the concept of an MST domain — the network is divided into regions, and switches only belong to the same domain if they have MSTP enabled, the same domain name, the same VLAN-to-instance mapping, and the same MSTP revision level. Multiple domains can coexist across a LAN, physically connected directly or indirectly.

Inside this domain structure, MSTP defines two kinds of spanning tree instance. Instance 0, called CIST (Common and Internal Spanning Tree Instance), carries every VLAN by default and connects the entire network — every switch, in every domain — guaranteeing a baseline loop-free topology across the whole network even before anything else is configured. Every other instance is an MSTI (Multiple Spanning Tree Instance), computed independently within a single domain, with its own root, its own topology, and its own per-port roles — completely decoupled from what any other MSTI is doing.

CIST itself is built from two pieces: an IST (Internal Spanning Tree) inside each domain, and a CST (Common Spanning Tree) between domains, where each domain is treated as a single node. Because of this two-level structure, MSTP has two distinct kinds of root: the total root — a single, network-wide root of the whole CIST — and the domain root, which is local to one instance within one domain. A switch can be both at once, but they're conceptually different roles.

Topology calculation runs on MST BPDU messages, which extend the standard RSTP BPDU with MSTP-specific fields — most importantly an MST Configuration ID (identifying which domain a switch belongs to) and per-instance MSTI configuration messages. Switches compare priority vectors — root bridge ID, external path cost, domain root ID, internal path cost, designated bridge, and designated/receiving port — in that strict order, always favoring the lowest (highest-priority) vector, to elect the CIST root, each domain's root port, and each domain's designated ports. Each MSTI runs this same comparison independently within its own domain, on its own schedule, sending its own BPDUs.

Once converged, switches keep sending BPDUs on the configured Hello interval regardless of whether anything changed; if a port goes three Hello intervals without hearing from its designated bridge, MSTP treats that link as failed. When an actual topology change is detected — a non-edge port moving into the forwarding state — the switch starts a TC timer, clears learned MAC addresses on affected ports, and floods topology-change BPDUs so the rest of the network can react and re-converge quickly, rather than waiting to time out stale MAC entries on their own.

Why MSTP is Beneficial

  • Eliminates the idle-link problem in single-tree STP/RSTP: Redundant links no longer sit permanently blocked for every VLAN — different VLANs can use different physical paths, so backup links actually carry traffic instead of waiting unused.

  • Genuine load balancing across VLANs: Because each MSTI computes its own independent topology, traffic naturally spreads across the physical topology instead of concentrating on whatever single tree STP/RSTP happened to compute.

  • Retains STP/RSTP's core reliability guarantee: CIST (instance 0) still gives every VLAN a baseline loop-free topology by default, so nothing is exposed to loop risk even before MSTIs are configured.

  • Fast reconvergence on real topology changes: The same TC-BPDU flooding mechanism RSTP uses lets the rest of the network react to a failure quickly, rather than relying purely on aging timers.

  • Fine-grained control per instance and per port: Priority, path cost, and role can all differ across MSTIs on the same physical port, letting operators tune exactly how each VLAN's traffic should be distributed.

At Asteraix

What We Can Do at Asteraix

AsterNOS implements a complete MSTP stack, configurable entirely through the CLI, with sensible defaults and explicit protections against misbehaving neighbors.

  • Full instance and VLAN-mapping control: mstp instance <id> creates an instance, vlan <vlan-id> binds VLANs to it, and priority <0-15> sets instance priority — giving operators direct control over how VLANs are grouped and which instance wins root election.

  • Per-port, per-instance priority tuning: interface priority <priority> interface {ethernet|link-aggregation} <name> sets port priority independently within a specific MSTI, so the same physical port can play a different role on different instances — exactly the flexibility that makes MSTP's load balancing possible.

  • Sensible, standards-aligned defaults: MSTP ships enabled globally and per-port, with 802.1t path-cost calculation, a 15-second forward delay, 2-second Hello time, and 20-second max age — defaults that match IEEE 802.1s recommendations out of the box.

  • Layered edge-port protection: Auto-edge is enabled by default (a port becomes an edge port automatically if it doesn't see a BPDU within 3 seconds of coming up), and can be overridden by explicit mstp edge-port enable, which takes priority over auto-edge and holds edge-port status immediately.

  • BPDU filtering and BPDU guard for security: mstp bpdu-filter excludes a port from MSTP entirely (used cautiously, since it reintroduces loop risk), while mstp bpdu-guard automatically admin-downs a port the moment it receives a BPDU — protecting edge ports from unauthorized switches or misconfigured devices being connected downstream. AsterNOS enforces a clear precedence: BPDU guard beats BPDU filtering, and edge-port role is preserved even when either protection is active.

  • Detailed visibility for verification: show mstp bridge, show mstp brief, show mstp interface, show mstp mstconfid, show mstp tree <instance-id>, and show mstp treeport give operators full insight into domain configuration, per-instance topology, and individual port roles and states — everything needed to confirm a multi-instance deployment is actually load-balancing traffic as designed.