MSTP

Why it exists

One spanning tree across all VLANs leaves half the uplinks blocked. One tree per VLAN uses them, and costs a topology calculation and a BPDU stream per VLAN — which on a thousand VLANs is a thousand of each.

MSTP maps many VLANs onto a few instances. Two instances with different roots use both uplinks, and cost two calculations regardless of how many VLANs are mapped into them. IEEE 802.1Q-2022 §13.4

The mapping only works if every switch agrees on it, and the interesting engineering is in how that agreement is established: not by exchanging the table, but by hashing it. IEEE 802.1Q-2022 §13.7

Agreeing by hash, not by intention

Two switches are in one region only if a sixteen-octet digest matches. The digest is computed over the thing people forget to compare.

How it works

A region is identified by a name, a revision number and the VLAN-to-instance table, hashed together into sixteen octets. Switches compare digests, so agreement costs the same whether the table has one entry or four thousand. IEEE 802.1Q-2022 §13.7

That trade has a sharp edge. When the digest differs, it will not say which input differed — and a difference in any one of the three produces the identical symptom.

Instance 0 is the CIST and is not an ordinary instance. It is what the region uses to reach anything outside it, and every VLAN not mapped somewhere else lands in it — following a topology nobody designed for it. IEEE 802.1Q-2022

To the outside, a region presents itself as a single bridge. At a boundary port every instance follows the CIST, so per-instance tuning inside the region has no effect on how traffic leaves it. IEEE 802.1Q-2022

Try it

On the wire

Constructed examples, encoded from the field table below them — not captured traffic.

Configure it

When it breaks

Symptom first, because that is what you have when it happens.

1. Two switches that should share a region each behave as their own, and every VLAN converges as if the other were a separate domain.

   Narrow it down

   1. Compare the region name, the revision number and the VLAN-to-instance mapping on both.
   2. Read the configuration digest each advertises — it is a hash of all three.
   3. Look for a VLAN created on one switch and not mapped on the other.

   Cause

   The digest differs, so the two are not in one region. Any difference produces the same result: a VLAN mapped on one and not the other changes the hash exactly as a misspelled name does.

   Fix

   Make name, revision and mapping identical. Compare the digest first — it is one value, and it is the thing being compared.

   IEEE 802.1Q-2022 §13.7

2. A VLAN that was working stops after a new VLAN is added elsewhere on the network.

   Narrow it down

   1. Check whether the new VLAN was mapped to an instance on every switch in the region.
   2. Compare digests before and after the change.
   3. Look for switches that now consider themselves boundary devices.

   Cause

   Adding a VLAN changes the mapping and therefore the digest. A switch that did not get the change leaves the region, and every instance it holds is recalculated against the outside world.

   Fix

   Apply the mapping region-wide in one change. This is the strongest argument in switching for configuration management.

3. Load sharing across two uplinks does not happen — all VLANs use the same one.

   Narrow it down

   1. Check how many instances exist and which VLANs are in each.
   2. Confirm the bridge priority differs per instance, not just globally.
   3. Look at whether every VLAN landed in instance 0 by default.

   Cause

   All VLANs are in one instance. MSTP shares load by having instances choose different roots, and unmapped VLANs default to the CIST, where there is only one topology to have.

   Fix

   Map VLANs to at least two instances and set the priority per instance so each prefers a different uplink.

   IEEE 802.1Q-2022 §13.4

4. Load sharing works between access and distribution and collapses onto one path leaving the region.

   Narrow it down

   1. Identify which ports are region boundary ports.
   2. Check the port role per instance on those ports — they will all match the CIST.
   3. Confirm whether the far side is in a different region or running plain RSTP.

   Cause

   Outside a region only the CIST exists. Every instance follows the CIST role at a boundary port, so per-instance priorities have nothing to act on there.

   Fix

   Extend the region to cover both ends of the links you want to share load across, or accept one path at the boundary and design for it.

   IEEE 802.1Q-2022

5. A boundary port toward a per-VLAN switch is blocked and reported as inconsistent, and no VLAN passes over it.

   Narrow it down

   1. Check what the neighbour runs — per-VLAN spanning tree emits a BPDU per VLAN.
   2. Look for a port reported as being in a PVST simulation inconsistent state.
   3. Compare which bridge is root for VLAN 1 against which is root for the CIST.

   Cause

   A region emits one BPDU for the CIST, and a per-VLAN neighbour expects one per VLAN. The simulation that bridges the two only holds while the region is root for every VLAN the neighbour has — otherwise it blocks rather than risk a partial topology.

   Fix

   Make the MSTP region the root for the VLANs concerned, or move the neighbour into the region. Disabling the guard removes the warning and not the hazard.

Design notes

Treat the VLAN-to-instance mapping as region-wide state and apply it everywhere in one change. It is expressed as per-switch configuration, partial application is silent, and the outage lands on a VLAN nobody touched.

Map every VLAN explicitly, including ones a switch has no ports in. A switch needs the mapping, not the VLAN, and an unmapped VLAN quietly follows the CIST.

Set bridge priority per instance, not globally. A global priority makes one switch root for everything, which is the design MSTP was deployed to get away from.

Keep the number of instances small — two or three is usually enough for load sharing. Every instance is a topology to compute, monitor and reason about during an incident, and the marginal value drops fast after the second.

Misconceptions

“MSTP runs one spanning tree per VLAN, more efficiently than PVST+.”

It runs one per instance, and an instance carries many VLANs. That is the entire saving: a thousand VLANs sharing two instances cost two topology calculations rather than a thousand. IEEE 802.1Q-2022 §13.4

“Switches in the same region need the same VLANs.”

They need the same VLAN-to-instance mapping, which is a different requirement. A VLAN mapped on one switch and absent from the mapping on another breaks the region even if neither has any ports in it.

“The region name is cosmetic.”

It is hashed into the digest along with the revision and the mapping. A typo partitions the region as completely as a wrong mapping, and produces a far more confusing symptom. IEEE 802.1Q-2022 §13.7

“Instance 0 is just another instance.”

It is the CIST: the tree that reaches outside the region, and the one every unmapped VLAN falls into. Tuning it as though it were an ordinary instance changes how the region connects to everything beyond it. IEEE 802.1Q-2022

More walkthroughs

Terms

MST digest

A 16-octet HMAC-MD5 of the VID-to-MSTID table. Two bridges share a region only when name, revision, and digest all match. Matching names with different maps do not merge.

MST region

The set of switches that share a spanning tree instance map. Membership is decided by comparing a digest of the region name, the revision and the whole VLAN-to-instance table — not by comparing configuration.

CIST

Instance 0, and not an ordinary instance: it is the tree a region uses to reach anything outside itself, and the one every unmapped VLAN falls into. At a region boundary every other instance follows it.

Check yourself

• Two switches will not form one MST region. What are the three things that must match?

  • Region name, revision number and VLAN-to-instance mapping
  • Bridge priority, root cost and port priority
  • VLAN list, native VLAN and trunk mode
  • MAC address, priority and instance count
• What does an MST instance carry?

  • One VLAN
  • Many VLANs, sharing one spanning tree calculation
  • One physical link
  • One region
• Adding a VLAN on one switch breaks a working VLAN elsewhere. Why?

  • The trunk allowed list changed
  • The mapping changed, so the digest changed, and that switch left the region
  • Spanning tree timers expired
  • The root bridge moved
• All VLANs use the same uplink despite two being available. What is missing?

  • A second trunk
  • A second instance with a different priority — unmapped VLANs all land in the CIST
  • A lower path cost
  • Rapid transitions
• Why is the VLAN-to-instance mapping hashed rather than exchanged?

  • To keep it confidential
  • Because the table has up to 4 094 entries, and a fixed sixteen octets answers the same question at constant cost
  • Because BPDUs cannot carry VLAN numbers
  • To allow partial matches
• A VLAN is created and never mapped to an instance. What happens to it?

  • It is blocked until mapped
  • It follows the CIST — the tree that also carries traffic between regions
  • It gets its own instance automatically
  • It uses the lowest-numbered instance
• What determines a boundary port’s role for each MST instance?

  • Each instance decides independently
  • They all follow the CIST — outside the region, only the common tree exists
  • The neighbour’s instance mapping
  • The lowest instance number
• Two switches share a region name and revision, and map VLAN 10 to different instances. How many regions?

  • One
  • Two — the digest differs, and the digest is what is compared
  • One, with a warning
  • Depends on the root bridge

Related

• RSTP

  Replaces spanning tree’s two timers with an explicit handshake, and names the backup path in advance so failover does not wait for information to expire.

• STP

  Keeps a switched network free of loops by disabling just enough ports to leave one active path between any two bridges.

• PVST+

  One spanning-tree instance per VLAN — Cisco’s way to load-share uplinks where IEEE STP/RSTP would keep a single tree.