PVST+

Why it exists

IEEE STP and RSTP compute one loop-free tree for the bridged network. Two parallel uplinks still leave one blocked for every VLAN. Campuses that want both uplinks busy need the trees to disagree somehow.

Cisco’s answer was an instance per VLAN — PVST+, later Rapid-PVST+ with 802.1w-style convergence. It is proprietary. The IEEE answer to the same problem is MSTP, which maps many VLANs onto a few instances. IEEE 802.1Q-2022 §13.4

Two VLANs, two roots

SW1 is root for VLAN 10 and SW2 is root for VLAN 20. Each instance elects independently, so the blocked uplink differs by VLAN and both links carry traffic.

How it works

Each VLAN elects its own root and assigns its own port roles. Bridge priority and port cost are configured per VLAN. Load sharing is deliberate disagreement between those elections. Cisco IOS XE 17.18.x — Configuring Spanning Tree Protocol (Catalyst 9300) §Spanning-Tree Modes and Protocols

The BPDU payload remains an 802.1D-style configuration BPDU. What is Cisco-specific is running many instances and using a Cisco multicast destination for non-native VLAN BPDUs so IEEE bridges do not consume them as ordinary STP. IEEE 802.1D-2004 §9.3.1

Rapid-PVST+ keeps the per-VLAN model and replaces classic timer-based transitions with RSTP proposal/agreement behaviour. On modern Catalyst platforms it is the default; classic `pvst` mode is chosen only when 802.1D timing must be observed. Cisco IOS XE 17.18.x — Configuring Spanning Tree Protocol (Catalyst 9300) §Spanning-Tree Modes and Protocols

On the wire

Constructed examples, encoded from the field table below them — not captured traffic.

Configure it

When it breaks

Symptom first, because that is what you have when it happens.

1. A Cisco switch connected to a non-Cisco one blocks a VLAN, or the two disagree about the topology on every VLAN but one.

   Narrow it down

   1. Check what the non-Cisco switch is running — almost certainly MSTP or RSTP, with one instance.
   2. Compare which VLAN carries a standard BPDU the neighbour understands.
   3. Look for asymmetric forwarding: forwarding on one side, blocking on the other, for non-native VLANs.

   Cause

   PVST+ runs one topology per VLAN; the neighbour runs one for all of them. Only the native VLAN carries a standard BPDU the neighbour processes; per-VLAN BPDUs use Cisco’s destination and are not that neighbour’s spanning tree.

   Fix

   Match the mode at the boundary, or accept that the neighbour sees one topology and design so that is safe.

   Cisco IOS XE 17.18.x — Configuring Spanning Tree Protocol (Catalyst 9300) §Spanning-Tree Modes and Protocols

2. Switch CPU rises steadily as VLANs are added, and topology changes make the switch unresponsive.

   Narrow it down

   1. Count VLANs times spanning-tree-enabled ports against the platform’s logical port limit.
   2. Check CPU during a topology change rather than at rest.
   3. Look at how many VLANs are allowed on each trunk.

   Cause

   PVST+ runs an instance per VLAN, so cost is VLANs × ports. Four thousand VLANs on forty-eight trunks is an outage waiting for a topology change.

   Fix

   Prune trunks to the VLANs actually needed, and move to MSTP where the count is genuinely large.

3. Load sharing across two uplinks was configured per VLAN and only one uplink carries traffic.

   Narrow it down

   1. Check whether the root bridge differs per VLAN, or only the port cost.
   2. Confirm priorities were set per VLAN rather than left at the global default.
   3. Look at which bridge is root for each VLAN.

   Cause

   Without a different root or cost per VLAN, every instance computes the same topology and there is nothing to share.

   Fix

   Set priority per VLAN and split them so half prefer one root and half the other — or use MSTP instances for the same outcome with far fewer trees.

   Cisco IOS XE 17.18.x — Configuring Spanning Tree Protocol (Catalyst 9300) §(Optional) Configuring the Device Priority of a VLAN

4. CPU high with hundreds of VLANs and Rapid-PVST+.

   Narrow it down

   1. Count active VLAN trees
   2. Compare to an MST instance map

   Cause

   One instance per VLAN scales with VLAN count.

   Fix

   Collapse to MSTP instances that match the load-share intent.

5. VLAN 20 still roots on the wrong switch after priority change.

   Narrow it down

   1. show spanning-tree vlan 20
   2. Confirm the priority was set for VLAN 20

   Cause

   Priority applied to the wrong VLAN.

   Fix

   Set and verify per-VLAN priority.

Design notes

Instance count is VLANs × STP-enabled ports. Thousands of VLANs on dense trunks is a CPU and logical-port limit problem, not a feature. Prune trunks; move to MSTP when the count is genuinely large.

PVST+ is not MSTP. There is no region digest and no mapping table. Mixing PVST+ with MSTP at a boundary needs an explicit design — it is not transparent interop. IEEE 802.1Q-2022 §13.7

Misconceptions

“PVST+ is the standard per-VLAN spanning tree.”

It is Cisco’s. There is no IEEE mandate for one tree per VLAN. The standards-based answer to multiple topologies is MSTP. IEEE 802.1Q-2022 §13.4

“PVST+ interoperates with MSTP transparently.”

It interoperates on the native VLAN and tunnels or ignores the rest from the IEEE side’s point of view. The neighbour sees one topology; PVST+ sees many. The boundary needs designing.

“More instances means better convergence.”

Each instance converges independently, so convergence is no faster and the CPU cost is multiplied. The benefit is load sharing across VLANs — and only when the topologies actually differ.

More walkthroughs

Terms

Bridge identifier

Eight octets identifying a bridge: a settable 16-bit priority followed by the 48-bit bridge address. Compared as a single number, priority first.

Root bridge

The bridge with the lowest bridge identifier. Every path in the active topology is measured as a cost back to it, and all of its ports are designated.

MST digest

A 16-octet HMAC-MD5 of the VID-to-MSTID table. Two bridges share a region only when name, revision, and digest all match. Matching names with different maps do not merge.

Check yourself

• What does PVST+ run per VLAN?

  • A separate spanning tree instance
  • A separate trunk
  • A separate MAC address table
  • A separate VLAN database
• How does PVST+ interoperate with a switch running only RSTP or MSTP?

  • Fully, on every VLAN
  • On the native VLAN only — per-VLAN BPDUs are not that neighbour’s spanning tree
  • Not at all
  • By converting automatically to MSTP
• Per-VLAN load sharing is configured and only one uplink is used. What is missing?

  • A second trunk
  • A different root or port cost per VLAN — otherwise every instance computes the same topology
  • A larger MTU
  • Rapid mode
• What is the standards-based alternative to PVST+ for multiple topologies?

  • Classic 802.1D alone
  • MSTP, which maps many VLANs onto a small number of instances
  • There is none
  • TRILL
• What resource does PVST+ consume as VLANs and trunks grow?

  • Only TCAM for ACLs
  • Spanning-tree instances — roughly VLANs × STP-enabled ports
  • Only DHCP bindings
  • Only OSPF adjacencies
• Bridge priority under PVST+ is configured:

  • Once globally for all VLANs
  • Per VLAN, so one switch can be root for some VLANs and not others
  • Only on the root bridge
  • Only under MSTP
• How does Rapid-PVST+ relate to PVST+?

  • It is IEEE MSTP under another name
  • Same per-VLAN model; rapid (802.1w-style) convergence instead of classic 802.1D timers
  • It collapses all VLANs into one tree
  • It removes BPDUs entirely
• At a PVST+/IEEE boundary, which VLAN carries a standard BPDU the neighbour understands?

  • Every VLAN
  • The native VLAN
  • Only VLAN 1 when it is not native
  • None — interop is impossible

Related

• STP

  Keeps a switched network free of loops by disabling just enough ports to leave one active path between any two bridges.

• RSTP

  Replaces spanning tree’s two timers with an explicit handshake, and names the backup path in advance so failover does not wait for information to expire.

• MSTP

  Maps many VLANs onto a handful of spanning trees, and decides who shares a topology by hashing the mapping rather than by trusting the configuration to match.