A Cisco Catalyst trunk can be physically up and forward traffic for one VLAN while spanning tree blocks another. To find out why, inspect the affected VLAN or MST instance and correlate the port state with the switch log and trunk configuration.
This guide uses Cisco Catalyst 9300 and IOS XE Dublin 17.12.x, including the 9300L family. Commands are read-only. VLAN 20, GigabitEthernet1/0/48, and Port-channel10 are examples.
Why STP is important on a campus network
Two physical paths between switches improve availability. If both paths forward the same Layer 2 traffic without loop prevention, broadcasts and unknown unicasts can circulate, MAC addresses can move repeatedly between ports, and shared trunks can become congested. STP builds a loop-free topology by electing a root bridge and assigning port roles. An alternate link can become the active path when the current path fails. Rapid PVST+ runs a separate spanning-tree instance per VLAN. MST maps groups of VLANs to instances.
1. Verify the mode, root bridge, and port roles
show spanning-tree summary
show spanning-tree rootConfirm the running mode and compare the root bridge ID with the campus design. The lowest bridge ID wins. Compare the advertised priority and bridge MAC, accounting for the extended system ID shown for the VLAN or instance. An unexpected root can redirect traffic onto a slower or less resilient path even when all interfaces are operational.
For Rapid PVST+ or PVST+, inspect the affected VLAN and the suspect uplink.
show spanning-tree vlan 20
show spanning-tree vlan 20 detail
show spanning-tree interface GigabitEthernet1/0/48 detail| Output | Interpretation |
|---|---|
Root FWD | The switch forwards toward the root through this port. |
Desg FWD | The port is designated for its segment and forwarding. |
Altn BLK | The redundant path is held in standby for this VLAN or instance. |
BKN* with an inconsistency marker | A protocol or protection condition is preventing forwarding. Look up the specific marker before changing anything. |
If the uplink is bundled, check spanning tree on Port-channel10 as well as EtherChannel membership. STP treats the operational bundle as one logical port.
2. Check trunks, inconsistencies, and logs
show spanning-tree inconsistentports
show interfaces trunk
show interfaces GigabitEthernet1/0/48 switchport
show etherchannel summary
show interfaces status err-disabled
show logging | include SPANTREE|ERR_DISABLE|LINEPROTO|MACFLAPCompare both ends of the link. Verify the operational trunk mode, native VLAN, and whether the affected VLAN is allowed and active. On show interfaces trunk, inspect the forwarding and pruning list separately. A VLAN can be allowed and active while an STP condition prevents it from forwarding.
- PVID inconsistency points to a VLAN ID mismatch. Check the native VLAN and tagging expectations on both ends.
- Type inconsistency warrants checking whether the link is operating as a trunk on both ends and whether the peer’s BPDU handling matches the design.
- Root inconsistency means Root Guard detected superior BPDUs. Trace the device advertising them and compare it with the approved root design.
- Loop inconsistency means Loop Guard stopped receiving expected BPDUs. Check the peer, link, and any intermediary transport.
- Err-disabled following a BPDU Guard event calls for tracing the unexpected BPDU source before restoring service to the port.
Use the detailed STP output to compare the topology change count and time since the last change across two snapshots. If a port appears in the last-change information, use it to trace the next switch and correlate the time with link or bundle events.
3. Follow the MST path when the switch runs MST
show spanning-tree mst configuration
show spanning-tree mst
show spanning-tree mst interface Port-channel10Identify the instance that carries the affected VLAN, then check that instance’s root, roles, and uplink state. Compare the region name, revision, and VLAN-to-instance mapping across switches intended to share a region. At a planned MST-to-Rapid-PVST+ boundary, verify the intended root placement and inspect consistency on both sides of the boundary.
Example: Trunk stays up after a switch replacement, but a VLAN loses access
After replacing an access switch, the uplink is operational but some clients lose connectivity. The switch log shows a PVID inconsistency and the spanning-tree output flags the uplink for an affected VLAN. On the distribution switch the native VLAN is 99, while the replacement uses VLAN 1 on the other end.
Confirm the approved native VLAN and tagging settings, then align both ends in the change window. Check that the port clears from show spanning-tree inconsistentports, that the expected VLANs are active and forwarding on the intended path, and that client traffic reaches its gateway. Confirm the redundant uplink’s expected role as well. If it remains alternate and blocking, compare that outcome with the design before treating it as another fault.
Apply STP protections by port role
Use PortFast and BPDU Guard on endpoint-facing ports that should never receive BPDUs. Place Root Guard where a downstream switch must never become root. Evaluate Loop Guard on eligible redundant paths that depend on continuous BPDU reception. Preserve those protections while diagnosing the condition that triggered them.