>
    Strata Copilot
    Network > Network Profiles > STP Profile
    Focus
    Download PDF
    Focus
    1. Home
    2. Next-Generation Firewall
    3. PAN-OS Web Interface Help
    4. Network
    5. Network > Network Profiles
    6. Network > Network Profiles > STP Profile
    Download PDF
    Next-Generation Firewall

    Network > Network Profiles > STP Profile

    Table of Contents

    Network > Network Profiles > STP Profile

    Beginning with PAN-OS 12.2.2 release, Layer 2 switching feature supports MSTP single instance on the next-generation firewalls.
    Add an STP profile to detect and prevent Layer 2 loops. When you introduce Layer 2 Switch interfaces on the firewall—which is the essence of the Branch in a Box solution—the firewall itself becomes part of the switching fabric. Any redundant links in that switching domain can create L2 loops, which cause broadcast storms and network instability. STP is the mechanism that prevents this.
    PAN-OS uses a profile-based model so that a single set of STP parameters can be defined once and applied consistently across multiple interfaces. Without profiles, you would have to configure timers and port behaviors individually on every interface—which is error-prone and difficult to maintain at scale. A profile ensures uniformity across all ports participating in the same spanning tree topology.
    Configure STP parameters under Network Profiles:
    • Globally—The global level is where the overall STP behavior for the entire device is defined.
    • Instance Level—The instance level is specific to Multiple Spanning Tree Protocol (MSTP) and allows the spanning tree topology to be organized into logical instances, each capable of having its own root bridge election and path computation. Currently, only the default instance (Instance 0) is supported, to which all VLANs are mapped.
    • Port Level—Most granular level configuration that controls how each individual physical interface participates in the spanning tree. Port-level parameters are configured through Port Profiles, which are then applied to individual interfaces or aggregate (LAG) interfaces through the interface configuration dialog.
    You can configure STP on both Layer 2 Switch type interfaces and Layer 2 type interfaces.
    STP ParameterDescription
    Name
    		Enter a name to identify the profile (up to 31 characters). The name is case-sensitive and must be unique. Use only letters, numbers, spaces, hyphens, and underscores.
    Enable
    Enable Spanning Tree Protocol on an interface.
    When STP is enabled on an interface, it changes how Bridge Protocol Data Units (BPDUs) are handled on that interface. Before STP is configured, any BPDUs received on a Layer 2 interface are flooded into the broadcast domain they belong to. However, when STP is configured on the interface, BPDUs are no longer flooded. Instead, they are handed off to the STP control plane, which processes them and sends the appropriate BPDUs back out through that interface as directed by the spanning tree protocol.
    Enabling STP allows the firewall to actively participate in the spanning tree topology rather than passively passing BPDUs along.
    Spanning-Tree Global Profile
    Configuration Name
    		Enter a (32-byte string) value that uniquely identifies an MST region. All switches intended to belong to the same region must be configured with a matching name.
    Revision
    		Enter a (2-byte numeric) value that represents the revision level of the MST region configuration.
    Forward Delay (seconds)
    Enter the time spent in the listening state.
    Range: 4-30 seconds.
    Hello Time (seconds)
    Enter the time interval between BPDU transmission.
    Range: 1-10 seconds.
    Max Age (seconds)
    Enter the maximum age time that the switch retains information learned from BPDUs.
    Range: 6-40 seconds.
    Max Hops
    Enter the maximum number of bridges within a Multiple Spanning Tree (MST) region that a Bridge Protocol Data Unit (BPDU) can pass through before it is dropped.
    Range: 6–40.
    The default (recommended) value: 6
    TX Hold Count
    Enter the maximum number of Bridge Protocol Data Units (BPDUs) that a switch port can send within a one-second interval.
    Range: 1–10.
    The default (recommended) value is 6.
    Spanning-Tree Instances Profile
    Instance ID
    The Instance ID is automatically set to 1 and cannot be modified.
    Bridge Priority
    Bridge Priority determines which bridge (switch or firewall) becomes the Root Bridge in the spanning tree topology. The bridge with the lowest priority value is elected as the Root Bridge, and all other bridges calculate their shortest path back to it. This forms the loop-free tree structure that STP is designed to enforce.
    Specify the bridge priority for the MSTP instance. Select a value from 0 to 15, which the firewall multiplies by 4096 to derive the actual bridge priority. The effective bridge priority ranges from 0 (0×4096) to 61440 (15×4096) in increments of 4096. The default value is 8, which corresponds to an effective bridge priority of 32768.
    Enter a value for root bridge election process; a lower numerical value grants the bridge a higher priority, making it more likely to be elected as the root bridge in the spanning tree topology.
    Spanning-Tree Ports Profile
    Port Profile Name
    		Enter a port profile name (up to 31 characters). This name appears in the list of port profiles when configuring a Layer 2 switch interface type. The name is case-sensitive and must be unique. Use only letters, numbers, spaces, hyphens, and underscores.
    Port Type
    Select the port types:
    • Edge—Immediately transitions the port to the forwarding state upon link detection, bypassing the standard spanning-tree negotiation process (commonly known as PortFast). This profile should only be used on ports connected directly to end devices.
    • Network—Serves as the default profile for ports operating over shared Ethernet connections, providing standard spanning-tree behavior suitable for general-purpose use.
    • Point-to-point—Indicates that the port is connected over a dedicated, non-shared link. A port configured as point-to-point can be either an Edge port or a Network port, and enables rapid topology convergence by engaging in a proposal-agreement handshake with the connected peer, ensuring a loop-free path is established before traffic is forwarded.
    • Auto—Auto select port type.
    BPDU Guard
    (Optional) Enable or disable BPDU Guard on the port.
    Enable BPDU Guard to protect the Layer 2 STP topology from BPDU-related attacks. When enabled, if a BPDU is received on the port, the port is immediately placed in an error-disabled state to protect the topology from unauthorized switches.
    Root Guard
    (Optional) Enable or disable Root Guard on the port.
    Restricts the port's ability to assume the Root Port role, preventing an unauthorized device from becoming the Root Bridge through that port.
    When enabled, it prevents a configured port from becoming a root port. Root Guard prevents a downstream switch (often mis-configured or rogue) from becoming a root bridge in a topology. When such an event is detected, the port transitions into Root-Inconsistent state.

    © 2026 Palo Alto Networks, Inc. All rights reserved.