Configure Spanning Tree Protocol
Focus
Focus
Next-Generation Firewall

Configure Spanning Tree Protocol

Table of Contents

Configure Spanning Tree Protocol

Enable and configure Spanning Tree Protocol on Layer 2 switch interfaces to detect and eliminate Layer 2 loops on firewalls.
Where Can I Use This?What Do I Need?
  • NGFW (Managed by PAN-OS or Panorama)
  • PAN-OS 12.2.2 or a later release
  • PA-500 Series: PA-550, PA-560
  • No additional license required
Spanning Tree Protocol (STP) detects and eliminates Layer 2 loops. Configure STP on every Layer 2 switch interface, and on any Layer 2 interfaces in the same broadcast domain, to prevent loops. PAN-OS supports IEEE 802.1s Multiple Spanning Tree (MSTP). STP is disabled by default.
Configuration has three stages: create the global profile to enable STP system-wide, create port profiles to define per-port behavior, then apply a port profile to each interface.
  • Enabling STP on a Layer 2 interface changes BPDU handling. By default, Layer 2 interfaces flood BPDUs into the broadcast domain. When you apply an STP port profile, PAN-OS processes BPDUs in the control plane instead and sends STP-computed BPDUs on the interface.
  • You can configure STP for Layer 2 interfaces, Layer 2 LAG interfaces, and LAG interfaces.
  1. Create an STP global profile to enable STP system-wide:
    1. Select NetworkNetwork ProfilesSTP Profiles.
    2. On the Spanning Tree Global Profile tab, enable STP to create STP profile.
    3. Set the IST timers. The following table describes each parameter:
      ParameterDefaultRangeDescription
      Forward Delay15 sec4-30 secTime an interface spends in the Listening and Learning states before forwarding
      Hello Time2 sec1-10 secInterval between BPDU transmissions
      Max Age20 sec6-40 secTime a switch retains BPDU information before discarding it
      Max Hops201-255Maximum BPDU hops across an MSTP region; applies only on the regional root bridge
      Tx Hold Count31-10Maximum BPDUs transmitted per Hello interval; limits BPDU bursts
    4. (Optional) Select the Instance Parameters tab to configure the bridge priority for each MST instance. The bridge with the lowest priority value becomes the root bridge for that instance.
      Only one MST instance is supported. Therefore Instance ID is automatically set to 0 and you cannot configure this field.
    5. Select OK.
  2. Create an STP port profile to define per-port STP behavior:
    1. Select NetworkNetwork ProfilesSTP Profiles.
    2. Select the Spanning Tree Ports Profile tab and then Add.
    3. Enter a Name for the profile.
    4. Configure the port parameters. The following table describes each option:
      ParameterOptionsDescription
      Port TypeEdge, Network, Point-to-Point, and Auto.Following are the different port types:
      • Edge: Transitions the port immediately to the forwarding state upon link detection (portfast behavior). Reserve for end devices only.
      • Network: Default for shared Ethernet segments.
      • Point-to-Point: Indicates that the port is connected over a dedicated, non-shared link. A port configured as point-to-point can be either an Edge port or a Network port, and enables rapid topology convergence by engaging in a proposal-agreement handshake with the connected peer, ensuring a loop-free path is established before traffic is forwarded.
      BPDU GuardEnable / DisableWhen enabled, the port enters Error-Disable state upon receiving any BPDU (802.1d, 802.1w, or 802.1s). Use on Edge ports to block unauthorized switches.
      Root GuardEnable / DisablePrevents the port from becoming a root port. Use to protect the designated root bridge from displacement by a higher-priority device.
      Port Cost0-200,000,000
      Path cost to the root bridge. Lower cost is preferred.
      Default: 20,000.
    5. Select OK.
  3. Apply the port profile to each interface that participates in STP:
    1. In the Ethernet or aggregate Ethernet interface dialog, select the STP tab.
    2. For STP Port Profile, choose the profile you created.
    3. Set the Port Priority using a multiplier value between 0 and 15; the actual priority is calculated as the entered value multiplied by 8. The default multiplier is 8, which yields an actual priority of 64. A lower value gives the port higher priority for selection as a forwarding port when multiple ports have equal path cost to the root.
    4. Configure the Port Path Cost at the port level. If not configured, the Port Path Cost defaults to 0 (auto) and is automatically set based on the port speed.
    5. Select OK and then Commit.