Cisco MST Configuration: Region, Instance and VLAN Mapping

Per-VLAN STP (PVST+) gives every VLAN its own spanning-tree instance, which is fine for a few dozen VLANs but wasteful on large campus networks with hundreds of VLANs. Multiple Spanning Tree (MST, IEEE 802.1s) lets you map many VLANs into a few instances, cutting BPDU overhead and CPU load while keeping separate forwarding topologies for load balancing. This Cisco MST configuration guide covers the three things every switch in a region must agree on - region name, revision number and VLAN-to-instance mapping - with full CLI examples, verification commands and a migration path from PVST+ that does not surprise you at 3 a.m.

What Defines an MST Region

Switches belong to the same MST region only when all three parameters match exactly: the configuration name (32 characters), the revision number, and the instance-to-VLAN mapping table. A region appears to the outside world as a single bridge speaking through instance 0 (the IST/CIST).

Because the mapping table is part of the region identity, adding a single VLAN to instance 2 on one switch and forgetting the peer splits the region just as surely as a different region name would. Treat the mapping as a shared configuration object owned by the region, not by the individual switch, and change it everywhere or nowhere.

There is a fourth, invisible parameter: the digest. Each switch hashes the name, revision and mapping into a configuration identifier that it advertises in its BPDUs. Two switches with an identical-looking show spanning-tree mst configuration cannot have different digests, so a digest mismatch always means one of the visible parameters differs - and the most common cause is an invisible one, such as a trailing space in the region name or a revision number typed as 010 on one switch.

MST Terminology: IST, CIST and MSTIs

• MSTI - an internal spanning-tree instance. Each one runs an independent topology with its own root election and its own set of blocking ports.
• IST (instance 0) - always present, always carrying the region's control protocol and every VLAN that is not explicitly mapped to another instance. Only the IST sends BPDUs.
• CIST - the Common and Internal Spanning Tree: the single logical topology that exists when the entire region is treated as one virtual bridge by the rest of the network.
• Boundary port - a port connecting the region to a switch in another region or running PVST+/RSTP; only the CIST and IST operate across it.

The important consequence of this model: an MSTI has no existence outside its region. Two regions side by side each maintain their own instance 1, and those two instances are unrelated topologies joined only through the CIST. That is why load-balancing schemes built on instance numbers stop at the region boundary.

Enabling MST and Creating the Region

Switch(config)# spanning-tree mode mst
Switch(config)# spanning-tree mst configuration
Switch(config-mst)# name NetworkJourney
Switch(config-mst)# revision 10
Switch(config-mst)# instance 1 vlan 10-50
Switch(config-mst)# instance 2 vlan 51-100
Switch(config-mst)# exit

Apply the identical configuration on every switch in the region. VLANs that are not mapped to a user instance stay in instance 0. Mapping changes are staged, not applied word by word: the switch keeps a pending copy until you leave configuration mode, which is exactly what show pending is for. Use the no form (no instance 2 vlan 51-100) to remove a mapping and no name plus no revision to return a switch to the default region parameters.

Setting Root Bridges per Instance

With VLANs spread over instances you can load-balance by making different switches root for different instances:

Switch(config)# spanning-tree mst 1 priority 4096
Switch2(config)# spanning-tree mst 2 priority 4096

Priorities must be multiples of 4096. Set the primary root for each instance to 4096 and, on the intended backup root, to 8192 so the backup takes over deterministically if the primary fails. Do not rely on the default 32768 with MAC-address tie-breaking - it works until someone inserts a switch with a lower base MAC.

Verifying MST Configuration

Switch# show spanning-tree mst configuration
Switch# show pending
Switch# show spanning-tree mst 1
Switch# show spanning-tree mst
Switch# show spanning-tree mst 0 root
Switch# show spanning-tree summary totals

show spanning-tree mst configuration must show the same name, revision and instance mapping on every member switch - a mismatch silently splits the region and can cause loops at the boundary. Use show pending before leaving configuration mode to double check the uncommitted mapping. show spanning-tree mst 0 root tells you who the CIST root is and how far away it is, which is the single fastest sanity check after a change.

Why a Region Split Is So Easy to Miss

A mismatched switch does not raise an alarm; it simply stops being a member. Both halves then run their own CIST, elect their own roots, and the links between them become boundary links whose state is decided by a topology nobody designed. The practical symptoms are unexpected blocking on a link you expected to be forwarding, traffic for a load-balanced VLAN pair taking the same path, and MAC address flapping between two uplinks. You will not see it in show spanning-tree on any single switch - only in show spanning-tree inconsistentports and in a side-by-side comparison of the configuration output on every member.

Migrating from PVST+ to MST Without an Outage

1. Plan two to four instances on paper and group VLANs so that the traffic you want load-balanced lands in different instances. Keep the mapping small; more instances mean more CPU, not more resilience.
2. Decide the root and backup root for every instance before you touch any switch, and write the priority commands down.
3. Configure the region parameters on switches one at a time, starting at the access layer, leaving each switch in PVST+ mode until the whole plan is ready.
4. Set spanning-tree mst <n> priority on the intended roots while still in PVST+ mode if the platform allows it, so there is no window with a default root.
5. Change spanning-tree mode mst on every member within a short window. Expect the links to re-converge on each switch as it joins the region.
6. Verify the region on every member, then verify that each instance has the root you designed.

While some switches run PVST+ and others run MST, the VLANs temporarily straddle two incompatible modes, and traffic across the boundary relies on PVST+ simulation. Treat the cutover as a short maintenance window rather than something to do while a backup is running.

Worked Design: Two Distribution Switches, Two Instances

A typical floor block has two distribution switches, dist1 and dist2, joined by a pair of links, with VLANs 10-19 for data and 20-29 for voice and wireless. Instance 1 takes the data VLANs and instance 2 the voice VLANs, so the two halves of the plan use different paths:

dist1(config)# spanning-tree mst 1 priority 4096
dist1(config)# spanning-tree mst 2 priority 8192
dist2(config)# spanning-tree mst 1 priority 8192
dist2(config)# spanning-tree mst 2 priority 4096
dist1(config-mst)# instance 1 vlan 10-19
dist1(config-mst)# instance 2 vlan 20-29
dist2(config-mst)# instance 1 vlan 10-19
dist2(config-mst)# instance 2 vlan 20-29

The result is that instance 1 blocks one of the two uplinks and instance 2 blocks the other, so both links carry traffic and a single link failure costs one instance's traffic a re-convergence rather than half the bandwidth of the whole block. Keep the per-instance load sharing balanced as well as the VLAN count: two instances with one huge VLAN each will not help if all the bandwidth sits in one VLAN.

Boundary and Interoperability Notes

When an MST region connects to a PVST+ or RSTP domain, only instance 0 interacts with the outside, and the region replicates IST information into per-VLAN BPDUs on boundary ports (PVST+ simulation). Cisco switches support up to 16 instances: instance 0 plus 15 MSTIs.

Two practical rules follow from this. First, VLANs mapped into different instances on one side of the boundary have no independent meaning on the other side, so a load-balancing design that depends on instances must keep both ends inside the same region or use separate physical paths. Second, a boundary link carries the CIST cost, not the MSTI cost, so uplink cost tuning inside the region has no effect on which boundary port forwards.

Tuning MSTP Timers and Edge Ports

Timers should be changed only on the root and only with a reason; every switch in the region learns them from the CIST root. In almost all cases the defaults are correct, and shortening them trades a little convergence time for a lot of instability.

Switch(config)# spanning-tree mst hello-time 2
Switch(config)# spanning-tree mst forward-time 15
Switch(config)# spanning-tree mst max-age 20
Switch(config)# interface range gigabitEthernet 1/0/1 - 24
Switch(config-if-range)# spanning-tree portfast
Switch(config-if-range)# spanning-tree bpduguard enable

Edge ports are where MSTP stability is won or lost at the access layer. PortFast removes the listening/learning delay for a host-facing port, and BPDU Guard shuts the port down if a switch is ever plugged in there, which is the only reliable way to keep an access port from becoming part of any instance's topology.

Troubleshooting Region Mismatches

Switch# show spanning-tree mst configuration digest
Switch# show spanning-tree inconsistentports
Switch# show spanning-tree mst interface gigabitEthernet 1/0/1
Switch# show spanning-tree interface gigabitEthernet 1/0/1 detail

Start with the digest on both ends of the suspect link. If the digests differ, compare the full configuration output line by line rather than trusting your memory of what you typed. If the digests match but a port is inconsistent, the problem is a VLAN-to-instance inconsistency for that specific port, typically a VLAN that exists on one side of a trunk but not the other, or a native-VLAN mismatch. show spanning-tree interface ... detail prints the per-instance role, state, cost and, crucially, the designated bridge for each MSTI, which tells you which switch each end believes should be forwarding.

Related Guides on This Site

Not sure whether to migrate? Read RSTP vs MSTP: convergence, instances and migration first, then harden the edge with PortFast, BPDU Guard and Root Guard. For the election mechanics behind the priority values used above, see spanning-tree root bridge election and priority design; for a vendor comparison read Dell OS10 RSTP and Rapid PVST+, and when a link looks unidirectional check UDLD normal and aggressive mode.

原文链接：https://ipcisco.com/lesson/mst-configuration-on-cisco