Image the followign scenario

Switch 1 Managed (root)

Switch 2 Managed

Switch 3 Unmanaged

They are connected as follows:

Switch 1 <-> Switch 3

Switch 2 <-> Switch 3

Switch 1 <-> Switch 2

Switch 3 uplinked to internet

Device A connected to switch 2

What path does traffic from the internet take to get to the end devices? Is this coordinated between the two switches if so how?


Internet packet -> Unamanged Switch3 -> Switch 2 -> Device A?


Internet packet -> Unamanged Switch3 -> Switch 1 -> Switch 2 -> Device A?

Remember that switch 3 is unmanaged and has no understanding of root priorities etc.

  • The ASA5505 switch is mostly unmanaged. As it doesn't run spanning-tree, you should avoid running things as indicated. (i.e. don't connected the managed switches to each other, or only connect the ASA to one of them.)
    – Ricky
    Feb 21, 2022 at 22:49

3 Answers 3


It is not given that an unmanaged switch does not understand spanning tree.

An unmanaged switch may participate in STP, or it may simply pass BPDUs through. Unless you give us the switch model, we cannot answer what any particular unmanaged switch will do. Also, many unmanaged switches are off-topic here.

An unmanaged switch will not understand VLANs, and is is undefined what it will do with tagged frames (some will pass them through, some will drop as damaged, and some will strip off the tags).

  • Switch 3 is really CISCO ASA 5505. So really its router with switch ports
    – Kevin
    Feb 21, 2022 at 22:18
  • An ASA is explicitly not a router per Cisco; it is a firewall, and the switch module is not an unmanaged switch.
    – Ron Maupin
    Feb 21, 2022 at 22:19
  • Understood. So given that, would you say that this is the path that the data will travel? Internet packet -> Unamanged Switch3 -> Switch 1 -> Switch 2 -> Device A?
    – Kevin
    Feb 21, 2022 at 22:23
  • Yes, of course. There is no other path, and the MAC address tables (including in the ASA switch module) will know how to reach the PC. Even completely unmanaged switches have MAC address tables that get updated when a frame is seen, and any unknown unicasts are flooded to all interfaces, just as with any managed switch.
    – Ron Maupin
    Feb 21, 2022 at 22:27
  • I tried looking up if cisco ASA 5505 is aware of STP capable, those threads are saying its not. So how will it determine the path then. community.cisco.com/t5/network-security/asa-and-spanning-tree/… or community.cisco.com/t5/switching/asa-and-spanning-tree/td-p/… not sure if I am missing something.
    – Kevin
    Feb 21, 2022 at 22:39

I will assume that the managed switches in your question support STP and the unmanaged switch doesn't. However note that "managed" and "understands STP" are strictly distinct features, it is quite possible to have a managed switch that does not understand STP (or has it disabled) and quite possible to have an unmanaged switch that supports STP.

If a switch that doesn't understand STP is involved in a cycle with switches that do support STP then there are two possibilities.

If the non-stp switch is "transparent" to the BDPU frames, then STP will operate as-if the the non-stp switch was a direct link between the stp switches. In your scenarion this means that switch2 will have to choose one link to block. The "cost" and bridge IDs will be the same (since the non-stp switch is not visible to the spanning tree algorithm), so the decision will be made based on the "Port ID" values sent by switch1.

If the non-stp switch blocks the BDPU frames, then no ports will be blocked, a loop will form and, unless there are additional protection measures in place, the network will collapse.


Managed or unmanaged doesn't matter in the case of a 'flat' network like that (there seem to be no VLANs).

However, you've created a ring which resembles a bridge loop that brings down a network - unless there's a mechanism like spanning tree that prevents that loop.

Note that using unmanaged switches or managed switches with deactivated xSTP in a looped network may hide the loop from the STP switches and bring down the network all the same.

In your case, if switch 3 is transparent to BDPUs, it'll look like a plain wire to switches 1 and 2. Depending on which ports they use to link to switch 3, they'll block one link. Lower-number ports take precedence over higher-number ports.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.