MikroTik / Layer 2 · Tutorial · July 2026

MikroTik
STP & Bonding

Two switches, two cables between them for redundancy — and now you've built a broadcast storm that takes the network down in seconds. Spanning Tree stops the loop; bonding lets you actually use both cables as one fat link. This is the Cisco STP & EtherChannel post in RouterOS, where both live on the bridge.

MikroTik RouterOS RSTP Bonding LACP

A Layer-2 loop has no TTL to save it — a single broadcast circulates forever, multiplying until the segment melts. Spanning Tree (STP/RSTP/MSTP) prevents that by detecting redundant paths and blocking all but one, then unblocking automatically if the active path dies. Bonding (LACP) solves the opposite problem: when you want to use two links at once, it aggregates them into one logical interface with more bandwidth and built-in failover — no loop, because the switches agree the links are one.

On RouterOS both are bridge-level concepts. STP is a property of the bridge and its ports; a bond is an interface you then add to the bridge as a single port. The concepts match Cisco IOS: STP & EtherChannel one-for-one — RSTP is RSTP, and LACP 802.3ad is the same standard EtherChannel negotiates.

Prerequisites

A bridge spanning more than one switch
At least two physical links between the two devices to make either feature meaningful

Spanning Tree — Pick RSTP, Then Set the Root

RouterOS bridges default to RSTP, which is what you want — fast convergence, backwards-compatible. The mistake is leaving root-bridge election to chance; you should decide which switch is root, not let MAC addresses decide.

Terminal — confirm RSTP, make the core the root bridge

> /interface bridge set bridge protocol-mode=rstp

# Lowest priority wins the root election. Set the CORE switch low
# so the tree is predictable and traffic flows the way you designed.
> /interface bridge set bridge priority=0x1000   # 4096; default is 0x8000

# Verify who actually became root and which ports are forwarding/blocking:
> /interface bridge monitor bridge
      root-bridge: yes
  root-bridge-id: 0x1000.CC:2D:...
> /interface bridge port print   # role/state per port: root/designated/blocking

⚠ Gotcha — Edge Ports & the "Why Did My Link Take 30s" Question

An access port with a host on it shouldn't participate in the tree — it should forward immediately. RouterOS auto-detects this (edge=auto), but if a port is flapping through listening/learning on every device plug-in, set edge=yes on host ports (the RSTP equivalent of Cisco PortFast). Conversely, never set edge=yes on a port going to another switch — that's how you hide a loop from STP.

Steering the Tree — Cost & Priority

Once the root is fixed, path cost decides which redundant link forwards and which blocks. Lower cost wins. Set it deliberately so your gigabit link carries traffic and the backup 100M link blocks — not the reverse.

Terminal — prefer the fast link, block the slow one

> /interface bridge port set [find interface=ether10] path-cost=10   # primary
> /interface bridge port set [find interface=ether11] path-cost=100  # backup, blocks
# For VLAN-aware trees where different VLANs should take different
# paths, switch the bridge to protocol-mode=mstp and map VLANs to MSTIs.

Bonding — Two Links, One Interface

When you want the bandwidth of both cables instead of blocking one, bond them. LACP (802.3ad) negotiates the aggregation with the far side so it's loop-free by design — the switches treat the pair as a single link.

Terminal — an 802.3ad LACP bond, added to the bridge as one port

# Create the bond from two physical ports. transmit-hash-policy spreads
# flows across members by L2+L3 headers (per-flow, not per-packet).
> /interface bonding add name=bond1 slaves=ether5,ether6 \
    mode=802.3ad transmit-hash-policy=layer-2-and-3 lacp-rate=1sec

# Then the bond is just a bridge port like any other:
> /interface bridge port add bridge=bridge interface=bond1
> /interface bonding monitor bond1   # lacp status, active slaves

💡 Pro Tip — Bonding Adds Bandwidth for Many Flows, Not One

A two-link LACP bond is 2× aggregate capacity, but any single TCP flow still rides one member — the hash pins a conversation to a link so packets don't reorder. Ten clients each get a full gig across a 2×1G bond; one client copying a file gets one gig, not two. That's inherent to link aggregation on every vendor, not a MikroTik quirk. Both ends must run LACP (Cisco: channel-group mode active) or the bond won't form.

Takeaways

A Layer-2 loop has no TTL — it's a self-amplifying storm. STP is not optional the moment you have redundant links.
Default to RSTP and set the root bridge deliberately with a low priority on your core; don't let MAC addresses elect it.
Mark host ports as edge (PortFast equivalent) for instant forwarding — but never on inter-switch links.
Path cost steers which redundant link forwards. Set it so your fast link carries and the slow one blocks.
Bond with LACP 802.3ad when you want both links live; it's loop-free by design and added to the bridge as one port.
Bonding scales flows, not a single stream — 2×1G helps ten clients, not one big copy. Both ends must speak LACP.

Redundant switch links that either loop or sit idle?

NOCTIS designs resilient Layer-2 cores on MikroTik and Cisco across Crete — deterministic spanning trees and LACP bonds that use the bandwidth you paid for and fail over cleanly.

Book a Discovery Call →