Root Guard is an STP toolkit feature that protects the root bridge election by preventing a port from becoming a root port when it receives superior BPDUs.
Root Guard is typically used when connecting your switches to switches outside your direct control, such as when a service provider connects to customer networks.
When a Root Guard-enabled port receives a superior BPDU, it enters a "broken" and "root inconsistent" state, effectively blocking all traffic on that port.
Unlike BPDU Guard, Root Guard automatically recovers once the port stops receiving superior BPDUs (after the Max Age timer expires, approximately 20 seconds).
Root bridge selection should not be random—it should consider optimal traffic flow (minimizing latency and congestion) and switch stability/reliability.
Topic
Details
Purpose
Enforces the current root bridge by blocking ports that receive superior BPDUs
Use Case
Service provider → Customer connections; any scenario where you connect to switches you don't control
Configuration Mode
Interface configuration mode ONLY (no global default option)
Port State When Triggered
"Broken" / "Root Inconsistent"
Recovery Method
Automatic—once superior BPDUs stop being received
Recovery Time
~20 seconds (Max Age timer)
Term
Definition
Root Guard
STP feature that prevents a port from becoming a root port by disabling it if superior BPDUs are received
Superior BPDU
A BPDU with better parameters in the STP algorithm (e.g., lower/better root bridge ID)
Broken State
Port status indicating it cannot forward or receive data frames
Root Inconsistent
Status indicating the port was disabled specifically by Root Guard
Max Age
STP timer (default 20 seconds) that determines how long BPDU information is retained
Latency
Time it takes traffic to travel through the network
Congestion
Network condition when too much traffic causes delays or frame drops
spanning-tree guard root ← Enable Root Guard (interface config mode)
show spanning-tree ← Verify Root Guard status (look for BKN/ROOT_Inc)
Item
Value
Max Age Timer (default)
20 seconds
Root Guard recovery time
~20 seconds
Lowest possible STP priority
0 (but VLAN ID is added in PVST+)
Default STP priority
32768
Root Guard vs. BPDU Guard Recovery
Root Guard: Automatic recovery when superior BPDUs stop
BPDU Guard: Requires manual intervention or ErrDisable Recovery
Configuration Mode Confusion
Root Guard: Interface config mode ONLY
PortFast/BPDU Guard/BPDU Filter: Can be enabled globally
Where to Configure Root Guard
Configure on ports facing external/untrusted switches
DON'T configure on customer ports connecting TO a provider (defeats the purpose)
Priority of 0 Doesn't Guarantee Root
Even with priority 0, a switch with a lower MAC address can become root
This is WHY Root Guard exists
Port State Terminology
"BKN" = Broken (blocked)
"ROOT_Inc" = Root Inconsistent
Don't confuse with err-disabled state
Mnemonic
Meaning
"Root Guard GUARDS the ROOT"
Prevents other switches from taking root bridge role
"Superior = Suspicious"
Superior BPDUs from untrusted sources should be blocked
"20 to Recover"
Max Age of 20 seconds for automatic recovery
"Interface Only for Root"
Root Guard can only be configured per-interface
"Broken but Not Dead"
Unlike err-disabled, Root Guard ports auto-recover
[Service Provider LAN] [Customer LAN]
SW1 (Root) ─── SW2 ─────────── SW4 ─── SW6
│ │
SW3 ─────────── SW5 ─────┘
Problem: Customer's SW6 has lower MAC → Could become root
Solution: Enable Root Guard on SW2 & SW3 ports facing customer
SW2(config)# interface g0/2
SW2(config-if)# spanning-tree guard root
SW3(config)# interface g0/2
SW3(config-if)# spanning-tree guard root
SW4/SW5 send BPDUs claiming SW6 is root (superior BPDUs)
SW2/SW3 G0/2 ports enter "broken/root inconsistent" state
Traffic blocked until customer increases SW6's priority
After ~20 seconds of no superior BPDUs → automatic recovery
What is Root Guard?
An STP feature that prevents a port from becoming a root port by placing it in a "broken/root inconsistent" state if it receives superior BPDUs.
What command enables Root Guard on a port?
spanning-tree guard root (in interface configuration mode)
spanning-tree guard root
Can Root Guard be enabled globally by default?
No. Unlike PortFast and BPDU Guard, Root Guard can ONLY be configured in interface configuration mode.
What state does a port enter when Root Guard is triggered?
"Broken" and "Root Inconsistent" state (shown as BKN and ROOT_Inc in show commands)
How does a Root Guard-disabled port recover?
Automatically—once the port stops receiving superior BPDUs (after Max Age timer expires, ~20 seconds)
What is a "superior BPDU"?
A BPDU with better/lower parameters in the STP algorithm, such as a lower root bridge ID.
What is the default Max Age timer in STP?
What's the difference between Root Guard and BPDU Guard recovery?
: Root Guard recovers automatically when superior BPDUs stop. BPDU Guard requires manual intervention or ErrDisable Recovery configuration.
Where should Root Guard be configured?
On ports connecting to switches outside your direct control (e.g., service provider ports facing customer switches)
Why can't setting priority to 0 guarantee a switch remains root?
Because another switch with priority 0 but a LOWER MAC address would have a better (lower) bridge ID and become root.
What two factors should be considered when selecting a root bridge?
1) Optimal traffic flow (minimize latency and congestion) 2) Stability and reliability of the switch
In PVST+, what is added to the configured priority value?
The VLAN ID (e.g., priority 0 + VLAN 1 = priority 1)
What command shows Root Guard status on ports?
show spanning-tree (look for BKN status and ROOT_Inc notation)
show spanning-tree
Should a customer configure Root Guard on ports connecting to their service provider?
No—this would block the links and prevent communication over the provider's network.
What happens to traffic on a Root Guard-blocked port?
All traffic is cut off—the port cannot forward frames and discards any frames it receives.
Feature
Trigger
Port State
Recovery
Global Config?
Broken/Root Inconsistent
Automatic (~20s)
No
BPDU Guard
Any BPDU
Err-disabled
Manual or ErrDisable Recovery
Yes
BPDU Filter
N/A (filters BPDUs)
Normal
N/A
PortFast
N/A (skips states)
Forwarding immediately
Zuletzt geändertvor 15 Tagen