Switching · Spanning Tree

Root guard

Keep a downstream switch from replacing the intended upstream root.

Independent lab examples; selected output and frame summaries are illustrative. Port naming and command support vary by switch and software release.

Network and objective

Classic PVST+ is used to expose original STP behavior; rapid-PVST+ and MST are separate lessons.

Use three fresh isolated switches with Gigabit trunks: SW1 Gi1/0/23 ↔ SW2 Gi1/0/23; SW1 Gi1/0/24 ↔ SW3 Gi1/0/24; SW2 Gi1/0/24 ↔ SW3 Gi1/0/23. Both VLANs10/20 exist on every switch. Baseline SW1/SW2/SW3 priorities are4096/8192/12288, with short costs and no extra links. Start independently from the included baseline for each lesson; subsequent repair snippets apply to the named device.

Physical links are solid; device roles and relevant links are labeled.

How it works

Root guard is used on a designated downstream boundary where ordinary BPDUs are expected but superior root claims are not. A superior claim places the affected instance into root-inconsistent blocking instead of accepting that route to the root.

It does not err-disable the whole port like BPDU guard. When superior information stops and normal protocol conditions return, the instance can recover automatically. Do not place root guard on an uplink where accepting a superior upstream root is the intended behavior.

Configure or inspect

SW1

vlan 10
vlan 20
spanning-tree mode pvst
spanning-tree pathcost method short
spanning-tree vlan 10 priority 4096
spanning-tree vlan 20 priority 4096
interface range GigabitEthernet1/0/23 - 24
 switchport mode trunk
 switchport trunk allowed vlan 10,20
 switchport nonegotiate
 no shutdown
exit
interface GigabitEthernet1/0/23
 spanning-tree guard root

SW2

vlan 10
vlan 20
spanning-tree mode pvst
spanning-tree pathcost method short
spanning-tree vlan 10 priority 8192
spanning-tree vlan 20 priority 8192
interface range GigabitEthernet1/0/23 - 24
 switchport mode trunk
 switchport trunk allowed vlan 10,20
 switchport nonegotiate
 no shutdown
exit

SW3

vlan 10
vlan 20
spanning-tree mode pvst
spanning-tree pathcost method short
spanning-tree vlan 10 priority 12288
spanning-tree vlan 20 priority 12288
interface range GigabitEthernet1/0/23 - 24
 switchport mode trunk
 switchport trunk allowed vlan 10,20
 switchport nonegotiate
 no shutdown
exit

Verify the result

Illustrative output · selected lines

SW1#show spanning-tree inconsistentports
Name        Interface            Inconsistency
VLAN0010    GigabitEthernet1/0/23 Root Inconsistent
Number of inconsistent ports: 1

The lab can reproduce this by giving downstream SW2 a lower VLAN10 priority than SW1 in isolation. The guarded instance blocks the unexpected superior claim.

Failure and recovery

If the legitimate upstream root is blocked by root guard, the port was classified incorrectly. Correct the boundary intent rather than simply lowering every bridge priority.

SW2

spanning-tree vlan 10 priority 8192
end
show spanning-tree vlan 10

Key Takeaways

Root guard targets superior downstream information.
Normal BPDUs are still expected.
Root-inconsistent is different from err-disable.
Recovery can be automatic after the superior claim stops.
Do not guard the intended upstream root path.