13-12
Catalyst 2950 Desktop Switch Software Configuration Guide
78-14982-01
Chapter 13 Configuring Optional Spanning-Tree Features
Unders tanding Optional Spanning -Tree Features

Unders tanding Root Gu ar d

The Laye r 2 network of a service provide r (SP) can incl ude many co nnectio ns to switche s that are no t
owned by the SP. In such a topology , the spanning tree can reconfigure itself and select a customer switc h
as the r oot sw it ch, a s shown in Figure 13-10. Yo u ca n avoid this sit uat ion by con figuring roo t gua rd o n
SP switch interfaces that connect to switches in your customer’s network. I f spanning -tree ca lculations
cause an interfac e in the cust omer network to be sele cted as t he root po rt, root gua rd then places the
interface in the root-inconsistent (blocked) state to prev ent the customer’s switch from becomi ng the root
switch or bei ng in the pat h to the root.
If a switch outside the SP network becomes the root switch, the interface is blocked (root-inconsistent
state ), and spa nnin g tree sele cts a new root swi tch. Th e cus tomer ’s switch does not be come the root
switch an d is not in the pa th to the root .
If the switch is operating in multiple spanning-tree (MST) mode, root guard forces the port to be a
designated port. If a boundary port is blocked in an internal spanning-tree (IST) instance because of root
guard, t he port also is bl ocked in all MS T instanc es. A bounda ry port is a port th at connec ts to a LAN ,
the designated switch of which is either an 802.1D switch or a switch with a different MST region
configuration.
Root guard ena bled on an interf ace applies to all the VL ANs to which the inte rface belong s. VLANs can
be grou pe d and m app ed t o an M ST inst anc e.
If your switch is running PVST or MSTP, you can enable this feature by using the spanning-tr ee guard
root interface configuration comman d. The M STP is available on ly if you have the EI instal le d on your
switch.
Caution Misuse of the root-guard feature can cause a loss of connectivity.
Figure 13-10 Root Guard in a Service-Provider Network
Customer network
Potential
spanning-tree root without
root guard enabled
Enable the root-guard feature
on these interfaces to prevent
switches in the customer
network from becoming
the root switch or being
in the path to the root.
Desired
root switch
Service-provider network
43578