Q:
How does Spanning-Tree Root-Guard operate?
A: The spanning-tree root-guard configuration sets ports to ignore superior BPDUs to prevent it from becoming root port.
In the following example, switches Rack2sw1 and Rack2sw2 are configured for spanning-tree protocol. Switch Rack2sw1 is configured with the spanning-tree priority of two and Rack2sw2 is configured with the spanning-tree priority of eight. Switch Rack2sw1 will become the spanning-tree root being it has a lower priority. Interface 24 on switch Rack2sw1 is configured for root-guard.
Testing is accomplished by changing the spanning-tree priority on switch Rack2sw2 to zero. Interface 24 on switch Rack2sw1 changes state to inconsistent and a blocked port by spanning-tree message is logged
********** Switch Rack2sw1 Configuration **********
Rack2sw1# show config | begin spanning-tree
spanning-tree
spanning-tree priority 2
Rack2sw1# show config interface 24
interface 24
untagged vlan 12
spanning-tree root-guard
********** Switch Rack2sw2 Configuration **********
Rack2sw2# show running-config | include spanning-tree
spanning-tree priority 8
********** Switch Verification **********
Rack2sw1# show spanning-tree | include CST
CST Root MAC Address : 941882-a36540 <==== Same Root Addresses
CST Root Priority : 8192
CST Root Path Cost : 0
CST Root Port : This switch is root
Rack2sw2# show spanning-tree | include CST
CST Root MAC Address : 941882-a36540 <==== Same Root Addresses
CST Root Priority : 8192
CST Root Path Cost : 20000
CST Root Port : 24
********** Testing **********
Rack2sw2(config)# spanning-tree priority 0
********** Testing Verification **********
Rack4sw1# show spanning-tree inconsistent-ports
Instance ID Blocked Port Reason
----------- ------------ -------------------------
CST 24 Root Guard
CST A1
CST A2
CST B1
CST B2
Rack2sw1# show logging -r
Keys: W=Warning I=Information
M=Major D=Debug E=Error
---- Reverse event Log listing: Events Since Boot ----
I 01/01/90 00:44:44 00435 ports: port 24 is Blocked by STP
Rack2sw1# show spanning-tree | include CST
CST Root MAC Address : 941882-a36540 <==== Different Root Addresses
CST Root Priority : 8192
CST Root Path Cost : 0
CST Root Port : This switch is root
Rack2sw2# show spanning-tree | include CST
CST Root MAC Address : 941882-a48880 <==== Different Root Addresses
CST Root Priority : 0
CST Root Path Cost : 0
CST Root Port : This switch is root