# Spanning-Tree RootGuard **URL:** \ **Category:** Lessons Discussion\ **Created:** [December 27, 2016, 4:33pm UTC](https://forum.networklessons.com/t/spanning-tree-rootguard/1144 "2016-12-27T16:33:06Z")\ **Posts on this page:** 13\ **Page:** 3
**Author:** ![serveradmin](https://cdn-forum.networklessons.com/letter_avatar_proxy/v4/letter/s/a6a055/32.png) [@serveradmin](https://forum.networklessons.com/u/serveradmin)\ **Post date:** [October 27, 2021, 6:44am UTC](https://forum.networklessons.com/t/spanning-tree-rootguard/1144/42 "2021-10-27T06:44:21Z")
Hi Rene I have two psyhical links connected to the core switch in port-channel with multiple vlans. How should I configure rootguard? On vlans, psyhical links or directly on port-channel? ---
**Author:** ![lagapidis](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/lagapidis/32/4949_2.png) [@lagapidis](https://forum.networklessons.com/u/lagapidis)\ **Post date:** [October 28, 2021, 8:46am UTC](https://forum.networklessons.com/t/spanning-tree-rootguard/1144/43 "2021-10-28T08:46:49Z")
Hello Serveradmin Take a look at this post: > [@Spanning-Tree RootGuard](https://forum.networklessons.com/t/spanning-tree-rootguard/1144/31): > > Hello Eyad Whenever configuring STP related features such as BPDUGuard, RootGuard, LoopGuard, and BPDUFilter, you always apply them on the port-channel interfaces and not on the physical ports. The only exception is [UDLD](https://networklessons.com/spanning-tree/spanning-tree-loopguard-udld) which is strictly a physical layer protection mechanism. I hope this has been helpful! Laz If you have further questions, let us know! I hope this has been helpful! Laz ---
**Author:** ![shaan129](https://cdn-forum.networklessons.com/letter_avatar_proxy/v4/letter/s/b4bc9f/32.png) [@shaan129](https://forum.networklessons.com/u/shaan129)\ **Post date:** [December 26, 2021, 6:27pm UTC](https://forum.networklessons.com/t/spanning-tree-rootguard/1144/45 "2021-12-26T18:27:43Z")
Hi Team , This feature works only if switch with high priority is connected directly to root switch port or even if the high priority switch is connected via another switch in path to the root switch ? Regards Ziad ---
**Author:** ![lagapidis](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/lagapidis/32/4949_2.png) [@lagapidis](https://forum.networklessons.com/u/lagapidis)\ **Post date:** [December 28, 2021, 7:55am UTC](https://forum.networklessons.com/t/spanning-tree-rootguard/1144/46 "2021-12-28T07:55:09Z")
Hello Ziad This feature will only affect the local switch. If it is configured on a specific interface, any superior BPDUs received on that interface will be disregarded and will not change the currently defined root bridge within the local switch. Now this feature can be configured on the root bridge itself, or on other switches downstream. In any case, once a superior BPDU is seen on such an interface, it will block that particular VLAN. That means that such BPDUs are not sent upstream to the root bridge, but are blocked there. So the feature will activate at the local switch, but will not allow the BPDUs to be further propagated. I hope this has been helpful! Laz ---
**Author:** ![wonglili](https://cdn-forum.networklessons.com/letter_avatar_proxy/v4/letter/w/7bcc69/32.png) [@wonglili](https://forum.networklessons.com/u/wonglili)\ **Post date:** [February 24, 2022, 3:04am UTC](https://forum.networklessons.com/t/spanning-tree-rootguard/1144/47 "2022-02-24T03:04:40Z")
Hi All, Any command can show interface guard root enable? ---
**Author:** ![lagapidis](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/lagapidis/32/4949_2.png) [@lagapidis](https://forum.networklessons.com/u/lagapidis)\ **Post date:** [February 25, 2022, 5:57am UTC](https://forum.networklessons.com/t/spanning-tree-rootguard/1144/48 "2022-02-25T05:57:06Z")
Hello Chun There are two ways to see if root guard is employed on an interface. The first is to use the following command: `SW1#show spanning-tree interface gigabitEthernet 0/1 detail` A sample output from this command can be seen below: ```auto Port 2 (GigabitEthernet0/1) of VLAN0001 is designated forwarding Port path cost 4, Port priority 128, Port Identifier 128.2. Designated root has priority 32769, address 5254.000c.f48d Designated bridge has priority 32769, address 5254.000c.f48d Designated port id is 128.2, designated path cost 0 Timers: message age 0, forward delay 0, hold 0 Number of transitions to forwarding state: 1 Link type is point-to-point by default Root guard is enabled on the port BPDU: sent 936, received 1 ``` Notice on the second last line, it states that `Root guard is enabled on the port`. The other way to check is to simply look at the running config like so: ```auto SW1#show running-config interface gigabitEthernet 0/1 Building configuration... Current configuration : 95 bytes ! interface GigabitEthernet0/1 negotiation auto no cdp enable spanning-tree guard root end SW1# ``` You can see that the `spanning-tree guard root` command is in the configuration of the interface. I hope this has been helpful! Laz ---
**Author:** ![musalyh](https://cdn-forum.networklessons.com/letter_avatar_proxy/v4/letter/m/3ab097/32.png) [@musalyh](https://forum.networklessons.com/u/musalyh)\ **Post date:** [March 19, 2023, 12:49pm UTC](https://forum.networklessons.com/t/spanning-tree-rootguard/1144/49 "2023-03-19T12:49:22Z")
I’m using two backbones and I’m using HSRP. Is there any problem if I set the guard root on the interface Vlan of Backbone 1 and Backbone 2? ---
**Author:** ![lagapidis](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/lagapidis/32/4949_2.png) [@lagapidis](https://forum.networklessons.com/u/lagapidis)\ **Post date:** [March 21, 2023, 7:10am UTC](https://forum.networklessons.com/t/spanning-tree-rootguard/1144/50 "2023-03-21T07:10:22Z")
Hello YongHun I haven’t completely understood your topology. I assume that you want one of the two HSRP switches to be the root bridge for half of the VLANs being served, and the other to be the root bridge for the other half. In any case, keep in mind that Root Guard should be applied to Layer 2 interfaces, specifically on the switch ports that are connected to other switches. It is not applicable to SVIs since SVIs are associated with Layer 3 functionality. If you share a little bit more about your topology, and let us know some more about what you want to achieve, we may be able to help you further. I hope this has been helpful! Laz ---
**Author:** ![sathish84be](https://cdn-forum.networklessons.com/letter_avatar_proxy/v4/letter/s/a88e57/32.png) [@sathish84be](https://forum.networklessons.com/u/sathish84be)\ **Post date:** [August 7, 2024, 7:25pm UTC](https://forum.networklessons.com/t/spanning-tree-rootguard/1144/51 "2024-08-07T19:25:38Z")
Hello Team, ![image](https://forum.networklessons.com/uploads/default/original/2X/1/12786c137a2ffd8aef331c0c8df08e07fb112d1f.png) With this topology, i have enabled ROOT Guard on SW1 and given priority 0 in SW3 .At SW1, i could see both ports are in inconsistency and protected SW1 as a root bridge. But the strange thing is that SW2 accepted superior BPDU from SW3 and SW3 become a ROOT b/w SW2 and SW3. How can we mitigate this with this topology. SW1:- ![image](https://forum.networklessons.com/uploads/default/original/2X/7/74d083833ab331928601957529b4e6e3ec2219d7.png) SW2:- ![image](https://forum.networklessons.com/uploads/default/original/2X/f/f7739db860773ed5824feb8fd294907cefc4b241.png) SW3:- ![image](https://forum.networklessons.com/uploads/default/original/2X/5/544aa71c2c7474a6eb9e71cfd6d302c935bcb274.png) the design may be a wrong as it suggested only in CORE/DIST/Access layer setup. ---
**Author:** ![davidilles](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/davidilles/32/9686_2.png) [@davidilles](https://forum.networklessons.com/u/davidilles)\ **Post date:** [August 8, 2024, 9:24am UTC](https://forum.networklessons.com/t/spanning-tree-rootguard/1144/53 "2024-08-08T09:24:35Z")
Hello, Sathish. There is a “solution” to this: **Solution 1** Configure Root Guard on SW1 ports and on SW2’s e0/2 port. The problem? If the link between SW1 and SW2 fails, SW2 will try to converge and move over to e0/2 which can cause it to end up as root inconsistent. If SW2’s e0/2 port is designated here, it means that SW3’s e0/2 port is blocking. If SW2 loses the path to SW1 over e0/0, **it will completely stop receiving BPDUs!** The root bridge is down and SW3’s e0/2 is blocking! So SW2 will actually declare itself the RB which will cause SW3’s Max Age timer to expire (because it won’t accept the BPDUs as they are inferior). Then, when SW3 sends the superior BPDUs from SW2, SW2 will not accept them because it violates the root guard policy 😃 You could implement an EtherChannel between SW1 and SW2 to mitigate this to a certain point, but the risk is still there. The problem with Root Guard is that **it’s not a 100% guarantee** that it will guard your entire topology without any issues. It can mitigate other switches from becoming the Root Bridge, but only to a certain point. It is therefore important to design your network accordingly so you can apply Root Guard on the correct ports without worrying about a rogue switch taking over as the root bridge and ports being root inconsistent. Take a look at this 2-tier design: ![hierarchical-switch-network-design](https://forum.networklessons.com/uploads/default/original/2X/0/06068e317736f6382d085ca26e803709ce1e308b.png) You could happily apply Root Guard on the distribution layer switch so the access switches never become the RB. Access switches in a 2-tier/3-tier design aren’t connected together so you don’t have to worry about anything there as their only connection is to the distribution layer. If there is another distribution switch, the configuration is the same although a bit different. ![redundancy-access-distribution-layer](https://forum.networklessons.com/uploads/default/original/2X/b/bee8d7f320d998977197dc74d5eef631852c6aa2.png) Say, if you apply Root Guard on the links facing the access switches on the distribution switches, if the direct link between the distribution switches goes down, it will block the ports once the access switches advertise a superior BPDU to it. This can be solved by implementing an EtherChannel between the distribution-layer switches. And even a better solution would be to not run a L2 topology but a complete L3 one instead 😃 That way you don’t have to run STP at all so you don’t have to worry about Root Guard, Loop Guard, etc. David ---
**Author:** ![sathish84be](https://cdn-forum.networklessons.com/letter_avatar_proxy/v4/letter/s/a88e57/32.png) [@sathish84be](https://forum.networklessons.com/u/sathish84be)\ **Post date:** [August 8, 2024, 6:50pm UTC](https://forum.networklessons.com/t/spanning-tree-rootguard/1144/54 "2024-08-08T18:50:35Z")
Thanks @andrew , one question…how can we fix this if port goes into “Root Inconsistency”. Does it still function STP ( like sending BPDU ) and sending/receiving traffics ?. or is it mandatory to release the interface out of inconsistency? or how it would be done ?. ---
**Author:** ![lagapidis](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/lagapidis/32/4949_2.png) [@lagapidis](https://forum.networklessons.com/u/lagapidis)\ **Post date:** [August 10, 2024, 6:57am UTC](https://forum.networklessons.com/t/spanning-tree-rootguard/1144/55 "2024-08-10T06:57:49Z")
Hello Sathish A port will remain in the Root Inconsistency state as long as superior BPDUs are being received. Once the superior BPDUs stop, the port will automatically go back to its operational state. You could attempt to bring it back by shutting down the port and bringing it back up again, but if superior BPDUs are still being received, it will go into the inconsistency state again. The proper procedure is to simply resolve the superior BPDU issue, and the root inconsistency state will resolve itself. Does that make sense? I hope this has been helpful! Laz ---
**Author:** ![lagapidis](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/lagapidis/32/4949_2.png) [@lagapidis](https://forum.networklessons.com/u/lagapidis)\ **Post date:** [August 10, 2024, 7:33am UTC](https://forum.networklessons.com/t/spanning-tree-rootguard/1144/56 "2024-08-10T07:33:25Z")
Hello Sathish From your description, it seems that the Root Guard feature is functioning correctly on SW1. Root Guard prevents a port from becoming a root port, thus protecting the bridge from receiving superior BPDUs on that port. This is why SW1 is protected as a root bridge. However, SW2 is not protected by Root Guard and therefore it’s accepting superior BPDUs from SW3, making SW3 a root bridge between SW2 and SW3. To mitigate this, you should enable Root Guard on E0/2 of SW2 as well. This will prevent SW2 from accepting superior BPDUs from SW3 and maintain the root bridge as it is. Root guard does not necessarily mean that the local switch becomes the root. SW2 which is not the root can also have root guard configured on E0/2, and it can still receive superior BPDUs on E0/0 and recognize SW1 as the root bridge. Does that make sense? I hope this has been helpful! Laz [Previous page](https://forum.networklessons.com/t/spanning-tree-rootguard/1144.md?page=2)