Jeremy's IT Lab: STP Toolkit - Root Guard

Introduction

• Focus on Root Guard, a feature in the STP toolkit.
• Root Guard prevents another switch with a lower bridge ID from becoming the root bridge.
• Useful when connecting to switches you don’t control (e.g., service provider to customer networks).

STP Toolkit Overview

• Previous videos covered:
  • PortFast
  • BPDU Guard
  • BPDU Filter
• Next video will cover Loop Guard.

Importance of Root Bridge

• STP elects a root bridge to prevent loops, ensuring each switch has one valid path to it.
• Optimal root bridge selection minimizes latency and congestion.
• Stability and reliability are key; newer, more reliable switches should be chosen as root bridge.

Example Network

• SW1 selected as root bridge for efficient traffic path to R1, the gateway to the internet.
• Improper root bridge (e.g., SW3) can slightly increase latency and cause potential congestion.

Root Guard Functionality

• Prevents ports from becoming root ports by disabling them if superior BPDUs are received.
• Example scenario: Service provider (SW1) and customer (SW6) networks are connected.
• SW6 has lower bridge ID, causing it to become root if unguarded.
• Root Guard ensures service provider’s network maintains its own root bridge (SW1).

Configuration

• Command: SPANNING-TREE GUARD ROOT in interface config mode to enable Root Guard.
• No global config mode command available; enables only on specific ports.
• Enabled ports receiving superior BPDUs are disabled ("broken" and "root inconsistent").

Recovery and Best Practices

• To recover a disabled port:
  • Stop receiving superior BPDUs (e.g., customer increases SW6 priority).
  • Ports recover automatically after BPDUs age out (default max age: 20 seconds).
• Only configure Root Guard on ports connecting to non-controlled networks.
• Not recommended for every network connection (e.g., customer’s port to provider).

Summary

• Root bridge selection should consider traffic flow and switch reliability.
• Use Root Guard when connecting to external networks to maintain control.
• SPANNING-TREE GUARD ROOT enables it on specific ports to prevent accepting superior BPDUs.
• Ports auto-recover without manual intervention or ErrDisable Recovery if superior BPDUs stop.

Conclusion

• Root Guard prevents unwanted changes in STP topology by external networks.
• Enables stability and efficiency in network operations.
• Essential for environments like service provider networks connecting to customer networks.