User's Manual

246
Users Manual of CS-6306R
20.1.1.6 Root Guard
The Root Guard feature prevents a port from turning into a root port because of receiving high-priority BPDU.
The Layer 2 network of a service provider (SP) can include many connections to switches that are not owned
by the SP. In such a topology, the spanning tree can reconfigure itself and select a customer switch as the root
switch, as shown in Figure 17-8. You can avoid this situation by enabling root guard on SP switch interfaces
that connect to switches in your customer's network. If spanning-tree calculations cause an interface in the
customer network to be selected as the root port, root guard then places the interface in the root-inconsistent
(blocked) state to prevent the customer's switch from becoming the root switch or being in the path to the root.
If a switch outside the SP network becomes the root switch, the interface is blocked (root-inconsistent state),
and spanning tree selects a new root switch. The customer's switch does not become the root switch and is
not in the path to the root.
If the switch is operating in multiple spanning-tree (MST) modes, root guard forces the interface to be a
designated port. If a boundary port is blocked in an internal spanning-tree (IST) instance because of root
guard, the interface also is blocked in all MST instances. A boundary port is an interface that connects to a
LAN, the designated switch of which is either an IEEE 802.1D switch or a switch with a different MST region
configuration.
Root guard enabled on an interface applies to all the VLANs to which the interface belongs. VLANs can be
grouped and mapped to an MST instance.
You can enable this feature by using the spanning-tree guard root interface configuration command.
Root Guard feature acts differently somehow in SSTP/PVST and RSTP/MSTP. In
SSTP/PVST mode, Root port is always blocked by Root Guard. In RSTP/MSTP
mode, Root port won’t be blocked until receiving higher level BPDU. A port which
formerly plays the Root role will not be blocked.
20.1.1.7 Loop Guard
You can use loop guard to prevent alternate or root ports from becoming designated ports because of a failure
that leads to a unidirectional link. This feature is most effective when it is enabled on the entire switched
network. Loop guard prevents alternate and root ports from becoming designated ports, and spanning tree
does not send BPDUs on root or alternate ports.
You can enable this feature by using the spanning-tree loopguard default global configuration command.
When the switch is operating in PVST+ or rapid-PVST+ mode, loop guard prevents alternate and root ports
from becoming designated ports, and spanning tree does not send BPDUs on root or alternate ports.
When the switch is operating in MST mode, BPDUs are not sent on nonboundary ports only if loop guard in all
MST instances blocks the interface. On a boundary port, loop guard blocks the interface in all MST instances.
Loop Guard feature acts differently somehow in SSTP/PVST and RSTP/MSTP. In
SSTP/PVST mode, the designated port is always be blocked by Loop Guard. In
RSTP/MSTP mode, the port will be blocked only when it changes into the designated
port because of inaccessibility to receiving BPDU. Loop Guard will not block a port,
which is provided with the designated role due to receiving the lower level BPDU.