Reference Guide

A, device D is elected as root, causing the link between Switches A and B to enter a Blocking state. Network traffic then
begins to flow in the directions indicated by the BPDU arrows in the topology. If the links between Switches C and A or
Switches C and B cannot handle the increased traffic flow, frames may be dropped.
In STP topology 3 (shown in the lower middle), if you have enabled the root guard feature on the STP port on Switch C
that connects to device D, and device D sends a superior BPDU that would trigger the election of device D as the new
root bridge, the BPDU is ignored and the port on Switch C transitions from a forwarding to a root-inconsistent state
(shown by the green X icon). As a result, Switch A becomes the root bridge.
Figure 124. STP Root Guard Prevents Bridging Loops
Configuring Root Guard
Enable STP root guard on a per-port or per-port-channel basis.
FTOS Behavior: The following conditions apply to a port enabled with STP root guard:
• Root guard is supported on any STP-enabled port or port-channel interface except when used as a stacking
port.
• Root guard is supported on a port in any Spanning Tree mode:
– Spanning Tree Protocol (STP)
– Rapid Spanning Tree Protocol (RSTP)
– Multiple Spanning Tree Protocol (MSTP)
– Per-VLAN Spanning Tree Plus (PVST+)
• When enabled on a port, root guard applies to all VLANs configured on the port.
801