Enabling Root Guard; Loop Guard; Enabling Loop Guard - Cisco IE-4000 Software Configuration Manual

Configuring Optional Spanning-Tree Features
Information About Configuring the Optional Spanning-Tree Features
Figure 51 Root Guard in a Service-Provider Network
spanning-tree root without
root guard enabled

Enabling Root Guard

Root guard enabled on an interface applies to all the VLANs to which the interface belongs. Do not enable the root guard
on interfaces to be used by the UplinkFast feature. With UplinkFast, the backup interfaces (in the blocked state) replace
the root port in the case of a failure. However, if root guard is also enabled, all the backup interfaces used by the
UplinkFast feature are placed in the root-inconsistent state (blocked) and are prevented from reaching the forwarding
state.
Note: You cannot enable both root guard and loop guard at the same time.

Loop Guard

You can use loop guard to prevent alternate or root ports from becoming designated ports because of a failure that leads
to a unidirectional link. This feature is most effective when it is enabled on the entire switched network. Loop guard
prevents alternate and root ports from becoming designated ports, and spanning tree does not send BPDUs on root or
alternate ports.
You can enable this feature by using the spanning-tree loopguard default global configuration command.
When the switch is operating in PVST+ or rapid-PVST+ mode, loop guard prevents alternate and root ports from
becoming designated ports, and spanning tree does not send BPDUs on root or alternate ports.
When the switch is operating in MST mode, BPDUs are not sent on nonboundary ports only if the interface is blocked by
loop guard in all MST instances. On a boundary port, loop guard blocks the interface in all MST instances.

Enabling Loop Guard

You can use loop guard to prevent alternate or root ports from becoming designated ports because of a failure that leads
to a unidirectional link. This feature is most effective when it is configured on the entire switched network. Loop guard
operates only on interfaces that are considered point-to-point by the spanning tree.
Note: You cannot enable both loop guard and root guard at the same time.
Customer network
Potential
Service-provider network
Enable the root-guard feature
on these interfaces to prevent
switches in the customer
network from becoming
the root switch or being
in the path to the root.
361
Desired
root switch