Etherchannel Guard; Root Guard - Cisco Catalyst 2960-XR Configuration Manual

Configuring Optional Spanning-Tree Features

EtherChannel Guard

You can use EtherChannel guard to detect an EtherChannel misconfiguration between the switch and a
connected device. A misconfiguration can occur if the switch interfaces are configured in an EtherChannel,
but the interfaces on the other device are not. A misconfiguration can also occur if the channel parameters are
not the same at both ends of the EtherChannel.
If the switch detects a misconfiguration on the other device, EtherChannel guard places the switch interfaces
in the error-disabled state, and displays an error message.
Related Topics
Enabling EtherChannel Guard, on page 98

Root Guard

The Layer 2 network of a service provider (SP) can include many connections to switches that are not owned
by the SP. In such a topology, the spanning tree can reconfigure itself and select a customer switch as the root
switch. You can avoid this situation by enabling root guard on SP switch interfaces that connect to switches
in your customer's network. If spanning-tree calculations cause an interface in the customer network to be
selected as the root port, root guard then places the interface in the root-inconsistent (blocked) state to prevent
the customer's switch from becoming the root switch or being in the path to the root.
Figure 18: Root Guard in a Service-Provider Network
If a switch outside the SP network becomes the root switch, the interface is blocked (root-inconsistent state),
and spanning tree selects a new root switch. The customer's switch does not become the root switch and is
not in the path to the root.
If the switch is operating in multiple spanning-tree (MST) mode, root guard forces the interface to be a
designated port. If a boundary port is blocked in an internal spanning-tree (IST) instance because of root
OL-29424-01
Catalyst 2960-XR Switch Layer 2 Configuration Guide, Cisco IOS Release 15.0(2)EX1
EtherChannel Guard
89