3Com Switch 4500 Family Manual page 237

Parameters
interface-list: Ethernet port list. You can specify multiple Ethernet ports by providing this argument in the
form of interface-list = { interface-type interface-number [ to interface-type interface-number ] } &<1-10>,
where &<1-10> means that you can provide up to 10 port indexes/port index ranges for this argument.
Description
Use the stp root-protection command to enable the root guard function on the current port. Use
the undo stp root-protection command to restore the root guard function to the default state on
the current port.
Use the stp interface root-protection command to enable the root guard function on specified
port(s) in system view. Use the undo stp interface root-protection command to restore the root
guard function to the default state on specified port(s) in system view.
By default, the root guard function is disabled.
Because of configuration errors or malicious attacks, the valid root bridge in the network may receive
configuration BPDUs with their priorities higher than that of the root bridge, which causes new root
bridge to be elected and network topology jitter to occur. In this case, flows that should have traveled
along high-speed links are led to low-speed links, causing network congestion.
You can avoid this problem by utilizing the root guard function. Root-guard-enabled ports can only be
kept as designated ports in all MSTIs. When a port of this type receives configuration BPDUs with
higher priorities, it turns to the discarding state before it is specified as a non-designated port and stops
forwarding packets (as if it is disconnected from the link). It resumes the normal state if it does not
receive any configuration BPDUs with higher priorities for a specified period.
You are recommended to enable root guard on the designated ports of a root bridge.
Loop guard, root guard, and edge port settings are mutually exclusive. With one of these functions
enabled on a port, any of the other two functions cannot take effect even if you have configured it
on the port.
Examples
# Enable the root guard function on Ethernet 1/0/1.
Enable the root guard function on Ethernet 1/0/1 in Ethernet port view.
<Sysname> system-view
System View: return to User View with Ctrl+Z.
[Sysname] interface Ethernet 1/0/1
[Sysname-Ethernet1/0/1] stp root-protection
Enable the root guard function on Ethernet 1/0/1 in system view.
<Sysname> system-view
System View: return to User View with Ctrl+Z.
[Sysname] stp interface Ethernet 1/0/1 root-protection
# Enable the root guard function on Ethernet 1/0/2 to Ethernet 1/0/4 in system view.
1-37