In which configuration mode is spanning-tree guard root used?

The spanning-tree guard root command is entered in Interface Config mode on Cisco IOS devices.

Spanning TreeInterface Config

spanning-tree guard root

Enables root guard on a switch port to prevent it from becoming a root port in the Spanning Tree Protocol, protecting against rogue switches that might try to become the root bridge.

Definition: spanning-tree guard root is a Cisco IOS interface config command. Enables root guard on a switch port to prevent it from becoming a root port in the Spanning Tree Protocol, protecting against rogue switches that might try to become the root bridge.

Overview

The `spanning-tree guard root` command is a critical security feature in Cisco IOS that prevents a switch port from becoming a root port in the Spanning Tree Protocol (STP) topology. When enabled, it forces the port to be a designated or blocking port, never a root port. This protects the network from rogue switches or misconfigurations that could attempt to become the root bridge, potentially causing topology changes, suboptimal paths, or even loops. The command operates by monitoring incoming Bridge Protocol Data Units (BPDUs). If a superior BPDU (one with a lower bridge ID) is received on a root-guard-enabled port, the port transitions to a root-inconsistent state (blocking) until the superior BPDUs cease. This ensures that the current root bridge remains stable and that only authorized switches can influence the root election.

Root guard is typically applied on ports that connect to access-layer switches or end devices where you do not expect any switch to become the root. It is an alternative to BPDU guard, which protects against unexpected BPDUs on access ports by err-disabling the port. While BPDU guard is used on ports that should never receive BPDUs (e.g., host ports), root guard is used on ports that legitimately participate in STP but should never become root ports. Common scenarios include uplinks from distribution switches to access switches, where the access switch should never be the root. Root guard can also be combined with other STP features like PortFast and BPDU guard for comprehensive edge port protection.

In the broader network configuration workflow, root guard is typically applied after the STP topology is stable and the root bridge is identified. It is a proactive security measure that prevents accidental or malicious root bridge hijacking. The command is configured per interface and takes effect immediately. It does not require a reload and is stored in the running configuration. Privilege level 15 (enable) is required to configure it. The command is available in IOS, IOS-XE, and some versions of IOS-XR, but not in NX-OS (which uses a different mechanism). Understanding root guard is essential for CCNA and CCNP candidates, as it appears in both the Switching and Troubleshooting sections of the exams.

Syntax·Interface Config

spanning-tree guard root

When to Use This Command

Prevent an unauthorized switch connected to an access port from becoming the root bridge.
Protect the STP topology on a port connected to a switch in a different administrative domain.
Ensure that a designated port remains designated and does not transition to root port due to inferior BPDUs.
Use on ports connecting to end-user devices that should never participate in STP root election.

Command Examples

Enable root guard on an interface

interface GigabitEthernet0/1
spanning-tree guard root

Switch(config-if)# spanning-tree guard root
Switch(config-if)#

The command is entered without any output confirmation. Root guard is enabled on the interface. If the interface receives a superior BPDU (indicating a potential root bridge), the port will be placed into a root-inconsistent state (blocking) to protect the current root.

Verify root guard configuration

show spanning-tree interface GigabitEthernet0/1 detail

GigabitEthernet0/1 is up, line protocol is up
  Port 1 (GigabitEthernet0/1) of VLAN 1 is designated forwarding
  Port path cost 4, Port priority 128, Port identifier 128.1
  Designated root has priority 32768, address 0011.2233.4455
  Designated bridge has priority 32768, address 0011.2233.4455
  Designated port id is 128.1, designated path cost 4
  Timers: message age 0, forward delay 0, hold 0
  Number of transitions to forwarding state: 1
  BPDU: sent 10, received 5
  Root guard is enabled on this port.

The output shows the interface status and STP parameters. The key line is 'Root guard is enabled on this port.' confirming root guard is active. If a superior BPDU were received, the port state would show 'root-inconsistent' instead of 'designated forwarding'.

Understanding the Output

When root guard is enabled, the switch monitors BPDUs received on the port. If a superior BPDU (with lower bridge ID or path cost) is received, the port is placed into a root-inconsistent state (blocking) to prevent the attached switch from becoming root. The 'show spanning-tree interface' command displays the port state; a healthy port shows 'designated forwarding' or 'alternate blocking'.

If root guard triggers, the state becomes 'root-inconsistent' and the port blocks traffic. The 'show spanning-tree inconsistentports' command lists all ports in inconsistent states. Good values: port is forwarding normally.

Bad values: port is root-inconsistent, indicating a potential STP attack or misconfiguration.

Configuration Scenarios

Prevent an Access Switch from Becoming Root Bridge

In a campus network, the distribution switch (Dist1) is the root bridge. An access switch (Acc1) should never become root. Root guard is applied on the uplink ports of Dist1 facing Acc1.

Topology

Dist1(Gi0/1)---10.0.1.0/30---(Gi0/1)Acc1
Dist1(Gi0/2)---10.0.2.0/30---(Gi0/2)Acc1

Steps

1.Step 1: Enter global configuration mode: Dist1# configure terminal
2.Step 2: Enter interface configuration for the uplink to Acc1: Dist1(config)# interface gigabitethernet0/1
3.Step 3: Enable root guard: Dist1(config-if)# spanning-tree guard root
4.Step 4: Repeat for the second uplink: Dist1(config)# interface gigabitethernet0/2
5.Step 5: Enable root guard: Dist1(config-if)# spanning-tree guard root
6.Step 6: Exit and verify: Dist1(config-if)# end

Configuration

! Configuration on Dist1
interface GigabitEthernet0/1
 spanning-tree guard root
!
interface GigabitEthernet0/2
 spanning-tree guard root

Verify: Use 'show spanning-tree interface gigabitethernet0/1 detail' and look for 'Root guard is enabled' in the output. Also check 'show spanning-tree' to ensure the port role is not root.

Watch out: If Acc1 sends a superior BPDU (e.g., because its priority is lower than Dist1's), the port will go into root-inconsistent state (blocking). This can cause connectivity loss if both uplinks are affected. Always ensure the root bridge has the lowest priority.

Protect Against Rogue Switch on an Edge Port

A rogue switch is plugged into an edge port on a distribution switch. Root guard prevents the rogue from becoming root and disrupting the network.

Topology

Dist1(Gi0/3)---10.0.3.0/30---(Gi0/1)Rogue

Steps

1.Step 1: Enter global configuration mode: Dist1# configure terminal
2.Step 2: Enter interface configuration for the edge port: Dist1(config)# interface gigabitethernet0/3
3.Step 3: Enable root guard: Dist1(config-if)# spanning-tree guard root
4.Step 4: Optionally enable PortFast for faster convergence: Dist1(config-if)# spanning-tree portfast
5.Step 5: Exit and verify: Dist1(config-if)# end

Configuration

! Configuration on Dist1
interface GigabitEthernet0/3
 spanning-tree guard root
 spanning-tree portfast

Verify: Use 'show spanning-tree interface gigabitethernet0/3 detail' to confirm root guard is enabled. If a rogue switch is connected, the port will show 'Root Inconsistent' in 'show spanning-tree inconsistentports'.

Watch out: Root guard does not err-disable the port; it only blocks it while superior BPDUs are received. Once the rogue is removed, the port recovers automatically. However, if combined with BPDU guard, the port may err-disable. Use one or the other based on the expected behavior.

Troubleshooting with This Command

When troubleshooting STP issues related to root guard, the primary command is `show spanning-tree inconsistentports`. This command lists all ports that are in a root-inconsistent state, which is the direct indicator that root guard has blocked a port due to receiving superior BPDUs. Healthy output shows no inconsistent ports.

If a port appears in this list, it means a device connected to that port is trying to become the root bridge. The next step is to identify the offending device by examining the BPDU details. Use `show spanning-tree interface <interface> detail` to see the port's role, state, and whether root guard is enabled.

Look for 'Root guard is enabled' and 'Port state: blocking' with 'Inconsistent' in the output. To see the BPDUs being received, use `debug spanning-tree events` (with caution in production) or `show spanning-tree interface <interface> bpdu` to view the last BPDU received. Focus on the bridge ID in the BPDU; a lower priority or MAC address indicates a potential root candidate.

Common symptoms that root guard helps diagnose include intermittent connectivity, unexpected topology changes, and suboptimal paths. For example, if a distribution switch suddenly stops forwarding traffic on its uplinks, check for root-inconsistent ports. The diagnostic flow: 1) Check `show spanning-tree inconsistentports`. 2) If ports are listed, note the interface. 3) Examine that interface's STP state with `show spanning-tree interface <int> detail`. 4) Determine the source of superior BPDUs by checking the connected device's configuration or using CDP/LLDP to identify it. 5) Correct the issue by either lowering the priority of the legitimate root bridge or removing the rogue device.

Correlate with `show spanning-tree root` to confirm the current root bridge. If the root is unexpected, the inconsistent port is likely the cause. Also, `show logging` may reveal messages like '%SPANTREE-2-ROOTGUARD_BLOCK: Root guard blocking port GigabitEthernet0/1 on VLAN 1.' This log message is a clear indicator.

In summary, root guard troubleshooting is straightforward: identify inconsistent ports, trace the source of superior BPDUs, and take corrective action.

CCNA Exam Tips

Root guard is configured on a per-port basis and prevents the port from becoming a root port; it does not affect BPDU forwarding.

If a port with root guard receives a superior BPDU, it enters a root-inconsistent state (blocking) until the superior BPDUs stop.

Root guard is typically used on ports that should never be the root port, such as access ports or ports connecting to end devices.

The exam may ask you to distinguish root guard from BPDU guard: BPDU guard shuts down the port (errdisable) if any BPDU is received, while root guard only reacts to superior BPDUs.

Common Mistakes

Confusing root guard with BPDU guard; root guard does not disable the port on BPDU reception, only on superior BPDUs.

Applying root guard to all ports including uplinks, which can cause unnecessary blocking if the root bridge changes.

Forgetting that root guard must be configured on the port where the unwanted root bridge might appear, not on the root bridge itself.

spanning-tree guard root vs show spanning-tree

While both commands relate to Spanning Tree Protocol, 'spanning-tree guard root' is a configuration command that enforces root protection on a specific interface, whereas 'show spanning-tree' is a diagnostic command that displays the STP state. They are often paired when troubleshooting STP issues, as one sets protection and the other verifies its effect.

Aspect	spanning-tree guard root	show spanning-tree
Scope	Per-interface (Gi0/1, etc.)	Global or per-VLAN
Configuration mode	Interface Configuration	Privileged EXEC (show command)
Persistence	Persists in running-config	Output only, not saved
Precedence / Effect	Prevents port from becoming root port	Reads current STP state; no effect
Typical use	Protect against rogue root bridge	Verify root bridge, port roles, topology

Use spanning-tree guard root when you need to enforce that a specific switch port never becomes the root port, typically on ports facing untrusted or external networks.

Use show spanning-tree when you need to view the current STP status, such as root bridge ID, port roles, and states, for troubleshooting or verification.

Platform Notes

In IOS-XE (e.g., Catalyst 9000 series), the `spanning-tree guard root` command syntax and behavior are identical to classic IOS. The output of `show spanning-tree inconsistentports` is also the same. However, in NX-OS (e.g., Nexus switches), root guard is not supported as a separate command.

Instead, NX-OS uses Bridge Assurance and BPDU guard for similar protection. The equivalent in NX-OS is to configure `spanning-tree bpduguard` on edge ports, but this err-disables the port upon receiving any BPDU, which is more aggressive. For root guard-like functionality, NX-OS relies on the root bridge being configured with a low priority and using BPDU filter on access ports.

In ASA (Adaptive Security Appliance), STP is not typically used; instead, ASA uses redundant interfaces and failover. Therefore, root guard is not applicable. In IOS-XR (e.g., ASR 9000), the command `spanning-tree guard root` is available in some versions, but the syntax may vary slightly; for example, it might be under `spanning-tree mst` or `spanning-tree vlan` context.

Always check the specific platform documentation. For IOS versions, the command has been available since at least IOS 12.0 and remains consistent in 15.x and 16.x. There are no significant behavioral differences across these versions.

One nuance: on some older IOS versions, root guard could only be applied to ports in VLAN 1; later versions support per-VLAN root guard using `spanning-tree vlan <vlan> guard root`. This per-VLAN variant is useful when multiple VLANs are trunked on a single port.

Related Commands

show spanning-tree

Displays the Spanning Tree Protocol (STP) state and configuration for all VLANs or a specific VLAN, used to verify root bridge, port roles, and STP topology.

Practice for the CCNA 200-301

Test your knowledge with practice questions covering all CCNA 200-301 exam domains.

Practice CCNA 200-301 Questions