What is Root Guard?
Root Guard prevents a port from becoming a Root Port.
Which problem does it solve?
Protects against:
- A wrongly placed Root Bridge
- An access/distribution switch winning the root election
What happens technically?
- The port receives a BPDU that is “better” than the current root
- The port is put into root-inconsistent
- No traffic is forwarded
- When the superior BPDU stops → the port reopens automatically
Where is it used?
- Downlinks from the Root Bridge (root → distribution/access)
Pitfalls 🚨
- Must not be used on access ports
- Protects not against loops
One-liner: Root Guard protects the power – not the topology