Enable root guard on port channel interface or individual links?

[RB6502]

Regarding the port-channels, should I enable root guard on the individual interfaces that make up the port-channels or on the port-channels themselves?

[David Ruess · Accepted solution]

Hello,

The configuration should be put on the port channel since the STP instance runs on the port channel and not the individual interfaces.

As a backup you could also enter it on the individual ports. If any port falls out of the port channel (while other mechanisms can also be in place to prevent issues) then it wont allow a root bridge out that single port that left the etherchannel.

-David