where can i config spanning tree root guard

[fly]

Hi dear ALL,

    If i config root guard on root switch , if network is large , any downside switch can cause root switch interface change to block status. this will affect customer important traffic pass through the root switch.

   if i confi root guard feature on access switch,   there are many many access switches,  config task is huge

    if i config two mst instance , one root on 6509-1  the other instance root on 6509-2   how can i config root guard on two switch.  can root guard distinguish between different vlan bpdu priority?

    thank you!

    Jeremy

[rais]

You should enable RootGuard where there is a danger of new switch [with better credentials] to show up. That would be the access switches. Once your network topology is stabilized, any additions to it is where the danger could be.

You can use:

interface range gigabitEthernet 1/1-24

spanning-tree guard root

The best way is to automate your config tasks.

Rais.

[fb_webuser]

spanning-tree guard root

is configured on a switch port to prevent that port from becoming a root port.

Usually you do this when it is a link to a network that you do not control.

If you want to discourage a switch from becoming a root switch use

spanning-tree vlan 1 priority ?

Also take a look at

spanning-tree bpdufilter enable

spanning-tree bpduguard disable

Might be what you are looking for

---

Posted by WebUser Stuart Gall