Configure the Root Guard

You can enable the root guard on a per-port basis. If enabled on a port, the switch ignores superior BPDUs received on that port and blocks that port. The port reverts back to the forwarding state automatically after the port stops receiving superior BPDUs. You must configure the port as a trunk port before you enable the root guard on the interface. By default, the root guard is disabled.

1. Enter Configuration mode for the interface.

   SEFOS# configure terminal
   SEFOS(config)# interface extreme-ethernet 0/1
   

2. Configure the port as a trunk port.

   SEFOS(config-if)# switchport mode trunk
   

3. Enable the root guard on the port.

   SEFOS(config-if)# spanning-tree guard root
   SEFOS(config-if)# end
   

4. Review the root guard output on the port.

   SEFOS# show spanning-tree interface extreme-ethernet 0/1 rootguard
    
   Root Guard  is Enabled
   

5. Disable the root guard on the interface.

   SEFOS# configure terminal
   SEFOS(config)# interface extreme-ethernet 0/1
   SEFOS(config-if)# no spanning-tree guard
   SEFOS(config)# end
   TOR-1 SEFOS#