Cisco IE 4000, Software Configuration Manual

Page: 364 / 1066

360
Configuring Optional Spanning-Tree Features
Information About Configuring the Optional Spanning-Tree Features
EtherChannel Guard
You can use EtherChannel guard to detect an EtherChannel misconfiguration between the switch and a connected
device. A misconfiguration can occur if the switch interfaces are configured in an EtherChannel, but the interfaces on the
other device are not. A misconfiguration can also occur if the channel parameters are not the same at both ends of the
EtherChannel.
If the switch detects a misconfiguration on the other device, EtherChannel guard places the switch interfaces in the
error-disabled state, and displays an error message.
You can enable this feature by using the spanning-tree etherchannel guard misconfig global configuration command.
Root Guard
The Layer 2 network of a service provider (SP) can include many connections to switches that are not owned by the SP.
In such a topology, the spanning tree can reconfigure itself and select a
customer switch as the root switch, as shown in
Figure 51 on page 361 . You can avoid this situation by enabling root guard on SP switch interfaces that connect to
switches in your customer’s network. If spanning-tree calculations cause an interface in the customer network to be
selected as the root port, root guard then places the interface in the root-inconsistent (blocked) state to prevent the
customer’s switch from becoming the root switch or being in the path to the root.
If a switch outside the SP network becomes the root switch, the interface is blocked (root-inconsistent state), and
spanning tree selects a new root switch. The customer’s switch does not become the root switch and is not in the path
to the root.
If the switch is operating in multiple spanning-tree (MST) mode, root guard forces the interface to be a designated port.
If a boundary port is blocked in an internal spanning-tree (IST) instance because of root guard, the interface also is
blocked in all MST instances. A boundary port is an interface that connects to a LAN, the designated switch of which is
either an IEEE 802.1D switch or a switch with a different MST region configuration.
Root guard enabled on an interface applies to all the VLANs to which the interface belongs. VLANs can be grouped and
mapped to an MST instance.
You can enable this feature by using the spanning-tree guard root interface configuration command.
Caution: Misuse of the root guard feature can cause a loss of connectivity.