DEMO: Root Guard

When you don't want a root bridge on one side

In almost all cases we're going to want to make sure that all of our switches on a network participate in spanning tree protocol. However, there are times when there are sections of our network that we want to make sure don't have any root bridges that are part of that section of the network, and in that case we might use a root guard to protect against that.

This is a real simplified version of one of the networks that I administered. We used an internet service provider who had a switch inside of our building, which was connected to other switches. It was a loop, so it was connected to other switches throughout the whole city, and a bunch of different clients were connected to these switches. We had our own switch that was connected into their switch, then our firewall, and then I had my core switch, and so this allowed me to connect other devices into here and have it directly connected to the outside world.

There are some advantages to this setup, but in this we would want to make sure that spanning tree protocol was working across here. The internet service provider would want to make sure that this switch right here didn't become the root bridge. It wouldn't be good for this switch to become the root bridge, and since it's my equipment that I'm working on, I could go on there and change the priority of this root bridge to take over the rest of the network, which would not be a good scenario right there. So they want to protect against me being able to take over that root bridge. This is where that scenario might be, that they create some sort of block on this port that I'm connected to, that is a root guard, which guards against something on this side of the port becoming a root bridge.

BPDU guard versus root guard

A question that often comes up is, what is the difference between a BPDU guard and a root guard? They serve very different purposes.

A BPDU guard is really for access ports, and it's to protect those ports that have PortFast turned on on it, so that way if it does receive any BPDU, then what is going to happen is it will disable that port, and then you have to manually go in there and shut down that port and turn it back on. So these are for ports that are never going to participate in STP.

The root guard really is for trunk ports, or really just ports that are connected to other switches, whether it's a trunk port or just a regular port, and that it still needs to participate in STP. But if it receives some sort of BPDU that has a superior root bridge on it, that is something on that side of the network that will put a root bridge on the wrong side of the network, then what will happen is it will go into a block state. Then this port will automatically recover once the situation has been fixed, that is, once it stops receiving superior BPDUs. Then it will automatically recover from this.

Another scenario

Let's come up with one other scenario so that we make sure that we really understand what root guards are. Here we have a network, and let's say switch three and four are my access switches, connected to a bunch of end devices here. Switch one and two are the ones that are connected to the outside world, so that's what leads to the internet and everything else.

Perhaps what I want to do is make sure that these two switches never can be the root bridge in this scenario, and that these switches are. There are ways I can engineer this: I can change the priority of these switches so they are always going to be the root bridge. But one other step that I could take with this is, on these interfaces right here I can put root guard on these interfaces, and now this side of the network will never have a root bridge within this network.

The commands

The commands for this are quite simple. What I'm going to do is get into the global configuration mode, so we're in the global configuration mode, and then I need to get into one of my interfaces, so 1043, to get in and configure this one. The command is spanning-tree guard root, and I can hit enter, and then that's turned on on there. If I want to turn it back off, all I have to do is the same command with the no in front of it, and then I can turn it back off.

Spanning tree protocol attacks

Now, there is something called a spanning tree protocol attack. Essentially somebody can plug into your network and claim that they have a superior BPDU, or a superior root bridge, thereby becoming the root bridge for the network. Network traffic gets generally forwarded on into that direction of the root bridge, and so therefore then they can carry out some sort of eavesdropping attack, denial of service attack, machine-in-the-middle attack, some way of capturing data that they're not supposed to have. So this can be problematic.

There are a couple of ways that we can mitigate this. One is through a BPDU guard: you put that on all of your access ports, so if a device plugs into there and some sort of BPDUs is sent out, it will shut off that port, therefore that is not a very effective attack. There's also this root guard here, so if we put root guards, let's say if we put them right here on this switch right here, then it could never accept that as well, and so this would never become the root.

Now, I will tell you that there's a strong possibility that you get a question on the CCNA certification exam that asks you how do you guard against these STP attacks, and my solution for it is BPDU guard. This is what I use to protect: I put all my access ports into this BPDU guard to make sure that they're shut down if there is any issue. If it is shut down, then I have to manually go and bring it back up, and I'll see why it's been shut down and be able to do some investigation with it. However, there are a lot of sources on the internet that suggest that root guard is the actual answer to that, and maybe rightfully so, because you're guarding against some other device becoming the root bridge of the network. But it's not the way I would implement it on my network.