Simple definition
Root Guard is a Spanning Tree protection feature that prevents a specific port from becoming a path toward an unexpected root bridge.
Technical definition
The feature is enabled on ports where superior BPDUs should never be accepted. If such a BPDU is received, the port enters a root-inconsistent state and stops forwarding traffic until the condition disappears.
How it works / role
The switch compares received BPDUs with the current STP election. A BPDU that would introduce a better root triggers the protective block. When those superior BPDUs stop, the port can automatically return to the normal STP topology.
What is it used for?
Keep the root bridge on the intended devices and prevent a misconfigured access switch from changing the STP topology.
Practical example
On a downstream port connected to a third-party switch, Root Guard blocks the port if that switch starts advertising a better STP priority than the network core.
Common issues
- Root Guard is enabled where a legitimate root change is possible
- Port remains root-inconsistent because superior BPDUs are still received
- STP priorities are poorly planned
- Confusion between Root Guard and BPDU Guard
Related terms
STP · BPDU Guard · Switch
Key takeaway: Root Guard protects the STP root position; BPDU Guard serves a different purpose and should not be treated as the same feature.