STP Root GuardSTP Root Guard

Standard STP lacks mechanisms that allow network administrators to securely manage the topology of a Layer 2 switched network. This capability is vital in scenarios where multiple administrative bodies or companies jointly govern a single network. Typically, the network topology depends on the placement of the root bridge, influenced by several factors including its location. For optimal performance, it is preferable to position the root bridge within the distribution or core network layer. However, in standard STP, any bridge possessing the lowest bridge ID becomes the root bridge by default, thereby stripping administrators of the ability to specify its location.

標準 STP 缺乏能讓網路管理員安全管理第 2 層交換式網路拓樸的機制。在多個管理單位或公司共同治理同一個網路的情境中，這項能力格外重要。一般而言，網路拓樸取決於根橋接器的位置，而根橋接器的位置又受多項因素影響，包括其所在地。為求最佳效能，最好將根橋接器放在分佈層或核心層網路中。然而，在標準 STP 中，任何擁有最低橋接器 ID 的橋接器預設就會成為根橋接器，導致管理員無法自行指定其位置。

Take a look at an example illustrating the problem of how a rogue root bridge can disrupt network operations, and how the root guard feature can mitigate such issues. In the network core, Switches A and B operate with A designated as the root bridge for a VLAN. Switch C functions at the access layer, with the link from B to C blocked on C's end, as depicted by the direction of STP BPDUs.

來看一個範例，說明流氓根橋接器（rogue root bridge）如何擾亂網路運作，以及 root guard 功能如何緩解這類問題。在網路核心中，交換器 A 與 B 運作，且 A 被指定為某個 VLAN 的根橋接器。交換器 C 位於存取層，從 B 到 C 的鏈路在 C 端被阻斷，如 STP BPDU 的方向所示。

If switch D starts to participate in STP and has a priority equal to or lower than the existing root bridge, it could become the new root bridge. Assuming the link between Switch A and B is 10 Gbps and links from both A to C and B to C are 1 Gbps, electing D as the root could force the 10 Gbps Ethernet link connecting the core switches to block.

如果交換器 D 開始參與 STP，且其優先權等於或低於現有的根橋接器，它就可能成為新的根橋接器。假設交換器 A 與 B 之間的鏈路是 10 Gbps，而 A 到 C 以及 B 到 C 的鏈路都是 1 Gbps，若選出 D 作為根橋接器，可能會迫使連接核心交換器的 10 Gbps 乙太網路鏈路轉為阻斷。

This blockage would reroute all VLAN data through a 1 Gbps link at the access layer, potentially leading to data overflow on this link, dropping frames, and resulting in significant performance degradation or connectivity issues.

這樣的阻斷會使所有 VLAN 資料改走存取層的 1 Gbps 鏈路，可能導致該鏈路資料溢出、框架遺失，並造成嚴重的效能下降或連線問題。

Root guard provides protection against such disruptions by preventing any port from becoming an STP root port. It maintains the port as STP-designated, ignoring any superior BPDUs that might suggest electing a new STP root. Instead, root guard transitions the port to a root-inconsistent STP state. It is crucial to enable root guard on all ports where the root bridge's presence is undesirable, effectively setting boundaries for where the STP root can exist.

Root guard 可防止連接埠成為 STP 根埠，藉此提供對抗這類干擾的保護。它會讓連接埠維持在 STP 指定埠狀態，忽略任何可能建議選出新 STP 根橋接器的優越 BPDU。相反地，root guard 會將該連接埠轉為根不一致（root-inconsistent）STP 狀態。在不希望根橋接器出現的所有連接埠上啟用 root guard 至關重要，這實際上等於為 STP 根橋接器的存在範圍設定了界限。

For instance, enabling root guard on the port at Switch C that connects to Switch D is advisable. Upon detecting a superior BPDU, Switch C would block the port, moving it to a root-inconsistent state and stopping all traffic. Once Device D stops sending superior BPDUs, the port becomes unblocked, transitioning from the listening state to the learning state, and finally, to the forwarding state. This recovery is automatic, requiring no manual intervention.

舉例來說，在交換器 C 連接交換器 D 的連接埠上啟用 root guard 是明智的做法。一旦偵測到優越的 BPDU，交換器 C 就會阻斷該連接埠，將其轉為根不一致狀態並停止所有流量。一旦裝置 D 停止傳送優越的 BPDU，該連接埠就會解除阻斷，從聆聽狀態轉為學習狀態，最後進入轉送狀態。這個復原過程是自動的，不需要人工介入。

When root guard activates, the following message is displayed:

當 root guard 啟動時，會顯示以下訊息：