Configuring restricted-role

When a port is configured with restricted-role, the port cannot be root port. The spanning tree information received on the configured port is subjected to role selection. If the received information is superior, then the port will be selected as alternate port or backup port. If the received information is inferior, then the port will be selected as designated port. By default, the restricted-role feature is disabled. In case of provider bridges, restricted role is enabled for all customer network ports.

  1. Execute the following show command to view the restricted-role status.

    Type the following:

    iS5comm# show spanning-tree detail
    Spanning tree Protocol Enabled.
    MST00 is executing the mstp compatible Multiple Spanning Tree Protocol
    Bridge Identifier has Priority 32768, Address 00:01:02:03:04:01
    Configured  Max age 20 sec 0 cs,  Forward delay 15 sec 0 cs
    Configured Hello Time 2 sec 0 cs
    We are root of the spanning tree
    Current Root has priority 32768, address  00:01:02:03:04:01
    cost of root path is 0
    Number of Topology Changes 1, Time since topology Change 100 seconds ago
    Transmit Hold-Count 9
    Root Times : Max age 20 sec 0 cs     Forward delay 15 sec 0 cs
    Port 1 [Gi0/1] of MST00 is Designated, Forwarding
    Gi0/1 is operating in the MSTP Mode
    Port path cost  2000000, Port priority  128,
    Port Identifier  128.1. Port HelloTime  2 sec 0 cs,
    Timers:Hello - 1,Forward Delay - 0,Topology Change - 0
    Designated root has priority 32768, address 00:01:02:03:04:05
    Designated Bridge has priority 32768, address 00:01:02:03:04:05
    Designated Port Id is 128.1, Designated pathcost is 0
    Operational Forward delay 15 sec 0 cs, Max age 20 sec 0 cs
    Number of Transitions to forwarding State: 6
    PortFast is enabled
    Link type is point to Point
    BPDUs : sent 112, received 994
    Restricted Role is disabled.
    Restricted TCN is disabled.
  2. Execute the following commands to configure the root-guard / restricted role feature on the port in both the switches.

    Type the following:

    • Enter the Global Configuration Mode.
    iS5comm(config)# interface gigabitethernet 0/1
    iS5comm(config-if)# spanning-tree restricted-role
    iS5comm(config-if)# end
    • View the restricted role configuration using the following command.
    iS5comm# show spanning-tree detail
    Spanning tree Protocol Enabled.
    MST00 is executing the mstp compatible Multiple Spanning Tree Protocol
    Bridge Identifier has Priority 32768, Address 00:01:02:03:04:01
    Configured  Max age 20 sec 0 cs,  Forward delay 15 sec 0 cs
    Configured Hello Time 2 sec 0 cs
    We are root of the spanning tree
    Current Root has priority 32768, address  00:01:02:03:04:01
    cost of root path is 0
    Number of Topology Changes 1, Time since topology Change 100 seconds ago
    Transmit Hold-Count 9
    Root Times : Max age 20 sec 0 cs     Forward delay 15 sec 0 cs
    Port 1 [Gi0/1] of MST00 is Designated, Forwarding
    Gi0/1 is operating in the MSTP Mode
    Port path cost  2000000, Port priority  128,
    Port Identifier  128.1. Port HelloTime  2 sec 0 cs,
    Timers:Hello - 1,Forward Delay - 0,Topology Change - 0
    Designated root has priority 32768, address 00:01:02:03:04:05
    Designated Bridge has priority 32768, address 00:01:02:03:04:05
    Designated Port Id is 128.1, Designated pathcost is 0
    Operational Forward delay 15 sec 0 cs, Max age 20 sec 0 cs
    Number of Transitions to forwarding State: 6
    PortFast is enabled
    Link type is point to Point
    BPDUs : sent 112, received 994
    Restricted Role is enabled.
    Restricted TCN is disabled.
    • Execute the no spanning-tree restricted-role Interface Configuration mode command to disable the root-guard / restricted role feature on the port.
    iS5comm(config-if) # no spanning-tree restricted-role
Parent topic: Configuring RSTP and MSTP