Root Guard stabilizes spanning-tree topology by preventing an external switch from becoming the root bridge. A protected port that receives a superior BPDU enters the root-inconsistent state and stops forwarding. section 15.4.1
Service-provider protection
A service provider applies Root Guard toward a customer network. If the customer switch advertises a lower bridge ID, the protected port blocks it. Configure the interface with spanning-tree guard root; show spanning-tree reports BKN and ROOT_Inc. section 15.4.1
