Lab Objective
Trigger a port security violation causing a port to enter err-disabled state, manually recover it once, then configure automatic errdisable recovery so future violations of the same type recover on their own after a configurable timeout.
Lab Purpose
A port placed into err-disabled state, discussed earlier in this series regarding port security, stays down until an administrator manually cycles it with shutdown and no shutdown. In environments where the same transient trigger (such as a brief power blip causing a spurious violation) occurs occasionally, automatic recovery avoids unnecessary help desk tickets and downtime.
Lab Topology
Switch1 ---- Gi1/0/5 ---- PC (port security configured,
maximum 1 MAC address)Task 1: Configure Port Security
Configure Gi1/0/5 with port security allowing a maximum of 1 MAC address, with a violation action of shutdown.
Task 2: Trigger the Violation
Connect a second device (or simulate a second MAC address) on the same port to trigger a security violation.
Task 3: Verify the Port Is Err-Disabled
Confirm the port shows an err-disabled status.
Task 4: Manually Recover the Port
Manually cycle the port to restore it.
Task 5: Configure Automatic Errdisable Recovery
Configure the switch to automatically recover ports from err-disabled state caused by port security violations after 300 seconds.
Task 6: Verify Automatic Recovery Configuration
Trigger the violation again and confirm the port automatically returns to service after the configured interval without manual intervention.
Solution and Verification
Switch1(config)# interface gigabitethernet1/0/5
Switch1(config-if)# switchport mode access
Switch1(config-if)# switchport port-security
Switch1(config-if)# switchport port-security maximum 1
Switch1(config-if)# switchport port-security violation shutdown
Switch1(config-if)# switchport port-security mac-address sticky-- A second device connects to Gi1/0/5
Switch1# show interfaces gigabitethernet1/0/5 status
Gi1/0/5 err-disabled
Switch1# show port-security interface gigabitethernet1/0/5 | include Violation
Security Violation Count : 1Switch1(config)# interface gigabitethernet1/0/5
Switch1(config-if)# shutdown
Switch1(config-if)# no shutdown
Switch1# show interfaces gigabitethernet1/0/5 status
Gi1/0/5 connectedSwitch1(config)# errdisable recovery cause psecure-violation
Switch1(config)# errdisable recovery interval 300Switch1# show errdisable recovery
ErrDisable Reason Timer Status
psecure-violation Enabled
Timer interval: 300 seconds-- The violation is triggered again
Switch1# show interfaces gigabitethernet1/0/5 status
Gi1/0/5 err-disabled
-- After waiting 300 seconds, with no manual
-- intervention:
Switch1# show interfaces gigabitethernet1/0/5 status
Gi1/0/5 connected
-- The port automatically recovered without
-- requiring shutdown / no shutdownKey Takeaway
Errdisable recovery must be enabled per specific cause (psecure-violation, bpduguard, and others each have their own independent recovery setting) rather than globally for every possible err-disable trigger, giving an administrator precise control over which specific failure types are allowed to self-heal versus which should always require manual investigation.