Network Security Articles
Cisco KnowledgeBase Cisco Switches Err-disabled Port State, Enable & Disable Autorecovery Feature
| Err-disabled Port State, Enable & Disable Autorecovery Feature |
 |
 |
| Written by Administrator |
| Wednesday, 25 July 2012 00:00 |
Errdisable is a feature that automatically disables a port on a Cisco Catalyst switch and is supported on most Catalyst switches running the Cisco IOS software. Including all the following models:
The Errdisable error disable feature was designed to inform the administrator when there is a port problem or error. The reasons a catalyst switch can go into Errdisable mode and shutdown a port are many and include:
When a port is in error-disabled state, it is effectively shut down and no traffic is sent or received on that port. The port LED is set to the orange color and, when you issue the show interfaces command, the port status shows as Errdisabled. Following is an example of what an error-disabled port looks like: 2960G# show interface gigabit0/7
To recover a port that is in an Errdisable state, manual intervention is required, and the administrator must access the switch and configure the specific port with 'shutdown' followed by the 'no shutdown' command. This command sequence will enable the port again, however, if the problem persists expect to find the port in Errdisable state again soon.
Understanding and Configuring Errdisable AutoRecoveryAs outlined above, there are a number of reasons a port can enter the Errdisable state. One common reason is the Port Security error, also used in our example below. Of all the errors, Port Security is more a feature rather than an error. Port Security allows the restriction of MAC Addresses on an interface configured as a layer 2 port. This effectively prevents others connecting unwanted hubs or switches on the network. Port Security allows us to specify a single MAC Address to be connected to a specific port, thus restricting access to a specific computer. In the case of a violation, Port Security will automatically disable the port. This is the behaviour of the default port security policy when enabling Port Security. Following is a configuration example of port security: 2960G(config)# interface GigabitEthernet0/48
Once a host is connected to the port, we can get more information on its port-security status and actions that will be taken when a violation occurs: 2960G# show port-security interface GigabitEthernet 0/48Note that the Violation Mode is set to Shutdown. This means that when a violation is detected, the switch will place gigabitethernet 0/48 in the err-disable shutdown state as shown below:%PORT_SECURITY-2-PSECURE_VIOLATION: Security violation occurred, caused by MAC address 0031.f6ac.03f5 on port GigabitEthernet0/48While it's almost always necessary to know when a port security violation occurs there are some circumstances where autorecovery is a desirable feature, especially durng accidental violations. The following commands enable the autorecovery feature 30 seconds after a port security violation: Determine the Reason for the Errdisabled StateTo view the Errdisabled reasons, and see for which reason the autorecovery feature has been enabled, use the show Errdisable recovery command:2960G# show errdisable recoveryWe have now confirmed that autorecovery is enabled for port-security violations. 2960G(config)# errdisable recovery cause all
To test our configuration we forced a port security violation, causing the switch to place the offending port in the shutdown state. Notice we've enabled autorecovery for all Errdisable reasons and the time left to enable the interfaces placed in shutdown state by the port security violation: 2960G# show errdisable recoverySeventeen seconds later, the switch automatically recovered from the port security violation and re-enabled the interface: Disabling The Errdisable FeatureThere are cases where it might be necessary to disable the Errdisable mechanism for specific supported features in order to overcome constant interface shutdowns and auto recoveries. While the Catalyst IOS does not allow disabling all features we can still fine-tune the mechanism and selectively disable a few.To view the Errdisable reasons monitored by the switch, use the show Errdisable detect command: 2960G# show errdisable detectinline-power Enabled portport-mode-failure Enabled portsfp-config-mismatch Enabled portAs shown, the command lists all supported Errdisable reasons. For our example, let's assume we want to disable the inline-power Errdisable feature. To achieve this, we simply use the following command: And verify that Errdisable has been disabled for the feature: 2960G# show errdisable detectOverall, the Errdisable feature is an extremely useful tool if configured and monitored correctly. Take the necessary time to play around with the supported options of your Cisco Catalyst switch and fine-tune it to suit your network needs. Related Articles
|
| Last Updated on Sunday, 29 July 2012 16:45 |
