System Networking: ERR-DISABLED PORT STATE

ERR-DISABLED PORT STATE

Errdisable is a feature that automatically disables a port on a Cisco Catalyst switch. When a port is error disabled, it is effectively shut down and no traffic is sent or received on that port.

The error disabled feature is supported on most Catalyst switches running the Cisco IOS software. Including all the following models:

Catalyst 2940 / 2950 / 2960 / 2960S
Catalyst 3550 / 3560 / 3560-E / 3750 / 3750-E
Catalyst 4000 / 4500 / 4507R
Catalyst 6000 / 6500

The Errdisable error disable feature was designed to inform the administrator when there is a port problem or error. The reasons a catalyst switch can go into Errdisable mode and shutdown a port are many and include:

Duplex Mismatch
Loopback Error
Link Flapping (up/down)
Port Security Violation
Unicast Flodding
UDLD Failure
Broadcast Storms
BPDU Guard

When a port is in error-disabled state, it is effectively shut down and no traffic is sent or received on that port. The port LED is set to the orange color and, when you issue the show interfaces command, the port status shows as Errdisabled.

Following is an example of what an error-disabled port looks like:

To recover a port that is in an Errdisable state, manual intervention is required, and the administrator must access the switch and configure the specific port with 'shutdown' followed by the 'no shutdown' command. This command sequence will enable the port again, however, if the problem persists expect to find the port in Errdisable state again soon.

As outlined above, there are a number of reasons a port can enter the Errdisable state. One common reason is the Port Security error, also used in our example below.

Of all the errors, Port Security is more a feature rather than an error. Port Security allows the restriction of MAC Addresses on an interface configured as a layer 2 port. This effectively prevents others connecting unwanted hubs or switches on the network. Port Security allows us to specify a single MAC Address to be connected to a specific port, thus restricting access to a specific computer.

In the case of a violation, Port Security will automatically disable the port. This is the behaviour of the default port security policy when enabling Port Security. Following is a configuration example of port security:

Topology: