errdisable recovery cause psecure-violation
Enables automatic recovery of ports that have been error-disabled due to port security violation (psecure-violation), allowing them to come back up after a specified timeout without manual intervention.
Definition: errdisable recovery cause psecure-violation is a Cisco IOS global config command. Enables automatic recovery of ports that have been error-disabled due to port security violation (psecure-violation), allowing them to come back up after a specified timeout without manual intervention.
Overview
The `errdisable recovery cause psecure-violation` command is a global configuration command on Cisco IOS devices that enables automatic recovery of switch ports placed in an error-disabled state due to a port security violation (psecure-violation). Port security is a Layer 2 security feature that restricts input to a switch port by limiting the MAC addresses allowed to send traffic. When a violation occurs—such as a device with an unauthorized MAC address attempting to communicate—the port can be configured to shut down (error-disable) to prevent potential attacks like MAC flooding.
By default, an error-disabled port remains down until an administrator manually issues the `shutdown` and `no shutdown` commands. This manual intervention can be burdensome in large networks or when temporary violations occur (e.g., a legitimate device is replaced). The `errdisable recovery cause psecure-violation` command automates this recovery, allowing the port to automatically come back up after a configurable timeout (set via `errdisable recovery interval`).
This command is particularly useful in environments where port security is enforced but occasional, non-malicious violations are expected, such as in campus networks with frequent device changes. It fits into the broader network configuration workflow as part of a proactive security posture: you enable port security to protect against unauthorized access, but you also enable automatic recovery to minimize downtime. Without this command, an administrator must manually re-enable each affected port, which can be time-consuming and error-prone.
The command is available in global configuration mode and requires privilege level 15 (enable mode). It does not produce buffered output; it simply modifies the running configuration. The change is immediate and can be saved to startup configuration with `copy running-config startup-config`.
Important IOS behavior: the recovery timer is global and applies to all error-disabled causes that have recovery enabled. The default recovery interval is 300 seconds (5 minutes), adjustable with the `errdisable recovery interval` command. Also, note that the port will only recover if the violation cause is no longer active; if the violating MAC address persists, the port may immediately re-enter error-disable state after recovery.
This command is an alternative to manually re-enabling ports or disabling port security entirely. It is not a substitute for proper security policy; it is a convenience feature to reduce operational overhead. In summary, this command is essential for balancing security and availability in switched networks.
errdisable recovery cause psecure-violationWhen to Use This Command
- In an office environment where users frequently plug in unauthorized devices, causing port security violations; this command allows ports to recover automatically after a timeout, reducing helpdesk tickets.
- In a lab or test network where port security is enabled for learning purposes, but you want ports to recover quickly after intentional violation tests.
- In a production network with strict security policies, but where occasional false positives from legitimate device changes should not require manual re-enabling of ports.
- When deploying port security on a large scale and you want to minimize operational overhead by automating recovery for non-critical violations.
Command Examples
Enable recovery for psecure-violation with default timer
errdisable recovery cause psecure-violationSwitch(config)#errdisable recovery cause psecure-violation Switch(config)#
The command is entered in global configuration mode. No output is shown if successful. The default recovery timer is 300 seconds (5 minutes).
Verify errdisable recovery configuration
show errdisable recoveryErrDisable Reason Timer Status ----------------- ------------- arp-inspection Disabled bpduguard Disabled channel-misconfig (STP) Disabled dhcp-rate-limit Disabled dtp-flap Disabled gbic-invalid Disabled inline-power Disabled link-flap Disabled loopback Disabled mac-limit Disabled psecure-violation Enabled security-violation Disabled storm-control Disabled udld Disabled unicast-flood Disabled vmps Disabled Timer interval: 300 seconds Interfaces that will be enabled at the next timeout:
The 'show errdisable recovery' output displays the status of recovery for each errdisable cause. 'psecure-violation' shows 'Enabled' indicating recovery is active. The 'Timer interval' shows the current recovery timeout (default 300 seconds). The 'Interfaces that will be enabled at the next timeout' line lists interfaces that are currently error-disabled and will be recovered when the timer expires.
Understanding the Output
The primary command 'errdisable recovery cause psecure-violation' does not produce output on success. To verify, use 'show errdisable recovery'. In the output, each errdisable reason is listed with its timer status (Enabled/Disabled).
For psecure-violation, you should see 'Enabled' to confirm recovery is configured. The 'Timer interval' line shows the recovery time in seconds (default 300). The 'Interfaces that will be enabled at the next timeout' section lists interfaces currently in errdisable state due to any enabled cause; these will be automatically re-enabled after the timer expires.
If no interfaces are listed, no ports are currently error-disabled for that reason. A good configuration shows psecure-violation as Enabled; a bad configuration shows Disabled or the timer set too low (causing flapping) or too high (delaying recovery). Watch for interfaces that repeatedly enter errdisable state, indicating a persistent security violation that should be investigated rather than relying on automatic recovery.
Configuration Scenarios
Enable automatic recovery for port security violations on a switch
A network administrator wants to ensure that switch ports error-disabled due to port security violations automatically recover after 5 minutes, reducing manual intervention in a busy campus network.
Topology
Switch1(Gi0/1)---PC1
Switch1(Gi0/2)---PC2Steps
- 1.Step 1: Enter global configuration mode: Switch1> enable
- 2.Step 2: Enter global configuration mode: Switch1# configure terminal
- 3.Step 3: Enable automatic recovery for psecure-violation: Switch1(config)# errdisable recovery cause psecure-violation
- 4.Step 4: (Optional) Set the recovery interval to 300 seconds (default): Switch1(config)# errdisable recovery interval 300
- 5.Step 5: Exit configuration mode: Switch1(config)# end
- 6.Step 6: Verify the configuration: Switch1# show errdisable recovery
! Switch1(config)# errdisable recovery cause psecure-violation Switch1(config)# errdisable recovery interval 300 !
Verify: Use `show errdisable recovery` to verify. Expected output includes 'psecure-violation' listed under 'Causes that have recovery enabled' and the timer interval.
Watch out: If the recovery interval is not set, the default is 300 seconds. Ensure the interval is appropriate for your network; too short may cause flapping if the violation persists.
Configure port security with automatic recovery on an access port
An administrator needs to secure an access port connecting a printer, but the printer may be replaced occasionally. Automatic recovery will prevent the port from staying down after a violation.
Topology
Switch1(Gi0/3)---Printer (MAC: aaaa.bbbb.cccc)Steps
- 1.Step 1: Enter global configuration mode: Switch1> enable
- 2.Step 2: Enter global configuration mode: Switch1# configure terminal
- 3.Step 3: Enable automatic recovery for psecure-violation: Switch1(config)# errdisable recovery cause psecure-violation
- 4.Step 4: Set recovery interval to 600 seconds (10 minutes): Switch1(config)# errdisable recovery interval 600
- 5.Step 5: Enter interface configuration mode: Switch1(config)# interface gigabitEthernet 0/3
- 6.Step 6: Configure port security: Switch1(config-if)# switchport port-security
- 7.Step 7: Set maximum MAC addresses to 1: Switch1(config-if)# switchport port-security maximum 1
- 8.Step 8: Set violation mode to shutdown (default): Switch1(config-if)# switchport port-security violation shutdown
- 9.Step 9: Specify allowed MAC address: Switch1(config-if)# switchport port-security mac-address aaaa.bbbb.cccc
- 10.Step 10: Enable the port (if not already): Switch1(config-if)# no shutdown
- 11.Step 11: Exit and verify: Switch1(config-if)# end
- 12.Step 12: Verify port security: Switch1# show port-security interface gigabitEthernet 0/3
! Switch1(config)# errdisable recovery cause psecure-violation Switch1(config)# errdisable recovery interval 600 Switch1(config)# interface gigabitEthernet 0/3 Switch1(config-if)# switchport port-security Switch1(config-if)# switchport port-security maximum 1 Switch1(config-if)# switchport port-security violation shutdown Switch1(config-if)# switchport port-security mac-address aaaa.bbbb.cccc Switch1(config-if)# no shutdown !
Verify: Use `show port-security interface gigabitEthernet 0/3` to verify port security settings. Use `show errdisable recovery` to confirm recovery is enabled. If a violation occurs, the port will error-disable and automatically recover after 600 seconds.
Watch out: If the violation mode is set to 'restrict' or 'protect', the port does not error-disable, so recovery is not applicable. Ensure violation mode is 'shutdown' for this command to have effect.
Troubleshooting with This Command
When troubleshooting port security violations and automatic recovery, the primary command is `show errdisable recovery`. This command displays all causes for which error-disable recovery is enabled, along with the recovery interval. Healthy output shows 'psecure-violation' listed under 'Causes that have recovery enabled' and the timer interval (default 300 seconds).
If the cause is not listed, recovery is not enabled for that violation type. Another key command is `show interfaces status err-disabled`, which lists all ports currently in error-disabled state and the reason. For example, if a port shows 'err-disabled' with reason 'psecure-viol', it indicates a port security violation.
Use `show port-security interface <interface>` to see the security settings and violation count. If the port is error-disabled and recovery is enabled, check the recovery timer with `show errdisable recovery`. The 'Time left' column shows remaining seconds until recovery.
Common symptoms: a port that repeatedly error-disables and recovers (flapping) suggests a persistent violation—the violating MAC address is still present. In such cases, examine the port-security table with `show port-security address` to identify the offending MAC. If the MAC is legitimate, update the allowed MAC list.
If not, investigate the connected device. Step-by-step diagnostic flow: 1) Identify error-disabled ports: `show interfaces status | include err-disabled`. 2) Determine the cause: `show interfaces status err-disabled`. 3) If cause is psecure-viol, check port security details: `show port-security interface <int>`. 4) Verify recovery is enabled: `show errdisable recovery`. 5) If recovery is enabled but port is not recovering, check the recovery interval and ensure the violation is no longer active. 6) To manually recover a port before the timer expires, use `shutdown` followed by `no shutdown` on the interface. Correlate with `debug errdisable recovery` to see recovery events in real time (use with caution in production).
Also, `show logging` may reveal syslog messages about error-disable and recovery. Remember that the `errdisable recovery cause psecure-violation` command only enables recovery; it does not prevent future violations. If the violation persists, the port will error-disable again immediately after recovery.
In such cases, consider increasing the recovery interval or addressing the root cause.
CCNA Exam Tips
CCNA exam tip: Remember that 'errdisable recovery cause psecure-violation' only enables recovery for port security violations; other causes like bpduguard require separate commands.
CCNA exam tip: The default recovery timer is 300 seconds; you can change it with 'errdisable recovery interval <seconds>'.
CCNA exam tip: If a port is error-disabled due to psecure-violation, it will not recover until the timer expires, even if the violation is removed. Use 'shutdown' followed by 'no shutdown' to manually recover immediately.
CCNA exam tip: The exam may test that 'errdisable recovery cause psecure-violation' is configured globally, not per-interface.
Common Mistakes
Mistake: Forgetting to also configure 'errdisable recovery interval' to a value other than default, leading to unexpected recovery times.
Mistake: Enabling recovery for psecure-violation but not having port security configured on any interface, making the command ineffective.
Mistake: Assuming that enabling recovery will prevent future violations; it only automates recovery, not prevention.
errdisable recovery cause psecure-violation vs errdisable recovery interval [secs]
The 'errdisable recovery cause psecure-violation' and 'errdisable recovery interval' commands are commonly used together but serve distinct roles in automatic port recovery. The former enables recovery for a specific error-disable cause (port security violation), while the latter sets the global timer for all enabled recovery causes. Without both configured, automatic recovery will not occur.
| Aspect | errdisable recovery cause psecure-violation | errdisable recovery interval [secs] |
|---|---|---|
| Scope | Enables recovery for psecure-violation cause only | Sets timer for all enabled recovery causes |
| Effect on ports | Ports disabled by psecure-violation cause will auto-recover | Ports disabled by any enabled cause will auto-recover after timer expires |
| Configuration mode | Global configuration | Global configuration |
| Dependency | Requires 'errdisable recovery interval' to be set for recovery to occur | Requires at least one cause enabled via 'errdisable recovery cause' |
| Persistence | Saved to running-config and startup-config | Saved to running-config and startup-config |
Use errdisable recovery cause psecure-violation when you want ports disabled by port security violation to automatically recover without manual intervention.
Use errdisable recovery interval [secs] when you need to control the recovery timeout duration for all error-disabled conditions that have auto-recovery enabled.
Platform Notes
On Cisco IOS-XE (e.g., Catalyst 9000 series), the command syntax and behavior are identical to classic IOS. The `show errdisable recovery` output may include additional fields like 'Recovery time left' in newer versions. On NX-OS (e.g., Nexus switches), the equivalent command is `errdisable recovery cause psecure-violation` as well, but the configuration is applied in global configuration mode.
However, NX-OS uses a different default recovery interval (300 seconds) and the command is available in all versions. On ASA firewalls, port security is not typically used; instead, MAC address filtering is handled via other mechanisms, so this command does not apply. For IOS-XR, the command does not exist; port security is not a feature in IOS-XR.
Behavior differences between IOS versions: In IOS 12.x, the `errdisable recovery` command was introduced; earlier versions required manual recovery. In IOS 15.x and 16.x, the command remains consistent. One nuance: in some IOS versions, the recovery interval must be set before enabling recovery causes; otherwise, the default interval applies.
Always verify with `show errdisable recovery` after configuration. Also, on some platforms, the recovery timer is global and applies to all enabled causes; you cannot set per-cause timers. For Catalyst switches running IOS-XE, the command is fully supported.
Always check the specific platform documentation for any caveats.
Related Commands
Practice for the CCNA 200-301
Test your knowledge with practice questions covering all CCNA 200-301 exam domains.
Practice CCNA 200-301 Questions