SecurityGlobal Config

errdisable recovery interval [secs]

Configures the time interval after which a port disabled due to an error-disabled condition will automatically be re-enabled.

Syntax·Global Config
errdisable recovery interval [secs]

When to Use This Command

  • When a port goes into errdisable state due to a security violation (e.g., port security) and you want it to recover automatically after a set time.
  • When a port is disabled due to a loop detection (e.g., BPDU guard) and you want it to come back up without manual intervention.
  • When you have a large network and want to minimize downtime by automatically recovering ports that were disabled due to transient errors.
  • When you want to standardize recovery time across all errdisable causes to a specific value (e.g., 300 seconds).

Command Examples

Set errdisable recovery interval to 300 seconds

errdisable recovery interval 300
Switch(config)# errdisable recovery interval 300
Switch(config)#

The command is entered in global configuration mode. No output is displayed if successful. The interval is set to 300 seconds (5 minutes).

Verify errdisable recovery interval configuration

show errdisable recovery
ErrDisable Reason                    Timer Status
---------------------------------  -------------
arp-inspection                      Disabled
bpduguard                           Enabled
channel-misconfig (STP)             Disabled
dhcp-rate-limit                     Disabled
dtp-flap                            Disabled
gbic-invalid                        Disabled
l2ptguard                           Disabled
link-flap                           Disabled
loopback                            Disabled
mac-limit                           Disabled
psecure-violation                   Enabled
security-violation                  Enabled
sfp-config-mismatch                 Disabled
storm-control                       Disabled
udld                                Disabled
vmps                                Disabled

Timer interval: 300 seconds

Port    ErrDisable reason    Time left (seconds)
------  -------------------  -------------------
Gi0/1   psecure-violation    245
Gi0/2   bpduguard            120

The 'Timer interval' line shows the configured recovery interval (300 seconds). The 'Timer Status' column indicates whether recovery is enabled for each errdisable reason. The bottom table lists currently disabled ports, the reason they were disabled, and the remaining time before automatic recovery.

Understanding the Output

The 'show errdisable recovery' command displays two main sections. The first section lists all possible errdisable reasons and whether recovery is enabled for each (Enabled/Disabled). The second section shows the configured timer interval in seconds. Below that, a table lists currently error-disabled ports, their errdisable reason, and the time left (in seconds) before automatic recovery. A 'Time left' of 0 means the port is about to recover. If a port does not appear, it is not in errdisable state. Good values for the interval are typically between 30 and 86400 seconds; common choices are 300 (5 minutes) or 600 (10 minutes). Watch for ports that repeatedly enter errdisable state, indicating a persistent issue that should be investigated.

CCNA Exam Tips

1.

CCNA exam tip: Remember that the default errdisable recovery interval is 300 seconds, but recovery must also be enabled for the specific cause (e.g., 'errdisable recovery cause psecure-violation').

2.

CCNA exam tip: The 'show errdisable recovery' command shows both the interval and per-cause status. You may be asked to identify which causes have recovery enabled.

3.

CCNA exam tip: A common exam scenario is a port that goes into errdisable due to port security violation. You must enable recovery for 'psecure-violation' and set the interval.

4.

CCNA exam tip: The 'errdisable recovery interval' command does not enable recovery for any cause by itself; you must also use 'errdisable recovery cause <cause>' for each desired cause.

Common Mistakes

Mistake 1: Setting the interval but forgetting to enable recovery for the specific cause (e.g., 'errdisable recovery cause psecure-violation'). The port will remain disabled.

Mistake 2: Setting the interval too low (e.g., 10 seconds) causing rapid flapping if the underlying issue persists.

Mistake 3: Not verifying the configuration with 'show errdisable recovery' and assuming recovery is working.

Practice for the CCNA 200-301

Test your knowledge with hundreds of CCNA practice questions covering all exam domains.

Practice CCNA Questions