errdisable recovery interval [secs]
Configures the time interval after which a port disabled due to an error-disabled condition will automatically be re-enabled.
Definition: errdisable recovery interval [secs] is a Cisco IOS global config command. Configures the time interval after which a port disabled due to an error-disabled condition will automatically be re-enabled.
Overview
The `errdisable recovery interval` command is a critical tool for network engineers managing Cisco switches, particularly in environments where port stability and uptime are paramount. Error-disabled (errdisable) states occur when a switch port detects a condition that violates network policies or indicates a potential threat, such as a loop (spanning-tree BPDU guard), a security violation (port security), or a link flap (link-flap error). When a port enters errdisable state, it is automatically shut down to protect the network.
Without automatic recovery, an administrator must manually re-enable the port using `shutdown` followed by `no shutdown`. The `errdisable recovery interval` command automates this process by specifying a time interval (in seconds) after which the switch will attempt to bring the port back online. This is especially useful in large networks where manual intervention is impractical or in scenarios where the cause of the error is transient (e.g., a brief cable fault).
The command is configured globally, and it applies to all ports that are in errdisable state due to any cause that has recovery enabled (via `errdisable recovery cause`). The default recovery interval is 300 seconds (5 minutes), but this can be adjusted to meet operational requirements—shorter intervals for less critical ports, longer intervals to allow more time for the underlying issue to resolve. It is important to note that the recovery interval does not affect ports that are manually shut down; it only applies to ports disabled by an errdisable condition.
The command is available in global configuration mode and requires privileged EXEC access (enable mode). Changes take effect immediately and are saved to the running configuration. When troubleshooting, engineers often combine this command with `show errdisable recovery` to view the current interval and the causes enabled for recovery, and with `show interfaces status err-disabled` to identify affected ports.
The command is part of a broader errdisable recovery framework that includes cause-specific recovery (e.g., `errdisable recovery cause psecure-violation`) and the ability to disable recovery for certain causes. Understanding this command is essential for CCNA and CCNP candidates, as it appears in exam topics related to switch security, STP, and network troubleshooting. In production networks, misconfiguration can lead to repeated flapping of ports if the underlying issue is not resolved, so careful planning and monitoring are required.
The command is supported on most Cisco Catalyst switches running IOS, IOS-XE, and even some older IOS versions, though the exact syntax and available causes may vary slightly. For example, on IOS-XE, the command is identical, but the output of `show errdisable recovery` may include additional fields. On NX-OS, the equivalent command is `errdisable recovery interval` (same syntax) but the causes are configured differently.
The command is not available on IOS-XR, which uses a different error-handling mechanism. Overall, the `errdisable recovery interval` command is a powerful automation tool that reduces administrative overhead and improves network resilience, but it must be used judiciously to avoid masking persistent problems.
errdisable recovery interval [secs]When to Use This Command
- When a port goes into errdisable state due to a security violation (e.g., port security) and you want it to recover automatically after a set time.
- When a port is disabled due to a loop detection (e.g., BPDU guard) and you want it to come back up without manual intervention.
- When you have a large network and want to minimize downtime by automatically recovering ports that were disabled due to transient errors.
- When you want to standardize recovery time across all errdisable causes to a specific value (e.g., 300 seconds).
Parameters
| Parameter | Syntax | Description |
|---|---|---|
| secs | <30-86400> | Specifies the time interval in seconds after which the switch will attempt to recover a port from errdisable state. Valid values range from 30 to 86400 seconds (1 second to 24 hours). The default is 300 seconds. A common mistake is setting the interval too low (e.g., 30 seconds) which may cause rapid flapping if the underlying issue persists, or too high (e.g., 86400 seconds) which defeats the purpose of automatic recovery. Choose a value that balances quick recovery with stability. |
Command Examples
Set errdisable recovery interval to 300 seconds
errdisable recovery interval 300Switch(config)# errdisable recovery interval 300 Switch(config)#
The command is entered in global configuration mode. No output is displayed if successful. The interval is set to 300 seconds (5 minutes).
Verify errdisable recovery interval configuration
show errdisable recoveryErrDisable Reason Timer Status --------------------------------- ------------- arp-inspection Disabled bpduguard Enabled channel-misconfig (STP) Disabled dhcp-rate-limit Disabled dtp-flap Disabled gbic-invalid Disabled l2ptguard Disabled link-flap Disabled loopback Disabled mac-limit Disabled psecure-violation Enabled security-violation Enabled sfp-config-mismatch Disabled storm-control Disabled udld Disabled vmps Disabled Timer interval: 300 seconds Port ErrDisable reason Time left (seconds) ------ ------------------- ------------------- Gi0/1 psecure-violation 245 Gi0/2 bpduguard 120
The 'Timer interval' line shows the configured recovery interval (300 seconds). The 'Timer Status' column indicates whether recovery is enabled for each errdisable reason. The bottom table lists currently disabled ports, the reason they were disabled, and the remaining time before automatic recovery.
Understanding the Output
The 'show errdisable recovery' command displays two main sections. The first section lists all possible errdisable reasons and whether recovery is enabled for each (Enabled/Disabled). The second section shows the configured timer interval in seconds.
Below that, a table lists currently error-disabled ports, their errdisable reason, and the time left (in seconds) before automatic recovery. A 'Time left' of 0 means the port is about to recover. If a port does not appear, it is not in errdisable state.
Good values for the interval are typically between 30 and 86400 seconds; common choices are 300 (5 minutes) or 600 (10 minutes). Watch for ports that repeatedly enter errdisable state, indicating a persistent issue that should be investigated.
Configuration Scenarios
Configure automatic recovery for port-security violations on access ports
A switch has many access ports with port security enabled. When a violation occurs (e.g., unauthorized device connects), the port goes errdisable. To avoid manual re-enablement, the network admin wants automatic recovery after 5 minutes (default). However, they want to ensure only port-security violations trigger recovery, not other causes.
Topology
SW1(Gi0/1)---PC1
SW1(Gi0/2)---PC2
SW1(Gi0/3)---PC3Steps
- 1.Step 1: Enter global configuration mode: SW1# configure terminal
- 2.Step 2: Set the recovery interval to 300 seconds (optional, as default is 300): SW1(config)# errdisable recovery interval 300
- 3.Step 3: Enable recovery for port-security violations: SW1(config)# errdisable recovery cause psecure-violation
- 4.Step 4: (Optional) Verify the configuration: SW1(config)# do show errdisable recovery
- 5.Step 5: Exit configuration mode: SW1(config)# end
! SW1# configure terminal SW1(config)# errdisable recovery interval 300 SW1(config)# errdisable recovery cause psecure-violation SW1(config)# end
Verify: Use `show errdisable recovery` to verify. Expected output includes: 'ErrDisable Reason: psecure-violation, Recovery Interval: 300 seconds' and 'Timer status: Timer is running' (if any port is in errdisable).
Watch out: If you do not explicitly enable recovery for the specific cause (e.g., `psecure-violation`), the port will not recover automatically even if the interval is set. The default recovery causes vary by IOS version; always verify with `show errdisable recovery`.
Adjust recovery interval for link-flap errors on trunk ports
A trunk port between two switches experiences intermittent link flaps due to a faulty cable. The port goes errdisable due to link-flap error. The admin wants to set a longer recovery interval (600 seconds) to allow time for the cable to be replaced, and also enable recovery for link-flap cause.
Topology
SW1(Gi0/24)---(Gi0/24)SW2Steps
- 1.Step 1: Enter global configuration mode: SW1# configure terminal
- 2.Step 2: Set recovery interval to 600 seconds: SW1(config)# errdisable recovery interval 600
- 3.Step 3: Enable recovery for link-flap cause: SW1(config)# errdisable recovery cause link-flap
- 4.Step 4: Verify: SW1(config)# do show errdisable recovery
- 5.Step 5: Save configuration: SW1(config)# end
! SW1# configure terminal SW1(config)# errdisable recovery interval 600 SW1(config)# errdisable recovery cause link-flap SW1(config)# end
Verify: Use `show errdisable recovery` to confirm interval and cause. Also use `show interfaces status err-disabled` to see if any ports are currently errdisabled due to link-flap. Expected: 'ErrDisable Reason: link-flap, Recovery Interval: 600 seconds'.
Watch out: The link-flap cause is not enabled by default. Also, if the underlying issue (e.g., faulty cable) is not fixed, the port will flap again after recovery, potentially causing network instability. Consider using `errdisable recovery cause all` with caution.
Troubleshooting with This Command
When troubleshooting errdisable issues, the `errdisable recovery interval` command is often used in conjunction with other show commands to understand the state of ports and the recovery mechanism. The first step is to identify which ports are in errdisable state using `show interfaces status err-disabled`. This command lists all ports that are currently disabled due to an error condition, along with the cause (e.g., psecure-violation, link-flap, bpduguard).
If a port is errdisabled, the next step is to check the recovery configuration with `show errdisable recovery`. This output shows the recovery interval (in seconds) and which causes are enabled for recovery. A healthy configuration will show the desired interval and the relevant causes enabled.
If a port is not recovering automatically, common issues include: (1) the recovery cause for that specific error is not enabled, (2) the recovery interval has not yet expired (check the timer status: 'Timer is running' indicates a port is waiting to recover), or (3) the port was manually shut down (errdisable recovery does not apply to manual shutdowns). To verify the timer, use `show errdisable recovery | include Timer`. If the timer is not running, no ports are currently in errdisable state waiting for recovery.
Another useful command is `show errdisable detect`, which shows which causes are configured to trigger errdisable. This helps correlate why a port went errdisable in the first place. For example, if a port goes errdisable due to BPDU guard, but recovery is only enabled for port-security, the port will not recover.
The diagnostic flow: 1) Identify errdisabled ports with `show interfaces status err-disabled`. 2) Check the cause. 3) Verify recovery configuration with `show errdisable recovery`. 4) If recovery is not working, ensure the cause is enabled with `errdisable recovery cause <cause>`. 5) If the interval is too short, adjust it. 6) Monitor the port after recovery using `show interfaces <interface>` to see if it comes up and stays up. If the port flaps again, the underlying issue (e.g., loop, security violation) must be resolved. The `debug errdisable recovery` command can be used to see real-time recovery events, but it should be used sparingly in production.
In summary, the `errdisable recovery interval` command is a key part of the troubleshooting toolkit, but it must be paired with cause-specific enablement and a solid understanding of the error conditions.
CCNA Exam Tips
CCNA exam tip: Remember that the default errdisable recovery interval is 300 seconds, but recovery must also be enabled for the specific cause (e.g., 'errdisable recovery cause psecure-violation').
CCNA exam tip: The 'show errdisable recovery' command shows both the interval and per-cause status. You may be asked to identify which causes have recovery enabled.
CCNA exam tip: A common exam scenario is a port that goes into errdisable due to port security violation. You must enable recovery for 'psecure-violation' and set the interval.
CCNA exam tip: The 'errdisable recovery interval' command does not enable recovery for any cause by itself; you must also use 'errdisable recovery cause <cause>' for each desired cause.
Common Mistakes
Mistake 1: Setting the interval but forgetting to enable recovery for the specific cause (e.g., 'errdisable recovery cause psecure-violation'). The port will remain disabled.
Mistake 2: Setting the interval too low (e.g., 10 seconds) causing rapid flapping if the underlying issue persists.
Mistake 3: Not verifying the configuration with 'show errdisable recovery' and assuming recovery is working.
errdisable recovery interval [secs] vs enable password [password]
Both commands are configured in global configuration mode and relate to security, but they address entirely different functions: one controls automatic port recovery from error-disabled conditions, while the other sets a plaintext password for privileged EXEC access. They are commonly confused because they share a similar syntax structure ('errdisable recovery interval' vs. 'enable password') and both are security-related, leading to misapplication if a user mistakenly thinks 'enable' is part of 'errdisable'.
| Aspect | errdisable recovery interval [secs] | enable password [password] |
|---|---|---|
| Purpose | Configures time for automatic port recovery after error-disable | Sets plaintext password for privileged EXEC access |
| Configuration Mode | Global configuration | Global configuration |
| Persistence | Saved to startup-config | Saved to startup-config |
| Security Implication | Reduces manual intervention for port recovery | Provides weak authentication (plaintext); overridden by enable secret |
| Typical Use | When ports must auto-recover from errors like BPDU guard or link-flap | When enable secret is not used and a simple password is acceptable |
Use errdisable recovery interval [secs] when you want ports that have been error-disabled due to security violations or port errors to automatically become active again after a defined timeout, reducing manual recovery efforts.
Use enable password [password] when you need to set a global privileged EXEC password and you are not using the more secure 'enable secret' command, typically in low-security lab environments or legacy configurations.
Platform Notes
On Cisco IOS-XE (e.g., Catalyst 3650, 9300), the `errdisable recovery interval` command syntax is identical to classic IOS. However, the output of `show errdisable recovery` may include additional fields such as 'Recovery Cause' with a more detailed description. The available causes may also differ; for example, IOS-XE includes causes like 'dot1x' and 'mab' that may not be present in older IOS.
On NX-OS (e.g., Nexus 9000), the command is `errdisable recovery interval <seconds>` with the same range (30-86400). However, the causes are configured differently: use `errdisable recovery cause <cause>` (e.g., `errdisable recovery cause port-security`). Note that NX-OS uses different cause names (e.g., 'port-security' instead of 'psecure-violation').
On ASA firewalls, there is no direct equivalent; errdisable is not a concept in ASA. On IOS-XR (e.g., ASR 9000), the errdisable recovery mechanism does not exist; instead, ports may be placed in a 'error-disabled' state but recovery is manual or handled via other mechanisms like 'redundancy'. For IOS versions prior to 12.2(25)SEC, the command may not support all causes; always check the documentation for your specific version.
In general, the command is widely supported on Catalyst switches running IOS 12.2 and later, including IOS 15.x and 16.x. When migrating from classic IOS to IOS-XE, the configuration is backward-compatible, but it is advisable to verify the cause names using `errdisable recovery cause ?`.
Practice for the CCNA 200-301
Test your knowledge with practice questions covering all CCNA 200-301 exam domains.
Practice CCNA 200-301 Questions