In which configuration mode is storm-control action shutdown used?

The storm-control action shutdown command is entered in Interface Config mode on Cisco IOS devices.

SecurityInterface Config

storm-control action shutdown

Configures the switch to shut down a port when a storm exceeds the configured threshold, preventing broadcast, multicast, or unicast storms from affecting network stability.

Definition: storm-control action shutdown is a Cisco IOS interface config command. Configures the switch to shut down a port when a storm exceeds the configured threshold, preventing broadcast, multicast, or unicast storms from affecting network stability.

Overview

The `storm-control action shutdown` command is a critical security feature on Cisco switches that protects the network from excessive broadcast, multicast, or unicast traffic, known as a storm. When a storm occurs, it can consume excessive bandwidth and CPU resources, leading to network degradation or outages. This command configures the switch to automatically disable (shut down) a port when the storm traffic exceeds a configured threshold.

The shutdown action is the most aggressive response, as it completely blocks all traffic on the affected port until an administrator manually re-enables it. This is in contrast to other actions like `trap` (sends an SNMP trap) or `shutdown` (the default action, which also shuts the port but can be overridden). The command is typically used on access ports connected to end devices, where a malfunctioning device or a loop could generate excessive traffic.

It is also useful on trunk ports to prevent a storm from propagating across VLANs. The storm-control feature works by monitoring the traffic rate on a port and comparing it to the configured rising threshold. If the rate exceeds the threshold, the configured action is triggered.

The shutdown action is irreversible via the command itself; the port remains in an err-disabled state until manually recovered. This behavior is important for network stability, as it prevents a single faulty port from affecting the entire switch. The command is available in interface configuration mode and requires privilege level 15.

It is saved to the running configuration and can be written to startup-config. Understanding this command is essential for CCNA and CCNP candidates, as storm control is a common topic in the exam and a practical tool for network engineers.

Syntax·Interface Config

storm-control action shutdown

When to Use This Command

Protecting access ports from excessive broadcast traffic caused by loops or misconfigured devices.
Mitigating the impact of a denial-of-service (DoS) attack that floods a switch port with multicast frames.
Automatically disabling a trunk port that experiences an abnormal unicast storm due to a faulty NIC.
Enforcing traffic storm control policies on ports connected to untrusted end-user devices.

Command Examples

Basic storm-control action shutdown on an access port

interface GigabitEthernet0/1
storm-control broadcast level 50
storm-control action shutdown

Switch(config-if)# storm-control broadcast level 50
Switch(config-if)# storm-control action shutdown
Switch(config-if)# end
Switch# show storm-control GigabitEthernet0/1 broadcast
Interface   Filter State   Upper        Lower        Current
----------- ------------ ------------ ------------ ------------
Gi0/1       Shutdown      50.00%       50.00%       0.00%

The output shows that interface Gi0/1 has storm control enabled for broadcast traffic with an upper threshold of 50%. The filter state is 'Shutdown', meaning the port will be error-disabled if the threshold is exceeded. Current traffic is 0.00% of bandwidth.

Storm-control action shutdown with multicast threshold

interface GigabitEthernet0/2
storm-control multicast level 30
storm-control action shutdown

Switch(config-if)# storm-control multicast level 30
Switch(config-if)# storm-control action shutdown
Switch(config-if)# end
Switch# show storm-control GigabitEthernet0/2 multicast
Interface   Filter State   Upper        Lower        Current
----------- ------------ ------------ ------------ ------------
Gi0/2       Forwarding    30.00%       30.00%       10.00%

The interface Gi0/2 has multicast storm control with a threshold of 30%. The filter state is 'Forwarding' because current traffic (10%) is below the threshold. If traffic exceeds 30%, the state changes to 'Shutdown' and the port is error-disabled.

Understanding the Output

The 'show storm-control interface' command displays storm control status per interface. The 'Filter State' column indicates whether the port is currently forwarding traffic ('Forwarding') or has been shut down ('Shutdown') due to a storm. 'Upper' and 'Lower' show the configured thresholds (as percentage of bandwidth).

'Current' shows the real-time traffic percentage for that traffic type. A 'Shutdown' state means the port is in errdisable state and must be manually re-enabled (or via errdisable recovery). A 'Forwarding' state with 'Current' near 'Upper' indicates the port is at risk of being shut down.

Watch for interfaces that repeatedly enter shutdown state, indicating persistent storm issues.

Configuration Scenarios

Configure storm-control shutdown on an access port to protect against broadcast storms

A switch port connected to a user workstation is experiencing intermittent broadcast storms due to a faulty NIC. The goal is to automatically shut down the port if broadcast traffic exceeds 50% of the interface bandwidth.

Topology

SW1(Gi0/1)---PC1

Steps

1.Step 1: Enter global configuration mode: SW1> enable
2.Step 2: Enter interface configuration mode: SW1# configure terminal
3.Step 3: Select the interface: SW1(config)# interface GigabitEthernet0/1
4.Step 4: Set the broadcast storm-control rising threshold to 50%: SW1(config-if)# storm-control broadcast level 50
5.Step 5: Configure the action to shutdown the port when the threshold is exceeded: SW1(config-if)# storm-control action shutdown
6.Step 6: Exit configuration mode: SW1(config-if)# end
7.Step 7: Verify the configuration: SW1# show storm-control GigabitEthernet0/1

Configuration

!
interface GigabitEthernet0/1
 storm-control broadcast level 50
 storm-control action shutdown
!

Verify: Use `show storm-control GigabitEthernet0/1` to verify the threshold and action. Expected output includes 'Action: Shutdown' and 'Broadcast threshold: 50%'.

Watch out: If the storm-control action is not explicitly set, the default action is to drop excess traffic, not shutdown. Always verify the action is set to shutdown if that is the desired behavior.

Configure storm-control shutdown on a trunk port to prevent multicast storms from affecting multiple VLANs

A trunk link between two switches is carrying multiple VLANs. A multicast storm from a misconfigured server could impact all VLANs. The goal is to shut down the trunk port if multicast traffic exceeds 80% of the link bandwidth.

Topology

SW1(Gi0/24)---(Gi0/24)SW2

Steps

1.Step 1: Enter global configuration mode: SW1> enable
2.Step 2: Enter interface configuration mode: SW1# configure terminal
3.Step 3: Select the trunk interface: SW1(config)# interface GigabitEthernet0/24
4.Step 4: Set the multicast storm-control rising threshold to 80%: SW1(config-if)# storm-control multicast level 80
5.Step 5: Configure the action to shutdown: SW1(config-if)# storm-control action shutdown
6.Step 6: Exit and verify: SW1(config-if)# end
7.Step 7: Verify: SW1# show storm-control GigabitEthernet0/24 multicast

Configuration

!
interface GigabitEthernet0/24
 storm-control multicast level 80
 storm-control action shutdown
!

Verify: Use `show storm-control GigabitEthernet0/24 multicast` to confirm the threshold and action. The output should show 'Action: Shutdown' and 'Multicast threshold: 80%'.

Watch out: Storm-control on trunk ports applies to all VLANs on that trunk. If you need per-VLAN thresholds, consider using per-VLAN storm-control or other mechanisms. Also, ensure the trunk is not carrying critical traffic that should not be interrupted.

Troubleshooting with This Command

When troubleshooting storm-control shutdown, the first step is to check the interface status. A port that has been shut down due to a storm will show as 'err-disabled' in the `show interfaces` output. The reason for the err-disable can be confirmed with `show interfaces status err-disabled`, which will list the cause as 'storm-control'.

To see the storm-control statistics, use `show storm-control [interface] [broadcast|multicast|unicast]`. Healthy output shows the current traffic rate and the configured threshold. If the port is err-disabled, the output will indicate that the action was triggered.

Common symptoms include users reporting loss of connectivity on a specific port, and the switch logs showing messages like '%PM-4-ERR_DISABLE: storm-control error detected on Gi0/1, putting Gi0/1 in err-disable state'. To recover, the administrator must manually re-enable the port with `shutdown` followed by `no shutdown` on the interface, or configure errdisable recovery with `errdisable recovery cause storm-control`. When diagnosing, it is important to determine the source of the storm.

Use `show storm-control` to see the traffic rate; if it is consistently high, investigate the connected device. Also, check for loops in the network using `show spanning-tree` and `show cdp neighbors`. Correlate storm-control events with CPU utilization using `show processes cpu` to see if the switch is overwhelmed.

If the storm is intermittent, consider lowering the threshold to catch it earlier. Remember that storm-control only monitors incoming traffic; it does not prevent the switch from generating storms. For unicast storms, ensure that the MAC address table is not flooding due to unknown unicast.

Use `show mac address-table` to check for flapping or incomplete entries. In summary, a systematic approach: verify err-disable status, check storm-control statistics, identify the storm type, trace the source, and adjust thresholds or recover the port.

CCNA Exam Tips

CCNA exam tip: Storm-control action shutdown puts the port in errdisable state; you must manually re-enable it or configure errdisable recovery.

CCNA exam tip: The storm-control command is applied per interface and can filter broadcast, multicast, or unicast traffic separately.

CCNA exam tip: The default action is to drop excess traffic (filter), not shutdown; you must explicitly configure 'storm-control action shutdown' to disable the port.

CCNA exam tip: On CCNA, know that storm control thresholds are set as a percentage of total interface bandwidth.

Common Mistakes

Mistake 1: Forgetting to configure 'storm-control action shutdown' — the default action only drops traffic, not disables the port, so the port remains up but may still be overwhelmed.

Mistake 2: Setting the threshold too low (e.g., 1%) causing legitimate traffic to trigger shutdown frequently.

Mistake 3: Not configuring errdisable recovery for storm-control, requiring manual intervention to bring the port back up after a storm event.

storm-control action shutdown vs enable password [password]

Both storm-control action shutdown and enable password are security-related commands in Cisco IOS, but they operate at different layers: one protects against Layer 2 traffic storms on a specific interface, while the other controls administrative access to the device. They are often reviewed together in security audits as part of hardening switch configurations.

Aspect	storm-control action shutdown	enable password [password]
Scope	Per-interface (storm protection)	Global (management access)
Configuration mode	Interface configuration	Global configuration
Persistence	Saved in running/startup config per interface	Saved in running/startup config globally
Precedence	Overridden by no storm-control or higher threshold	Overridden by enable secret (if configured)
Typical use	Safeguard against broadcast/multicast/unicast storms	Basic password for privilege level 15 access

Use storm-control action shutdown when you need to automatically disable a switch port upon detecting a broadcast, multicast, or unicast storm that exceeds the configured threshold, to protect the network from excessive traffic.

Use enable password [password] when you want to set a simple plaintext password for privileged EXEC access and do not require the stronger encryption provided by enable secret.

Platform Notes

In IOS-XE (e.g., Catalyst 9000 series), the `storm-control action shutdown` command syntax is identical to classic IOS. However, the default action in IOS-XE may be to drop traffic rather than shutdown, so explicit configuration is recommended. The `show storm-control` output in IOS-XE includes additional fields like 'Current storm state' and 'Traffic rate'.

In NX-OS (e.g., Nexus switches), the equivalent command is `storm-control action shutdown` as well, but the configuration is done under interface mode with `storm-control broadcast level <percent>` and `storm-control action shutdown`. Note that NX-OS also supports `storm-control multicast level` and `storm-control unicast level`. On ASA firewalls, storm control is not directly applicable; instead, use `storm-control` under interface configuration for switch modules.

In IOS-XR (e.g., ASR 9000), storm control is not supported; instead, use QoS policies to limit broadcast/multicast traffic. For IOS versions 12.x and 15.x, the command is consistent, but in 12.x, the default action might be to drop traffic, while in 15.x, the default is also drop. Always verify the behavior with `show storm-control`.

In Catalyst 2960 and 3560 switches, the command is fully supported. For older 2950 switches, storm-control is available but may not support unicast storm control. Always check the specific platform documentation for exact syntax and capabilities.

Practice for the CCNA 200-301

Test your knowledge with practice questions covering all CCNA 200-301 exam domains.

Practice CCNA 200-301 Questions