Port Security: Violation and Err-disabled Recovery
A replacement laptop takes the desk offline the instant it is plugged in, and no shutdown only brings the port straight back down. Diagnose it and recover the port yourself, live, right below.
Symptom
A replacement PC takes the desk offline instantly. Read the secure address table, find the MAC still pinned there from the last machine, and recover the port properly.
Your mission
Prove the cause, then fix it
Format
Guided CLI investigation
Investigate before you configure.
Use the CLI evidence to isolate the fault, make the smallest safe correction, then verify the network state changed.
Observe the symptom and link state.
Diagnose by comparing the protocol evidence.
Verify the expected device state and confirm the original symptom is resolved.
Console access: SW1
This workspace stacks for portrait phones. Rotate to landscape for the full split-screen console.
Need a hint?
Reveal the root cause when you're ready.
Try the investigation first, then use this as your escape hatch, not a dead end.
Lab debrief
Turn the session into a repeatable troubleshooting pattern.
Use this reference after your attempt: first explain the symptom, then verify the evidence, then confirm the repair.
The problem
A user was given a replacement laptop and their desk went dead the moment it was plugged in. The switch port shows err-disabled with a reason of psecure-violation, and simply issuing no shutdown brings it straight back down again.
What you'll practice
- Recognise an err-disabled port and read its reason
- Read port security status, limits and violation counters
- Tell a statically configured secure MAC apart from a sticky-learned one
- Understand why the violation counter does not reset when the port recovers
- Recover an err-disabled port properly rather than by guesswork
The topology
One access switch with a single secure user port, configured for a maximum of one MAC address, a statically pinned secure MAC from the previous machine, and a shutdown violation action.
Commands to run yourself
The real diagnostic commands for this lab, copy-paste ready. Run these in the same order to reproduce the investigation on your own session.
show interfaces status err-disabledshow port-security interface GigabitEthernet0/1show port-security addressTopology diagram
Frequently asked
Why does no shutdown alone not fix an err-disabled port?
It clears the administrative shutdown, but the violating condition is still there: the new machine's MAC still is not the one pinned to the port, so the next frame violates again and the port shuts down again. The secure address has to be corrected first.
Why is the violation count still 1 after the port comes back up?
It is a cumulative counter, not a live status. It records that a violation happened on this port and it is not cleared by bouncing the interface, so do not read a non-zero count as proof the port is still broken. Read Port Status for that.
Is a statically configured secure MAC different from a sticky one?
Yes, and show port-security address labels them differently: SecureConfigured for one you typed in, SecureSticky for one the switch learned and wrote into the running configuration itself. A statically pinned address survives a new machine arriving, which is exactly what causes this outage.
Ready to run this lab yourself?
No setup, no image sourcing. Book a session or ask for a live demo.