Cisco MAC Sticky Ports

Question

So I have setup a sticky port on my switch with 1 allowed MAC for an access point. It has grabbed the Mac of the AP and after testing the port with a pc it shutdown the port as it should.

But then I plugged the AP back in and the port is still down, is this how it's supposed to work? Is there a way that I can get the port to come back online when the Mac address comes back

Thanks

Answer 1

You don't specify the switch make and model, so I'm assuming a Cisco switch based on the Tag on the question.

If a switchport on a Cisco switch is shut down due to some sort of error or port-security violation, it doesn't automatically come back up. You have to enable errdisable recovery as outlined here: https://www.cisco.com/c/en/us/support/docs/lan-switching/spanning-tree-protocol/69980-errdisable-recovery.html

In short, it explains the following:

You can check the existing status of port recovery with: show errdisable recovery

And in configure mode, you can set the port state you want to recover from with the following command: errdisable recovery cause <CAUSE>

---

In your case, you would probably want to turn on psecure-violation recovery:

show errdisable recovery
!
conf t
!
errdisable recovery cause psecure-violation
!
end
wr
!
show errdisable recovery

You can ALSO turn on all causes for auto-recovery, but that is risky if a port was shutdown for BPDUGuard violations, for example. Some possible errdisabled causes you could auto-recover from:

#errdisable recovery cause ?
  all                 Enable timer to recover from all causes
  arp-inspection      Enable timer to recover from arp inspection error disable
                      state
  bpduguard           Enable timer to recover from BPDU Guard error disable
                      state
  channel-misconfig   Enable timer to recover from channel misconfig disable
                      state
  dhcp-rate-limit     Enable timer to recover from dhcp-rate-limit error
                      disable state
  dtp-flap            Enable timer to recover from dtp-flap error disable state
  gbic-invalid        Enable timer to recover from invalid GBIC error disable
                      state
  l2ptguard           Enable timer to recover from l2protocol-tunnel error
                      disable state
  link-flap           Enable timer to recover from link-flap error disable
                      state
  mac-limit           Enable timer to recover from mac limit disable state
  pagp-flap           Enable timer to recover from pagp-flap error disable
                      state
  psecure-violation   Enable timer to recover from psecure violation disable
                      state
  security-violation  Enable timer to recover from 802.1x violation disable
                      state
  udld                Enable timer to recover from udld error disable state
  unicast-flood       Enable timer to recover from unicast flood disable state