5

So I have setup a sticky port on my switch with 1 allowed MAC for an access point. It has grabbed the Mac of the AP and after testing the port with a pc it shutdown the port as it should.

But then I plugged the AP back in and the port is still down, is this how it's supposed to work? Is there a way that I can get the port to come back online when the Mac address comes back

Thanks

4

You don't specify the switch make and model, so I'm assuming a Cisco switch based on the Tag on the question.

If a switchport on a Cisco switch is shut down due to some sort of error or port-security violation, it doesn't automatically come back up. You have to enable errdisable recovery as outlined here: https://www.cisco.com/c/en/us/support/docs/lan-switching/spanning-tree-protocol/69980-errdisable-recovery.html

In short, it explains the following:

You can check the existing status of port recovery with: show errdisable recovery

And in configure mode, you can set the port state you want to recover from with the following command: errdisable recovery cause <CAUSE>


In your case, you would probably want to turn on psecure-violation recovery:

show errdisable recovery
!
conf t
!
errdisable recovery cause psecure-violation
!
end
wr
!
show errdisable recovery

You can ALSO turn on all causes for auto-recovery, but that is risky if a port was shutdown for BPDUGuard violations, for example. Some possible errdisabled causes you could auto-recover from:

#errdisable recovery cause ?
  all                 Enable timer to recover from all causes
  arp-inspection      Enable timer to recover from arp inspection error disable
                      state
  bpduguard           Enable timer to recover from BPDU Guard error disable
                      state
  channel-misconfig   Enable timer to recover from channel misconfig disable
                      state
  dhcp-rate-limit     Enable timer to recover from dhcp-rate-limit error
                      disable state
  dtp-flap            Enable timer to recover from dtp-flap error disable state
  gbic-invalid        Enable timer to recover from invalid GBIC error disable
                      state
  l2ptguard           Enable timer to recover from l2protocol-tunnel error
                      disable state
  link-flap           Enable timer to recover from link-flap error disable
                      state
  mac-limit           Enable timer to recover from mac limit disable state
  pagp-flap           Enable timer to recover from pagp-flap error disable
                      state
  psecure-violation   Enable timer to recover from psecure violation disable
                      state
  security-violation  Enable timer to recover from 802.1x violation disable
                      state
  udld                Enable timer to recover from udld error disable state
  unicast-flood       Enable timer to recover from unicast flood disable state

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.