How to Fix an Err-Disabled Port on a Cisco Switch
An err-disabled port is one the switch has deliberately shut down because it detected a problem — a port-security violation, BPDU Guard trigger, or a link-flap. The port stays down until you fix the cause and recover it. Never just bounce the port without finding out why it went down — the switch disabled it for a reason.
Step 1: Find out why
The single most important command. It tells you exactly which condition triggered the shutdown:
Switch# show interfaces status err-disabled
Port Name Status Reason Err-disabled Vlans
Gi0/5 err-disabled psecure-violation
Gi0/9 err-disabled bpduguardOr check a single port and read the log:
Switch# show interfaces GigabitEthernet0/5
GigabitEthernet0/5 is down, line protocol is down (err-disabled)
Switch# show logging | include ERR_DISABLE
%PM-4-ERR_DISABLE: psecure-violation error detected on Gi0/5, putting Gi0/5 in err-disable stateThe Reason column is the whole investigation. Do not skip to the recovery step until you have read it.
What each reason means
The common triggers and what they are actually telling you:
| Reason | What happened | Likely cause |
|---|---|---|
psecure-violation | Port security saw more MAC addresses than allowed, or an unexpected MAC. | Someone plugged in a hub/switch, or a device was swapped on the port. |
bpduguard | A BPDU arrived on a port configured with PortFast + BPDU Guard. | Someone plugged a switch into an access port meant for an endpoint. |
link-flap | The link went up/down too many times in a short window. | Bad cable, failing NIC, or a loose connector. |
dtp-flap | Trunk negotiation kept flapping. | Mismatched trunk/access config between the two ends. |
storm-control | Broadcast/multicast traffic exceeded the configured threshold. | A broadcast storm, often from a Layer 2 loop. |
loopback | The switch received its own keepalive back. | A physical loop — a cable plugged into two ports on the same switch. |
Notice the pattern: nearly every reason is the switch protecting the network from something genuinely harmful. A bpduguard shutdown may have just saved you from a network-wide spanning-tree meltdown.
Step 2: Fix the actual cause
Address the underlying problem before you bring the port back:
- psecure-violation: find the offending MAC with show port-security interface. Was it an unauthorised device, or did the legitimate device simply change? Adjust the allowed MAC count or clear the sticky entry.
- bpduguard: find out what got plugged in. If it is a rogue switch, remove it. If it is a legitimate switch, that port should be a trunk with PortFast removed, not an access port.
- link-flap: replace the cable, then the SFP/transceiver, then suspect the far-end NIC.
- storm-control / loopback: hunt the Layer 2 loop. Check for a cable plugged into two ports, and verify spanning tree is running everywhere.
- dtp-flap: hardcode both ends —
switchport mode accessorswitchport mode trunk— and disable DTP withswitchport nonegotiate.
Step 3: Recover the port
Once the cause is fixed, the manual recovery is a simple shut/no shut:
Switch# configure terminal
Switch(config)# interface GigabitEthernet0/5
Switch(config-if)# shutdown
Switch(config-if)# no shutdown
Switch(config-if)# end
Switch# show interfaces GigabitEthernet0/5 | include line protocolThe shutdown is not optional. Issuing only no shutdown on an err-disabled port does nothing — the port is already administratively down from the switch's perspective, and you must cycle it to clear the err-disable state.
Optional: automatic recovery
You can tell the switch to bring the port back by itself after a timeout. This is useful for causes that are often transient (link-flap) and dangerous for causes that are not (bpduguard, loopback) — auto-recovering a port that is causing a loop just re-creates the loop.
Switch(config)# errdisable recovery cause psecure-violation
Switch(config)# errdisable recovery cause link-flap
Switch(config)# errdisable recovery interval 300That re-enables affected ports 300 seconds after they were disabled. Verify what is currently enabled:
Switch# show errdisable recoveryA word of caution. Auto-recovery hides the symptom. If a port keeps err-disabling every five minutes, auto-recovery turns a loud, obvious failure into a quiet, intermittent one that is much harder to diagnose. Use it deliberately, not as a default. When you are learning, leave recovery manual — being forced to read the reason each time is exactly how you build the troubleshooting instinct. Practise the whole cycle in our port-security lab.
Frequently asked questions
What does err-disabled mean on a Cisco switch?
It means the switch detected a problem on that port and deliberately shut it down to protect the network. Common triggers are port-security violations, BPDU Guard, link-flap and storm control.
How do I re-enable an err-disabled port?
Fix the underlying cause first, then enter interface configuration and issue 'shutdown' followed by 'no shutdown'. Just 'no shutdown' on its own will not clear the err-disable state.
How do I find out why a port went err-disabled?
Run 'show interfaces status err-disabled' — the Reason column names the exact trigger. You can also check 'show logging' for the %PM-4-ERR_DISABLE message.
Should I enable errdisable recovery?
Only selectively. It is reasonable for transient causes like link-flap, but risky for bpduguard or loopback, because auto-recovering a port that is causing a Layer 2 loop simply re-creates the loop.
Why did BPDU Guard shut my port down?
Because a BPDU arrived on an access port configured with PortFast. That means a switch was plugged into a port meant for an endpoint. BPDU Guard shuts it down to prevent a spanning-tree loop.
Related articles
Want hands-on training?
Learn this on real Cisco lab devices with placement support at Attila Technologies, Ahmedabad.