topic Re: turn off specific port port security in Network Security

turn off specific port port security

mr_awd — Fri, 21 Feb 2020 14:16:15 GMT

Dear community members,

I have to connect an additionnal small PoE switch to existing 2960 edge switch. At the moment of additionnal switch connection that specific port is disabled after few seconds.

From what I have found when googled, it seems that switchport port-security is enabled and I'm looking for a help to disable the port security on one specific port.

here is the current output on port security

show port-security interface gigabitEthernet 1/0/17

Port Security : Disabled
Port Status : Secure-down
Violation Mode : Shutdown
Aging Time : 0 mins
Aging Type : Absolute
SecureStatic Address Aging : Disabled
Maximum MAC Addresses : 40
Total MAC Addresses : 0
Configured MAC Addresses : 0
Sticky MAC Addresses : 0
Last Source Address:Vlan : 0000.0000.0000:0
Security Violation Count : 0

Strange thing about the violation count is that the counter in never incremented?!

Any suggestion on how to take off switchport security on this specific port is more than welcome.
Thanks in advance

Re: turn off specific port port security

GRANT3779 — Tue, 05 Sep 2017 14:29:57 GMT

Hi,

From that port output it does not look like Port-Security is enabled. See below output from a port with and one without port security configured.

BRS-CORE-01#sh port-security interface gi1/0/13
Port Security : Enabled
Port Status : Secure-up
Violation Mode : Restrict
Aging Time : 2 mins
Aging Type : Inactivity
SecureStatic Address Aging : Disabled
Maximum MAC Addresses : 2
Total MAC Addresses : 1
Configured MAC Addresses : 0
Sticky MAC Addresses : 0
Last Source Address:Vlan : 0c27.2454.ef48:504
Security Violation Count : 0

BRS-CORE-01#sh port-security interface gi1/0/6
Port Security : Disabled
Port Status : Secure-down
Violation Mode : Shutdown
Aging Time : 0 mins
Aging Type : Absolute
SecureStatic Address Aging : Disabled
Maximum MAC Addresses : 1
Total MAC Addresses : 0
Configured MAC Addresses : 0
Sticky MAC Addresses : 0
Last Source Address:Vlan : 0000.0000.0000:0
Security Violation Count : 0

What are the interface configs from each end of this switch to switch connection? It could be spanning tree, It could be a configuration mismatch, speed for example.

What made you believe it was port-security? What are the outputs of

show int status from each switch

Is there anything in the logs? Are the ports down/down?

Re: turn off specific port port security

mr_awd — Wed, 06 Sep 2017 10:07:00 GMT

Thanks for hints!

output for show interfaces status

Gi1/0/17 err-disabled 21 auto auto 10/100/1000BaseTX

And here is what I've found in logs

14:52:54.982: %PM-4-ERR_RECOVER: Attempting to recover from bpduguard err-disable state on Gi1/0/17
Sep 5 14:52:58.974: %SPANTREE-2-BLOCK_BPDUGUARD: Received BPDU on port Gi1/0/17 with BPDU Guard enabled. Disabling port.
Sep 5 14:52:58.974: %PM-4-ERR_DISABLE: bpduguard error detected on Gi1/0/17, putting Gi1/0/17 in err-disable state
Sep 5 14:54:58.976: %PM-4-ERR_RECOVER: Attempting to recover from bpduguard err-disable state on Gi1/0/17
Sep 5 14:55:02.968: %SPANTREE-2-BLOCK_BPDUGUARD: Received BPDU on port Gi1/0/17 with BPDU Guard enabled. Disabling port.
Sep 5 14:55:02.968: %PM-4-ERR_DISABLE: bpduguard error detected on Gi1/0/17, putting Gi1/0/17 in err-disable state
Sep 5 14:57:02.970: %PM-4-ERR_RECOVER: Attempting to recover from bpduguard err-disable state on Gi1/0/17

I should have looked into logs BEFORE posting. However, don't be rude with me because I'm not really a network specialist. I understand some things from what I have learnt on cisco netacad years ago. But when you are not working with networks remembering things is becoming a difficult task.

The switch version

Switch Ports Model              SW Version            SW Image
------ ----- -----              ----------            ----------
*    1 52    WS-C2960X-48FPS-L 15.0(2)EX4            C2960X-UNIVERSALK9-M

STP summary

SW-BXL-E4-AC-01#show spanning-tree summary
Switch is in rapid-pvst mode
Root bridge for: none
EtherChannel misconfig guard is enabled
Extended system ID           is enabled
Portfast Default             is disabled
PortFast BPDU Guard Default is enabled
Portfast BPDU Filter Default is disabled
Loopguard Default            is disabled
UplinkFast                   is disabled
BackboneFast                 is disabled
Configured Pathcost method used is short

Name                   Blocking Listening Learning Forwarding STP Active
---------------------- -------- --------- -------- ---------- ----------
VLAN0001                     0         0        0          3          3
VLAN0021                     0         0        0         27         27
VLAN0022                     0         0        0         27         27
VLAN0023                     0         0        0          5          5
VLAN0024                     0         0        0          3          3
VLAN0025                     0         0        0          3          3
VLAN0026                     0         0        0          3          3
VLAN0027                     0         0        0          3          3
---------------------- -------- --------- -------- ---------- ----------
8 vlans                      0         0        0         74         74

Port g1/0/17 is access port and I want to connect one small non-cisco PoE switch because the cisco switch is at maximum of PoE capacity and doesn't accept new PoE end devices. If I connect a simple end device (pc, printer...) the port is operating normally. If I connect switch on it the port is disabled. Now I know it's because of spanning tree but I don't have required competences to know if it's possible to "disable" the spanning tree on one specific port ?

Any idea?

Thanks!

Re: turn off specific port port security

GRANT3779 — Wed, 06 Sep 2017 13:16:22 GMT

Hello,

I could be wrong but it looks like you have bpduguard enabled globally on the switch and the access port you are connecting has portfast configured on it. This is causing the problems. I also think you have errdisable recovery configured for bpduguard and the port is essentially in a loop of being blocked/coming up and continues this way.

You can remove portfast from the interface config and then bring the port up and down.

I dont know the details of your topology however and assuming you are aware of the limitations when connecting two switches with access port.