Nessus tenable.sc scan

[yaredo70]

Hi All,
We have currently required to scan our cisco switches with Nessus tenable.sc scanner and every time the scan started the datalink port disabled on the switch. I looked up the error and I found that err-disabled and I have to manually run a shut and no shut command to open the port.

if there anyone has had the issue before please share. 

Thanks 

[Mike.Cifelli]

datalink port disabled on the switch. I looked up the error and I found that err-disabled and I have to manually run a shut and no shut command to open the port.  Here is some info that should help:

-You can enable port sec error autorecovery to eliminate the need to manually shut/no shut ports in order to re-enable.  

--

View port sec status:

#show port-security interface <int>

--

View ports in err-disabled:

#show interfaces status err-disabled

--

Enable the autorecovery feature 30 seconds after a port security violation:

#errdisable recovery cause psecure-violation
#errdisable recovery interval 30

NOTE: Autorecovery default timer is 300 seconds.  

Lastly, I would discuss with the scan team to determine if there is a better way to ensure the NADs are hardened/secure.  Access ports going into errdisabled is a service interruption and something I would assume most want to avoid.  HTH!

[yaredo70]

Hi Mike,

Thank you for your reply. I don't think there is a port security configuration on the switch, I will look up the config files if there is any port security configured. My question is how We can prevent that from happening? This happened only after the scan started.

Thanks,

[Kasun Bandara]

first check the error-disabled reason. then you can take actions to that by disabling err-disable only for given reason. you can check logs or use console monitoring to get the reason easily.

[yaredo70]

Hi,

I have checked the error and I found this 

err-disabled  reason - udld 

 how do I solve it?

Thanks?