A few days ago, I was contacted by our security department reporting several IP cameras were down. Upon inspection, I discovered 7 ports in an err_disable state. Looking at the logs, I found the following entries:
Nov 26 13:47:11 PST: %PM-4-ERR_DISABLE: psecure-violation error detected on Gi7/0/30, putting Gi7/0/30 in err-disable state
Nov 26 13:47:11 PST: %PORT_SECURITY-2-PSECURE_VIOLATION_MAC_MOVE: Security violation occurred, caused by MAC address 0800.1011.9fe5 on port GigabitEthernet7/0/34 attempting to access port GigabitEthernet7/0/30.
Nov 26 13:47:12 PST: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet7/0/30, changed state to down
I checked interface gi7/0/34 and found two different MAC addresses on the port. One address was the camera connected to that interface. The other was the MAC address listed in the log entry above. I shut/no shut each interface and they all came back up correctly. In checking interface gi7/0/34 following the shutdown, it only lists one MAC address.
any thoughts as to what occurred?
As a side note, all of the cameras are mounted in the ceiling with no easy physical access.
