Port Security

[Jelani_DTE_PRO]

Hello.

Whenever, I enable port security on a switchport that has a computer connected to it, the port enters "err-disabled" status. It doesn't matter if the Ethernet cable is connected between the wall and the computer or the phone and the computer...it causes the port on the switch to error out, whenever I enter the "switchport port-security" command. Before I configured the port to access the voice vlan, it would error out when I tried enabling mac sticky. Now that the port is configured to access both the data and voice vlans, it errors out when port security is simply enabled.

Has anyone experienced a similar issue or know what could possibly be causing this issue? 

Thanks,

Jelani

[Andrew Khalil]

@Jelani_DTE_PRO,

Can you please share the log error!

Please don't forget to rate all helpful responses and mark solutions!

Bst Rgds,

Andrew Khalil

[Jelani_DTE_PRO]

Log Buffer (4096 bytes):
5-UPDOWN: Line protocol on Interface FastEthernet0/8, changed state to up
Jan 29 10:41:08: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/8, changed state to down
Jan 29 10:41:09: %LINK-3-UPDOWN: Interface FastEthernet0/8, changed state to down
Jan 29 10:41:15: %LINK-3-UPDOWN: Interface FastEthernet0/8, changed state to up
Jan 29 10:41:16: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/8, changed state to up
Jan 29 10:41:28: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/8, changed state to down
Jan 29 10:41:30: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/8, changed state to up
Jan 29 10:41:40: %SW_DAI-4-DHCP_SNOOPING_DENY: 1 Invalid ARPs (Req) on Fa0/8, vlan 3.([28f1.0e1c.5e83/169.254.111.60/0000.0000.0000/169.254.111.60/10:41:39 Eastern Tue Jan 29 2019])
Jan 29 10:54:58: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/8, changed state to down
Jan 29 10:54:59: %LINK-3-UPDOWN: Interface FastEthernet0/8, changed state to down
Jan 29 10:55:03: %LINK-3-UPDOWN: Interface FastEthernet0/8, changed state to up
Jan 29 10:55:04: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/8, changed state to up
Jan 29 10:55:42: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/8, changed state to down
Jan 29 10:55:43: %LINK-3-UPDOWN: Interface FastEthernet0/8, changed state to down
Jan 29 11:05:20: %LINK-3-UPDOWN: Interface FastEthernet0/8, changed state to up
Jan 29 11:05:21: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/8, changed state to up
Jan 29 11:11:28: %PM-4-ERR_DISABLE: psecure-violation error detected on Fa0/8, putting Fa0/8 in err-disable state
Jan 29 11:11:28: %PORT_SECURITY-2-PSECURE_VIOLATION: Security violation occurred, caused by MAC address 28f1.0e1c.5e83 on port FastEthernet0/8.
Jan 29 11:11:29: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/8, changed state to down
Jan 29 11:11:30: %LINK-3-UPDOWN: Interface FastEthernet0/8, changed state to down
Jan 29 11:12:36: %PM-4-ERR_DISABLE: psecure-violation error detected on Fa0/8, putting Fa0/8 in err-disable state
Jan 29 11:12:36: %PORT_SECURITY-2-PSECURE_VIOLATION: Security violation occurred, caused by MAC address 28f1.0e1c.5e83 on port FastEthernet0/8.
Jan 29 11:13:01: %LINK-5-CHANGED: Interface FastEthernet0/8, changed state to administratively down
Jan 29 11:13:04: %LINK-3-UPDOWN: Interface FastEthernet0/8, changed state to up
Jan 29 11:13:05: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/8, changed state to up
Jan 29 11:15:41: %PM-4-ERR_DISABLE: psecure-violation error detected on Fa0/8, putting Fa0/8 in err-disable state
Jan 29 11:15:41: %PORT_SECURITY-2-PSECURE_VIOLATION: Security violation occurred, caused by MAC address 28f1.0e1c.5e83 on port FastEthernet0/8.
Jan 29 11:15:42: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/8, changed state to down
Jan 29 11:15:43: %LINK-3-UPDOWN: Interface FastEthernet0/8, changed state to down
Jan 29 11:16:23: %LINK-5-CHANGED: Interface FastEthernet0/8, changed state to administratively down
Jan 29 11:16:25: %LINK-3-UPDOWN: Interface FastEthernet0/8, changed state to up
Jan 29 11:16:26: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/8, changed state to up
Jan 29 11:24:49: %PM-4-ERR_DISABLE: psecure-violation error detected on Fa0/8, putting Fa0/8 in err-disable state
Jan 29 11:24:49: %PORT_SECURITY-2-PSECURE_VIOLATION: Security violation occurred, caused by MAC address 28f1.0e1c.5e83 on port FastEthernet0/8.
Jan 29 11:24:50: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/8, changed state to down
Jan 29 11:24:51: %LINK-3-UPDOWN: Interface FastEthernet0/8, changed state to down
Jan 29 11:25:11: %LINK-5-CHANGED: Interface FastEthernet0/8, changed state to administratively down
Jan 29 11:25:13: %LINK-3-UPDOWN: Interface FastEthernet0/8, changed state to up
Jan 29 11:25:14: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/8, changed state to up

[paul driver]

Hello

lt looks dynamic arp inspection has initiated- basically the switch is stating the  binding table entry’s it has cached don’t match the switchport assigned assigned to that .

[Andrew Khalil · Accepted solution]

@Jelani_DTE_PRO

First, you have a violation configured for port F0/8,

and the recently connected device has a MAC address that it's not configured for that port.

It looks like there is another MAC address configured for that port, or dynamically learned by the means of the dhcp snooping in combination with the arp inspection.

As a result, I would advice you to issue these 2 commands:

#clear ip arp inspection statistics

#clear ip dhcp snooping binding

If you are planning to connect several devices to that port, don't forget to issue the following commands:

#switchport port-security max x

where x is the number of the mac addresses.

Please don't forget to rate all helpful responses and mark solutions!

Bst Rgds,

Andrew Khalil

[Jelani_DTE_PRO]

Andrew, 

That worked. Thanks, much!!!

[Andrew Khalil]

@Jelani_DTE_PRO

Happy to help dear,

and will be happier to get a helpful rating)))

bst rgds,

Andrew Khalil

[Jelani_DTE_PRO]

Andrew,

Bro, how do you give a rating?

[Andrew Khalil]

Just click on the star icon under each helpful reply!
Thanks in advance!
Bst Rgds,
Andrew Khalil

[Jelani_DTE_PRO]

Cool. Just did it! Gave you a "5".