Errdisable Recovery for L2 Security

Bundle lab · $29.99

CCNP Layer 2 Security Hardening, Lab 9/10. You will enable automatic errdisable recovery on a campus access switch so ports shut down by Layer-2 security (Dynamic ARP Inspection, DHCP rate-limit, or storm control) can return to service automatically after a safe interval. The switch already enforces DHCP snooping with a correct trust boundary, DAI validation, and broadcast/multicast/unicast storm-control with shutdown actions. Your job: turn on errdisable auto-recovery for arp-inspection, dhcp-rate-limit, and storm-control, and set the interval to 60 seconds. Verify with show errdisable recovery.

Learning objectives

• Explain why ports enter errdisabled state for Layer-2 security violations (DAI, DHCP rate-limit, storm-control).
• Configure errdisable auto-recovery for specific security causes on a Cisco access switch.
• Set and verify the global recovery interval so transient faults self-heal without manual intervention.
• Confirm trust-boundary placement for DHCP snooping and DAI (uplink trusted, access untrusted).
• Use show errdisable recovery to validate timers and enabled causes.

Troubleshooting focus

• If show errdisable recovery does not list your causes, ensure each cause is explicitly enabled globally.
• If ports remain down indefinitely, confirm the recovery interval is nonzero and that the cause is enabled for recovery.
• If DHCP or ARP stops working, verify the uplink is trusted for DHCP snooping and DAI; access ports must remain untrusted.
• If errdisable events keep recurring, inspect rate limits and storm-control thresholds — overly aggressive limits can cause flaps.