Port Security: Violation Shutdown & Manual Recovery

Bundle lab

Hands-on CCNA L2 switching lab: build a small campus with a distribution switch and two access switches carrying a shared user VLAN over 802.1Q trunks. Harden access ports with sticky port-security in violation shutdown mode. Intentionally seed and diagnose broken trunks/host VLANs, restore end-to-end host reachability, then trigger a port-security violation to observe err-disabled behavior and perform manual recovery.

Learning objectives

• Create a user VLAN and place host-facing ports in that access VLAN on L2 access switches
• Build 802.1Q trunks between access and distribution switches, with a hardened native VLAN and allowed list
• Enable switchport port-security on user access ports, using sticky MAC and violation mode shutdown
• Trigger a port-security violation and identify the err-disabled state and counters
• Manually recover an interface from err-disabled using shutdown/no shutdown and re-verify host connectivity

Troubleshooting focus

• ping 10.20.20.20 from CLIENT-A fails: start with interface state. A brief status view finds down/down links or mismatched modes on the trunks and access ports.
• Traffic does not cross a trunk: confirm both ends agree on mode trunk, that allowed VLANs include 20 and 99, and that native VLAN is 999. An allow-list mismatch silently drops VLAN 20.
• One host cannot reach the other: check both host ports are in VLAN 20, not the default. Compare their VLANs and per-switch MAC-table learning.
• The MAC table is missing a client: each access switch should learn its local client MAC on Ethernet0/1 in VLAN 20, and SW-A-DIST should learn both MACs on the respective trunks.
• An access port is err-disabled: confirm the violation mode, address the cause — restore the MAC or clear sticky data — then recover with an explicit shutdown / no shutdown. Re-check sticky entries and counters.
• show port-security interface Ethernet0/1 reports Port Security: Disabled while violation mode, sticky and maximum all appear in the config: an interface accepts those options with the feature off.