Skip to content

Errdisable

Errdisable is a protective mechanism that automatically disables switch ports when specific error conditions or security violations are detected, preventing potential network disruptions and security breaches. It monitors various fault conditions including BPDU guard violations, port security breaches, link flapping, ARP inspection failures, and other Layer 2 protocol anomalies. The feature provides configurable detection thresholds, automatic recovery timers, and granular control over which error conditions trigger port shutdown, enabling administrators to balance network protection with operational continuity.

Diagram

Diagram

Classes

configuration (iosxe.devices)

NameTypeConstraintMandatoryDefault Value
errdisableClass[errdisable]No

errdisable (iosxe.devices.configuration)

NameTypeConstraintMandatoryDefault Value
detect_causeClass[detect_cause]No
flap_setting_causeClass[flap_setting_cause]No
recovery_intervalIntegermin: 30, max: 86400No
recovery_causeClass[recovery_cause]No

detect_cause (iosxe.devices.configuration.errdisable)

NameTypeConstraintMandatoryDefault Value
allBooleantrue, falseNo
arp_inspectionBooleantrue, falseNo
bpduguardBooleantrue, falseNo
dhcp_rate_limitBooleantrue, falseNo
dtp_flapBooleantrue, falseNo
gbic_invalidBooleantrue, falseNo
inline_powerBooleantrue, falseNo
l2ptguardBooleantrue, falseNo
link_flapBooleantrue, falseNo
loopbackBooleantrue, falseNo
mlacp_minlinkBooleantrue, falseNo
pagp_flapBooleantrue, falseNo
pppoe_ia_rate_limitBooleantrue, falseNo
security_violation_shutdown_vlanBooleantrue, falseNo
sfp_config_mismatchBooleantrue, falseNo
small_frameBooleantrue, falseNo
loopdetectBooleantrue, falseNo

flap_setting_cause (iosxe.devices.configuration.errdisable)

NameTypeConstraintMandatoryDefault Value
dtp_flap_max_flapsIntegermin: 1, max: 100No
dtp_flap_timeIntegermin: 1, max: 120No
link_flap_max_flapsIntegermin: 1, max: 100No
link_flap_timeIntegermin: 1, max: 120No
pagp_flap_max_flapsIntegermin: 1, max: 100No
pagp_flap_timeIntegermin: 1, max: 120No

recovery_cause (iosxe.devices.configuration.errdisable)

NameTypeConstraintMandatoryDefault Value
allBooleantrue, falseNo
arp_inspectionBooleantrue, falseNo
bpduguardBooleantrue, falseNo
channel_misconfigBooleantrue, falseNo
dhcp_rate_limitBooleantrue, falseNo
dtp_flapBooleantrue, falseNo
gbic_invalidBooleantrue, falseNo
inline_powerBooleantrue, falseNo
l2ptguardBooleantrue, falseNo
link_flapBooleantrue, falseNo
link_monitor_failureBooleantrue, falseNo
loopbackBooleantrue, falseNo
mac_limitBooleantrue, falseNo
mlacp_minlinkBooleantrue, falseNo
mrp_miscablingBooleantrue, falseNo
oam_remote_failureBooleantrue, falseNo
pagp_flapBooleantrue, falseNo
port_mode_failureBooleantrue, falseNo
pppoe_ia_rate_limitBooleantrue, falseNo
pspBooleantrue, falseNo
psecure_violationBooleantrue, falseNo
security_violationBooleantrue, falseNo
sfp_config_mismatchBooleantrue, falseNo
small_frameBooleantrue, falseNo
storm_controlBooleantrue, falseNo
udldBooleantrue, falseNo
unicast_floodBooleantrue, falseNo
vmpsBooleantrue, falseNo
loopdetectBooleantrue, falseNo

Examples

iosxe:
devices:
- name: Device1
configuration:
errdisable:
detect_cause:
all: true
flap_setting_cause:
dtp_flap_max_flaps: 5
dtp_flap_time: 30
link_flap_max_flaps: 10
link_flap_time: 60
pagp_flap_max_flaps: 5
pagp_flap_time: 30
recovery_interval: 300
recovery_cause:
all: false
arp_inspection: true
bpduguard: true