Errdisable

Errdisable is a protective mechanism that automatically disables switch ports when specific error conditions or security violations are detected, preventing potential network disruptions and security breaches. It monitors various fault conditions including BPDU guard violations, port security breaches, link flapping, ARP inspection failures, and other Layer 2 protocol anomalies. The feature provides configurable detection thresholds, automatic recovery timers, and granular control over which error conditions trigger port shutdown, enabling administrators to balance network protection with operational continuity.

Diagram

Classes

iosxe

Name	Type	Constraint	Mandatory
devices	List	devices	No
device_groups	List	device_groups	No
global	Class	global	No

devices (iosxe)

Name	Type	Constraint	Mandatory	Default Value
configuration	Class	configuration	No

device_groups (iosxe)

Name	Type	Constraint	Mandatory	Default Value
configuration	Class	configuration	No

global (iosxe)

Name	Type	Constraint	Mandatory	Default Value
configuration	Class	configuration	No

configuration (iosxe.devices)

Name	Type	Constraint	Mandatory	Default Value
errdisable	Class	errdisable	No

errdisable (iosxe.devices.configuration)

Name	Type	Constraint	Mandatory
detect_cause	Class	detect_cause	No
flap_setting_cause	Class	flap_setting_cause	No
recovery_interval	Integer	min: `30`, max: `86400`	No
recovery_cause	Class	recovery_cause	No

detect_cause (iosxe.devices.configuration.errdisable)

Name	Type	Constraint	Mandatory
all	Boolean	`true`, `false`	No
arp_inspection	Boolean	`true`, `false`	No
bpduguard	Boolean	`true`, `false`	No
dhcp_rate_limit	Boolean	`true`, `false`	No
dtp_flap	Boolean	`true`, `false`	No
gbic_invalid	Boolean	`true`, `false`	No
inline_power	Boolean	`true`, `false`	No
l2ptguard	Boolean	`true`, `false`	No
link_flap	Boolean	`true`, `false`	No
loopback	Boolean	`true`, `false`	No
mlacp_minlink	Boolean	`true`, `false`	No
pagp_flap	Boolean	`true`, `false`	No
pppoe_ia_rate_limit	Boolean	`true`, `false`	No
security_violation_shutdown_vlan	Boolean	`true`, `false`	No
sfp_config_mismatch	Boolean	`true`, `false`	No
small_frame	Boolean	`true`, `false`	No
loopdetect	Boolean	`true`, `false`	No

flap_setting_cause (iosxe.devices.configuration.errdisable)

Name	Type	Constraint	Mandatory
dtp_flap_max_flaps	Integer	min: `1`, max: `100`	No
dtp_flap_time	Integer	min: `1`, max: `120`	No
link_flap_max_flaps	Integer	min: `1`, max: `100`	No
link_flap_time	Integer	min: `1`, max: `120`	No
pagp_flap_max_flaps	Integer	min: `1`, max: `100`	No
pagp_flap_time	Integer	min: `1`, max: `120`	No

recovery_cause (iosxe.devices.configuration.errdisable)

Name	Type	Constraint	Mandatory
all	Boolean	`true`, `false`	No
arp_inspection	Boolean	`true`, `false`	No
bpduguard	Boolean	`true`, `false`	No
channel_misconfig	Boolean	`true`, `false`	No
dhcp_rate_limit	Boolean	`true`, `false`	No
dtp_flap	Boolean	`true`, `false`	No
gbic_invalid	Boolean	`true`, `false`	No
inline_power	Boolean	`true`, `false`	No
l2ptguard	Boolean	`true`, `false`	No
link_flap	Boolean	`true`, `false`	No
link_monitor_failure	Boolean	`true`, `false`	No
loopback	Boolean	`true`, `false`	No
mac_limit	Boolean	`true`, `false`	No
mlacp_minlink	Boolean	`true`, `false`	No
mrp_miscabling	Boolean	`true`, `false`	No
oam_remote_failure	Boolean	`true`, `false`	No
pagp_flap	Boolean	`true`, `false`	No
port_mode_failure	Boolean	`true`, `false`	No
pppoe_ia_rate_limit	Boolean	`true`, `false`	No
psp	Boolean	`true`, `false`	No
psecure_violation	Boolean	`true`, `false`	No
security_violation	Boolean	`true`, `false`	No
sfp_config_mismatch	Boolean	`true`, `false`	No
small_frame	Boolean	`true`, `false`	No
storm_control	Boolean	`true`, `false`	No
udld	Boolean	`true`, `false`	No
unicast_flood	Boolean	`true`, `false`	No
vmps	Boolean	`true`, `false`	No
loopdetect	Boolean	`true`, `false`	No

Cisco IOS-XE CLI Equivalent

errdisable detect cause dhcp-rate-limit
errdisable detect cause loopdetect
errdisable detect cause security-violation shutdown vlan
errdisable recovery cause link-monitor-failure
errdisable recovery cause loopdetect
errdisable recovery cause psecure-violation
errdisable recovery interval 300

NAC YAML Configuration

iosxe:
  devices:
    - name: Device1
      configuration:
        errdisable:
          detect_cause:
            all: true
            dhcp_rate_limit: true
            loopdetect: true
            security_violation_shutdown_vlan: true
          flap_setting_cause:
            dtp_flap_max_flaps: 5
            dtp_flap_time: 30
            link_flap_max_flaps: 10
            link_flap_time: 60
            pagp_flap_max_flaps: 5
            pagp_flap_time: 30
          recovery_interval: 300
          recovery_cause:
            all: false
            arp_inspection: true
            bpduguard: true
            link_monitor_failure: true
            loopdetect: true
            psecure_violation: true

Examples

iosxe:
  devices:
    - name: Device1
      configuration:
        errdisable:
          detect_cause:
            all: true
          flap_setting_cause:
            dtp_flap_max_flaps: 5
            dtp_flap_time: 30
            link_flap_max_flaps: 10
            link_flap_time: 60
            pagp_flap_max_flaps: 5
            pagp_flap_time: 30
          recovery_interval: 300
          recovery_cause:
            all: false
            arp_inspection: true
            bpduguard: true