A structured lesson workspace with readable content, hands-on examples, and a clean path to completion.
New engineers spend hours staring at a switch port that "doesn't work." Five seconds of `show interfaces status` tells them everything they need to know. This lesson is about getting to those five seconds fast.
| Status | Meaning | Common cause |
|---|---|---|
| connected | Link up, both ends negotiating | Normal |
| notconnect | No link — cable or far end down | Bad cable, unplugged, powered-off peer |
| disabled | Administratively shut down | `shutdown` on the interface |
| err-disabled | Port disabled by a protection feature | Port security, BPDU guard, UDLD |
| inactive | VLAN doesn't exist or is suspended | Config error |
| monitoring | SPAN destination port | Expected during captures |
Gi0/1 and Gi0/2 are healthy. Gi0/3 has no link — check the cable or the device on the far end. Gi0/4 is admin-down — someone ran `shutdown`. Gi0/5 is err-disabled, which is the one that catches new engineers off guard: the port is physically fine, but a protection feature has turned it off.
Switch1(config)# interface gigabitEthernet0/2Switch1(config-if)# description Workstation-ASwitch1(config-if)# switchport mode accessSwitch1(config-if)# switchport access vlan 1Switch1(config-if)# speed autoSwitch1(config-if)# duplex autoSwitch1(config-if)# no shutdownSwitch1(config-if)# endSwitch1# write memory
That's the canonical access port config. We use VLAN 1 (the default) here because VLANs are taught in Module 6 — same commands, just a different number later. Description is for humans — nothing reads it functionally, but future-you will thank present-you. `switchport mode access` explicitly disables trunking negotiation (DTP), which is a security best practice. `no shutdown` is only needed if the port was previously shut.
Always `write memory` (or `copy running-config startup-config`) after a config change you want to survive a reboot. Nothing on the CCNA is more frustrating than losing your VLAN config because you never saved.
When a protection feature trips — port security, BPDU guard, UDLD, link-flap — the switch puts the port into err-disabled and stops forwarding. The port stays down until you either fix the cause and manually recover, or configure automatic recovery.
`psecure-violation` means port security saw a MAC it didn't expect. Common in lab environments where someone swaps a NIC or plugs in a new laptop. Recovery:
Switch1(config)# interface gigabitEthernet0/5Switch1(config-if)# shutdownSwitch1(config-if)# no shutdownSwitch1(config-if)# end
Shutdown then no shutdown is the standard recovery — a single `no shutdown` on an already-shutdown-capable interface sometimes doesn't clear the err-disable flag depending on IOS version. The two-step is reliable.
You can automate recovery with `errdisable recovery cause psecure-violation` and `errdisable recovery interval 300`. The port will retry every 5 minutes. Useful in access environments where users unplug and replug devices constantly.
Leave `speed auto` and `duplex auto` on unless you have a specific reason to hardcode. Auto-negotiation on both ends produces the best result. The problem is when one end is hardcoded and the other is auto — the auto end can't detect duplex reliably and defaults to half, causing late collisions and terrible performance.
Duplex mismatch is the classic "the network is slow" story. Interface counters show late collisions and FCS errors on the half-duplex end, growing steadily. Always hardcode both ends or neither — never one.
Finish the lesson once you have worked through the material. This awards ★ 40 XP.