Troubleshoot › Error Decoder › %PORT_SECURITY-2-PSECURE_VIOLATION

What does %PORT_SECURITY-2-PSECURE_VIOLATION mean?

Port security violation: port shut down

%PORT_SECURITY-2-PSECURE_VIOLATION: Security violation occurred, caused by MAC address 001a.2b3c.4d5e on port GigabitEthernet1/0/12

Platform: Cisco IOS / IOS XE. Values shown are the documented defaults — confirm them on your platform with the check commands below.

What it means

The port is configured to allow only certain MAC addresses (the hardware addresses of approved devices). A device with a different address tried to use the port, so the switch blocked it — with the default 'shutdown' mode, it err-disables the port and everything on it stops working.

Likely causes, in order

• Someone plugged in a different device: a personal laptop, a new PC that replaced the old one, a phone charger with a network chip.
• A small desktop switch or hub was added, so the port suddenly sees many MAC addresses.
• The approved device was replaced (for example a new printer or IP phone) and nobody updated the allowed list.

Check, in order

1. Copyshow port-security interface Gi1/0/12Shows the last MAC address seen, the allowed addresses, and the violation count.
2. Copyshow mac address-table interface Gi1/0/12What is actually connected now, before you clear anything.

The fix

• Confirm the new device is approved to be on the network. If it is, update the port's allowed MAC address or raise the maximum count.
• Clear the violation by shutting and re-opening the port (shut / no shut).
• If this keeps happening on user ports, consider 'restrict' mode (blocks the stranger, logs it, keeps the approved device working) instead of 'shutdown' mode.

Sources

• Cisco: Recover Errdisable Port State (port security is one of its causes)

More error messages