Octet

Say this first

The switch shut the port in software because a protection feature tripped: BPDU guard, port security, UDLD, EtherChannel misconfig guard, link flap, storm control and others. I read the reason first, remove the cause, then shutdown and no shutdown. Automatic recovery exists (errdisable recovery cause ..., 300 seconds by default) but is off until you enable it per cause.

Go deeper

Find the reason

Output

SW1# show interfaces status err-disabled

Port         Name               Status       Reason               Err-disabled Vlans
Gi1/0/5      Desk 3.12          err-disabled bpduguard

The log line at the moment it happened is just as useful:

Output

%SPANTREE-2-BLOCK_BPDUGUARD: Received BPDU on port Gi1/0/5 with BPDU Guard enabled. Disabling port.
%PM-4-ERR_DISABLE: bpduguard error detected on Gi1/0/5, putting Gi1/0/5 in err-disable state

Common reasons

Reason	Trigger
`bpduguard`	A BPDU arrived on a port with BPDU guard
`psecure-violation`	Port security in shutdown mode saw a disallowed MAC
`udld`	UDLD found a unidirectional link
`channel-misconfig`	EtherChannel bundled on one side only
`link-flap`	The link went up and down too often
`storm-control`	Storm control with action shutdown
`dhcp-rate-limit`, `arp-inspection`	DHCP snooping or DAI rate limit exceeded

Automatic recovery

Cisco IOS

errdisable recovery cause bpduguard
errdisable recovery cause psecure-violation
errdisable recovery interval 300

show errdisable recovery lists enabled causes and the time left per port.

They will ask next

Why not enable recovery for every cause?
A port that recovers into the same fault fails again every interval. For a loop or a bad fiber that means a repeating outage. I enable it for user-caused events like BPDU guard and port security, with alerting, and investigate UDLD and channel-misconfig by hand.
Is err-disabled the same as administratively down?
No. The config still says no shutdown; the switch disabled the port. show interfaces reports down, line protocol is down (err-disabled).

Traps

Bouncing the port without reading the reason. It trips again, or the loop it stopped comes back.

How did you do?