Switch Port Blocking? Here's the Real Fix

1. Loop in the Network (STP Blocking)

This is the most common reason I see. You're plugging something in—maybe a new switch, a VoIP phone, or even a laptop with a second cable—and the port goes amber or shows "blocking" in the logs. The switch's Spanning Tree Protocol (STP) is doing its job: it detects a loop and blocks the port to stop a broadcast storm.

Had a client last month who plugged a new Netgear GS108 into a Cisco SG300. Both switches were running STP, but the cable from the Netgear to the server and back to the Cisco created a loop. Ports on both switches went blocking. The network manager panicked—thought the switch was dead. Nope. Pulled the extra cable, and everything came back in 30 seconds.

How to fix it

1. Check for physical loops. Look at the cables. Do you have a device connected to two different switch ports? That's a loop. Unplug one cable.
2. Enable PortFast on access ports. If the port connects to a single device (PC, printer, camera), turn on PortFast. This skips the STP listening/learning phases and brings the port up immediately. On a Cisco switch:
   interface gigabitEthernet 0/1
spanning-tree portfast
3. If it's a trunk port, check your spanning-tree settings. Sometimes you have a loop in the VLAN topology. Use show spanning-tree to see which ports are blocking. Then trace the cables.

Most switches these days have loop protection built in. Netgear calls it "Loop Prevention" under the switch settings. Ubiquiti stuff has it too. Turn that on—it'll auto-block ports that create loops without bringing down STP.

One tip: don't just disable STP. I've seen people do that, and then a broadcast storm takes down the whole network. Keep STP on, but add PortFast where it makes sense.

2. Bad Cable or Wrong Speed/Duplex

Second most common cause. The switch sees too many errors on the port and blocks it—or the port's set to auto-negotiate, but the connected device isn't matching. This leads to a port that shows "blocking" or "err-disabled" in some cases (like Cisco's errdisable state).

Just last week, a small biz called me because their printer's port was blocking. Their guy had run a new Cat5 cable through the ceiling. Turns out he'd used a cable that was too long—over 100 meters—and the signal was so degraded the switch said "nope." Replaced the cable with a 75-foot one, and the port came up fine.

Check this

• Look at the port counters. Run show interface gigabitEthernet 0/1 and look for CRC errors, collisions, or late collisions. If you see more than a handful, the cable's bad or the length is too long.
• Try a known good cable. Short one, like 3 feet. Plug it between the switch and a laptop. If the port comes up, the cable's the problem.
• Check speed and duplex. Force the port to 100Mbps full duplex on both ends if the device is old. Auto-negotiate can fail with some mismatched hardware (looking at you, old HP printers). On a Cisco switch:
  speed 100
duplex full

If the port goes into errdisable (on Cisco), you can re-enable it manually: shutdown then no shutdown on the interface. But fix the cable first or it'll just happen again.

3. Port Security or MAC Address Limit

This one's sneaky. You've got a port that's set to only allow one MAC address (or a specific number). Someone plugs in a switch behind that port, and now the port sees multiple MACs—so it blocks. Or a device with a different MAC tries to connect. The port goes into "security violation" mode and blocks all traffic.

I saw this at a law office. They had a conference room port that was locked down to one MAC. The paralegal brought in a laptop and plugged it into a USB hub that had a different MAC. Port blocked. Took me 10 minutes to find it in the logs: %PORT_SECURITY-2-PSECURE_VIOLATION on the Cisco switch.

Fix it

1. Check the port security config. On Cisco: show port-security interface gigabitEthernet 0/1. It'll tell you if violations have occurred and the max MAC count.
2. Clear the violation. If it's temporary, just re-enable the port: shutdown then no shutdown. But the device that caused it will get blocked again unless you fix the config.
3. Change the allowed MAC count. If it's a port where people plug in laptops, set it to allow 2 or 3 MACs. Or just turn off port security entirely if you don't need it. Command:
   switchport port-security maximum 3
4. If you want to allow any device, disable port security: no switchport port-security on the interface.

Pro tip: If you're using port security for security reasons (like a cash register or server), set the violation mode to restrict instead of shutdown. That way the port stays up, but you get a log alert. switchport port-security violation restrict.

Quick-Reference Summary Table

That's it. Most blocked ports are loops or bad cables. Check those first, and you'll save yourself a lot of head-scratching.