VLAN mismatches, STP blocking, and port-security violations—the three most common Layer-2 issues in enterprise networks.

 Below is a clear, practical troubleshooting guide for VLAN mismatches, STP blocking, and port-security violations—the three most common Layer-2 issues in enterprise networks.

---

✅ 1. VLAN Mismatch Troubleshooting

A VLAN mismatch happens when two connected switch ports (usually trunks) have different VLAN configurations, causing traffic loss.

Symptoms

• Cannot reach devices across switches

• Trunk link up but hosts in same VLAN cannot communicate

• CDP/LLDP warnings like “Native VLAN mismatch detected”

Troubleshooting Steps

Step 1: Check trunk configuration

Cisco:

show interfaces trunk
show interface <int> switchport

Look for:

• Allowed VLANs

• Native VLAN

• Operational mode (trunk / access)

Step 2: Compare both sides of the trunk

• Allowed VLANs must match

• Native VLAN must match

• Encapsulation (dot1q) must match

Step 3: Fix inconsistent settings

Example (Cisco):

interface g0/1
 switchport mode trunk
 switchport trunk allowed vlan 1,10,20,30
 switchport trunk native vlan 99

Step 4: Verify after changes

show interfaces trunk

---

✅ 2. STP Blocking Troubleshooting

STP blocks ports to prevent loops. Sometimes the wrong port gets blocked due to STP priority or path cost.

Symptoms

• Port in blocking or discarding state

• Intermittent connectivity

• Slow network convergence

Troubleshooting Steps

Step 1: Check STP state

show spanning-tree
show spanning-tree interface <int>

Identify:

• Root bridge

• Which port is root / designated / alternate / blocking

Step 2: Verify root bridge correctness

If the wrong switch is root:

show spanning-tree root

Step 3: Fix root bridge by adjusting STP priority

Example:

spanning-tree vlan 10 priority 4096

Lower priority = more likely to be root.

Step 4: Check port cost or path cost

You may need to influence STP decisions:

spanning-tree cost <value>

Step 5: Look for unintentional loops

• Check for unmanaged switches

• Check if someone connected two wall ports together

• Patch panel mistakes

---

✅ 3. Port Security Violations Troubleshooting

Port security protects access ports. Violations occur when:

• MAC address changes

• More MACs appear than allowed

• Device moves to another port (sticky vs static)

• Unauthorized device plugged in

Symptoms

• Port goes into err-disabled

• Logs show:
  “Port-Security Violation”

Troubleshooting Steps

Step 1: Check port security status

show port-security interface <int>
show interface status err-disabled

Step 2: Identify violation reason

• Security violation count

• Allowed MAC vs detected MAC

Step 3: Clear err-disabled state

shutdown
no shutdown

Step 4: Fix the configuration

Common secure configuration:

interface f0/1
 switchport mode access
 switchport access vlan 10
 switchport port-security
 switchport port-security maximum 2
 switchport port-security mac-address sticky
 switchport port-security violation restrict

Change violation action if needed:

• protect → silently drop

• restrict → drop + log

• shutdown → port disabled

Step 5: Remove old MACs if laptop moved

clear port-security sticky interface <int>

---

📌 Summary Table

Issue	Common Cause	Key Command	Fix
VLAN mismatch	Trunk allowed/native VLAN mismatch	show interfaces trunk	Align allowed VLANs + native VLAN
STP blocking	Wrong root, loops, path cost	show spanning-tree	Adjust priority/cost, remove loops
Port-security violation	MAC changes, too many MACs	show port-security int x	Clear MACs, adjust max, change mode