H3C S5500-SI Series Operation Manual page 684

Analysis
Changing port security mode is not allowed when an 802.1X-authenticated or MAC authenticated user
is online.
Solution
Use the cut command to forcibly disconnect the user from the port before changing the port security
mode.
[Switch-GigabitEthernet1/0/1] quit
[Switch] cut connection interface gigabitethernet 1/0/1
[Switch] interface gigabitethernet 1/0/1
[Switch-GigabitEthernet1/0/1] undo port-security port-mode
1-21