Solved

Switch running 802.1x does not clear its MAC address table

Posted on 2015-01-30
3
209 Views
Last Modified: 2015-03-11
Hi,

I have a stack of switches that are running dot1x

description Dot1X Enabled
 switchport mode access
 switchport voice vlan 10
 switchport port-security aging time 1
 switchport port-security aging type inactivity
 authentication event fail action authorize vlan 1
 authentication event server dead action authorize vlan 1
 authentication event server alive action reinitialize 
 authentication host-mode multi-domain
 authentication order dot1x mab
 authentication priority dot1x mab
 authentication port-control auto
 authentication periodic
 authentication timer reauthenticate server
 authentication violation replace
 mab
 mls qos trust dscp
 dot1x pae authenticator
 dot1x timeout tx-period 3
 spanning-tree portfast
 spanning-tree bpduguard enable

Open in new window


if the device authenticates using MAB, then even after it has been disconencted the MAC address still stays in the MAC address table

DP1-West#sh mac address-table int g1/0/33
          Mac Address Table
-------------------------------------------

Vlan    Mac Address       Type        Ports
----    -----------       --------    -----
   1    9c93.4e55.3135    STATIC      Gi1/0/33 
Total Mac Addresses for this criterion: 1
DP1-West#

DP1-West#sh int g1/0/33    
GigabitEthernet1/0/33 is down, line protocol is down (notconnect) 
  Hardware is Gigabit Ethernet, address is 34db.fd2e.6d21 (bia 34db.fd2e.6d21)
  Description: Dot1X Enabled
  MTU 1500 bytes, BW 1000000 Kbit/sec, DLY 10 usec, 
     reliability 255/255, txload 1/255, rxload 1/255

Open in new window


this is stopping devices working and I can see no way to remove the mac address from the table, there is no "clear mac address-table static command.

Cisco IOS Software, C2960X Software (C2960X-UNIVERSALK9-M), Version 15.0(2)EX5, RELEASE SOFTWARE (fc1)
cisco WS-C2960X-48FPD-L (APM86XXX) processor (revision A0) with 524288K bytes of memory

Any ideas where this is going wrong as it means that the first time we attach a decvice it will work. but after that the port will never work for another device of if the device moves to another port. I dove have "allow mac move" enabled global.
0
Comment
Question by:Aaron Street
  • 2
3 Comments
 
LVL 3

Accepted Solution

by:
Stephen Berk earned 500 total points
ID: 40581068
0
 
LVL 16

Author Comment

by:Aaron Street
ID: 40581860
Hi,

good spot. But actually this was applied after the issue had been happening so is no the cause. I got a suggestion from someone else saying to enable port-security timeout.

this happens to be the only port on the switch with this config applied, typical that its the one I used to copy the config from.

Cheers
0
 
LVL 16

Author Closing Comment

by:Aaron Street
ID: 40658384
In the end it was an issue with portchannels and IOS version, all fixed now
0

Featured Post

Microsoft Certification Exam 74-409

Veeam® is happy to provide the Microsoft community with a study guide prepared by MVP and MCT, Orin Thomas. This guide will take you through each of the exam objectives, helping you to prepare for and pass the examination.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Guest Wi-Fi Marketing solution required 8 59
What to look for in Fraud Protection Solutions  PoC 1 33
Botnet detection help me please 21 81
Interface VLAN dependencies 6 32
ADCs have gained traction within the last decade, largely due to increased demand for legacy load balancing appliances to handle more advanced application delivery requirements and improve application performance.
For many of us, the  holiday season kindles the natural urge to give back to our friends, family members and communities. While it's easy for friends to notice the impact of such deeds, understanding the contributions of businesses and enterprises i…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Here's a very brief overview of the methods PRTG Network Monitor (https://www.paessler.com/prtg) offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…

919 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

16 Experts available now in Live!

Get 1:1 Help Now