Cisco 4506 802.1x Issues

[cjebbs]

This same issue was posted in March 08 and I was wondering if anyone had found a resolution.

We have recently turned 802.1x on in our office environment. It appears to work very well except anywhere from 1 to 3 times a day a mac address which is plugged into one port, shows up on another effectively disabling the port with the following message:

<45>3740: Oct 14 13:23:33: %DOT1X-5-SECURITY_VIOLATION: Security violation on interface GigabitEthernet4/5, New MAC address xxx.xxx.xxx is seen
<45>3741: on the interface in Single Host mode
<44>3742: Oct 14 13:23:33: %PM-4-ERR_DISABLE: security-violation error detected on Gi4/5, putting Gi4/5 in err-disable state


The only way to resolve it is to shut the port and then re-enable.

 

[burtsbees]

You must have

switchport port-security max
or
switchport port-security mac sticky

Post a sh run int ge4/5

/

tim@tim-laptop ~ $ sudo apt-get install windows
Reading package lists... Done
Building dependency tree
Reading state information... Done
E: Couldn't find package windows...Thank Goodness!

 

[baddos]

How does it show up on another port? Are these laptops or such moving around and plugging into different jacks?

 

[cjebbs]

The machines are not moving, in fact the biggest offender is a desktop. Basically, this desktop, which is an exception and plugged into a hub which is plugged into a port with no dot1x enabled, shows up on another port effectively shutting down the security enabled port. Here is the configuration of all dot1x ports.

interface GigabitEthernet3/1
switchport access vlan 47
switchport mode access
dot1x port-control auto
dot1x timeout quiet-period 5
dot1x timeout tx-period 5
dot1x guest-vlan 99
spanning-tree portfast
end

There are six identified systems, out of 128, which show up on other ports. I am searching the biggest offender for malware now but I have never seen a piece of malware act like this.

 

[VinceWhirlwind]

I've seen this on Nortel switches. Nasty. Cured with a firmware upgrade.

do a sh ver.

 

[leedsit]

We had this on some core 6509`s a year or two back. it was a pain in the rear as it would come and go. Before Cisco would do anything they wanted show commands during the issue but it was tricky to catch. In the end a code upgrade fixed it.

LEEroy
MCNE6,CCNP,CWNA,CCSA,Project+

 

[cjebbs]

Yeah,
I was afraid of that. We are running 12.2(25). I am going to put in for cc for an upgrade this week. Strange, it hasn't happened yet today. I will track it and see if the upgrade resolves the problem.