topic Hi Juan and Neno, in Network Access Control

802.1x, MAC addresses with status DROP

rhub — Mon, 11 Mar 2019 02:08:12 GMT

Hi all,

we have rolled out 802.1x enterprise-wide. RADIUS-servers are ACS 1121 (5.3.0.40). Currently we are rolling-out Win7-clients.

The access-layer is built on Catalyst 3560g-48-poe, (IOS 12.2(53)SE2).

On certain switches we have the problen (only Win7-clients; XPs do not cause it) that client MAC-addresses are registered in VLAN4 (Data-VLAN) as well as in VLAN 996 (Quarantine-VLAN) according to the screen-shot below:

switch#sh mac- int gi0/27

Mac Address Table

----------------------------------------------------------------------------------------

Vlan Mac Address Type Ports

------ ------------------- ------- -------

4 2c27.d71d.6279 STATIC Drop

996 2c27.d71d.6279 DYNAMIC Gi0/27

Total Mac Addresses for this criterion: 2

Unfortunately the MAC address in VLAN 4 will never age-out, which means that they keep the above status. To wipe-out the MAC addresses we have to reboot the switch, which is no solution for us.

Has anyone faced something similar to this problem ? What is causing this problem ? How can we get rid of these MAC addresses without rebooting the switch ?

Any hints are very much appreciated

Best regards

RHUB

Did you ever get this

nspasov — Fri, 26 Jun 2015 15:04:17 GMT

Did you ever get this resolved?

Hi Neno,This has been

rhub — Wed, 01 Jul 2015 09:43:30 GMT

Hi Neno,

This has been resolved by upgrading the switches to the newest release.

Thanks for the reply! Can you

nspasov — Wed, 01 Jul 2015 16:42:20 GMT

Thanks for the reply! Can you give me the specific version. I am dealing with an issue now and running 150-2.SE6. It is not exactly the latest but pretty recent and I want to confirm 100% before I request a change control window for the upgrade.

Thanks!

Hi Neno and rhub.

esteban0477 — Mon, 25 Apr 2016 21:30:16 GMT

Hi Neno and rhub.

I'm dealing with the same issue running c2960-lanlitek9-mz.150-2.SE5, could you give please more info about your advance in this topic, maybe if you have get some documentation about it, it would be really useful for me.

Best Regards.

Juan Esteban

It looked like this was a bug

nspasov — Tue, 26 Apr 2016 15:06:47 GMT

It looked like this was a bug with the version of code. So I would suggest upgrading your code. Also, please note that LAN Lite is does not support many 802.1x features.

Thank you for rating helpful posts!

Hi Juan and Neno,

rhub — Tue, 26 Apr 2016 15:22:21 GMT

Hi Juan and Neno,

we upgraded all 3560-switches with IOS 15.0.2. but I did not have the possibility to test it; I will do it asap and let you know abut the results.

Best regards

Roman

Sounds good! Let us know :)

nspasov — Tue, 26 Apr 2016 16:06:53 GMT

Sounds good! Let us know 🙂

Re: 802.1x, MAC addresses with status DROP

davinci — Mon, 02 Mar 2020 18:37:47 GMT

I have a similar problem.

switch model/IOS: WS-C2960X-48FPD-L 15.2(7)E0a

What is the solution?

switch#sh mac address-table interface gigabitEthernet 1/0/29
Mac Address Table
-------------------------------------------

Vlan Mac Address Type Ports
---- ----------- -------- -----
16 0004.f25d.947d DYNAMIC Drop
16 10e7.c670.cbdd DYNAMIC Drop