topic Re: port security config camera not working in Network Access Control

port security config camera not working

warner1 — Mon, 01 Feb 2021 12:25:41 GMT

Hello all

after port security configuration in the switch my cameras are not working.

all the other devices in the same switch are working like Biometric.

please help me out in this regards.

Re: port security config camera not working

balaji.bandi — Mon, 01 Feb 2021 12:30:01 GMT

Camera will be MAB authentication, can you post one of the port configuraiton where Camera connected and not working

what you see on the Logs of switch and ISE ?

Re: port security config camera not working

Marcelo Morais — Mon, 01 Feb 2021 14:34:23 GMT

Hi @warner1

take a look at the following link: ISE Secure Wired Access Prescriptive Deployment Guide ... search for port-security.

Hope this helps !!!

Re: port security config camera not working

ahollifield — Mon, 01 Feb 2021 20:38:37 GMT

Do you mean port-security like the built in sticky MAC, etc. on the switch. Or are you configuring 802.1X/MAB on the switchport?

Re: port security config camera not working

warner1 — Tue, 02 Feb 2021 06:53:37 GMT

still i didnt get this....? please help me out in this.

Even though the port-security interface command enforces MAC address limit, it is not compatible with the authentication/dot1x configurations on the switch port. In general, we recommend that you do not enable port security when IEEE 802.1x is enabled.

Re: port security config camera not working

warner1 — Tue, 02 Feb 2021 06:54:31 GMT

i tried both of it but still not working my cameras are going off.

Re: port security config camera not working

Marcelo Morais — Tue, 02 Feb 2021 11:13:49 GMT

Hi @warner1

the port-secutiy is at Switch Level ... and the 802.1x is an ISE feature (in your case you are using the DOT1X/MAB configuration), that's why it's not recommended to use port-security with 802.1x.

Hope this helps !!!

Re: port security config camera not working

warner1 — Tue, 02 Feb 2021 11:44:19 GMT

Thanks @Marcelo Morais for your reply

now what i have to do for configuration of port security as it is necessary for me to configure it without going off the cameras.

i will be thankful to you for your support.

Re: port security config camera not working

ahollifield — Tue, 02 Feb 2021 12:50:05 GMT

Are you trying to use both port-security and 802.1X or just port security?

Re: port security config camera not working

ahollifield — Tue, 02 Feb 2021 12:50:45 GMT

Port-security is not supported with 802.1X. You should either choose to use 802.1X pointed at ISE or authentication or port-security.

Re: port security config camera not working

Marcelo Morais — Tue, 02 Feb 2021 20:16:57 GMT

Hi @warner1

could you please share why the port-security is a must for you? Why not configuring MAB on the port?

For port-security configuration: How to configure port-security.

For MAB configuration: Steps to configure ISE for MAB.

Hope this helps !!!

Re: port security config camera not working

warner1 — Wed, 03 Feb 2021 08:46:57 GMT

Hi @Marcelo Morais

As my manager said to configure port security to all the ports in the switch and i configured all the ports except for the camera ports. i spoke with the camera team as well but they to dont have any idea of it. what would be the best solution in your view.

please guide me in this scenario.

Re: port security config camera not working

ahollifield — Wed, 03 Feb 2021 17:14:59 GMT

Do you have both 802.1X/MAB and Port security enabled on the switchport? Please share your switchport configuration.

Re: port security config camera not working

Marcelo Morais — Wed, 03 Feb 2021 17:45:23 GMT

Hi @warner1

if my understanding is correct, your issue is not configuring MAB with ISE ... the point is, you have to configure port-security, but there is an issue between the port-security configuration and the Camera.

To troubleshoot port-security:

debug port-security

Try some simple configurations like:

interface <interface>
 shut
 switchport access vlan <VLAN>
 switchport mode access
 switchport port-security maximum 3
 switchport port-security violation  restrict
 switchport port-security
 spanning-tree portfast
 no shut

then you can use the Camera MAC Addr:

interface <interface>
 shut
 no switchport port-security maximum 3
 switchport port-security mac-address stick [MAC Addr]
 no shut

Hope this helps !!!