topic Re: Port Err-Disable cisco switch usually happens on Dot1x user with I in Network Access Control

Port Err-Disable cisco switch usually happens on Dot1x user with ISE

oumodom — Mon, 16 Dec 2024 07:46:45 GMT

Dear Cisco ISE lover,

I have tried to find out the root cause on port Err-Disable whether it is the link flap or what else once we apply with Dot1x configuration?

Really appreciate for your assistance.

Re: Port Err-Disable cisco switch usually happens on Dot1x user with I

MHM Cisco World — Mon, 16 Dec 2024 07:53:52 GMT

Do you see log about violation?

MHM

Re: Port Err-Disable cisco switch usually happens on Dot1x user with I

Ambuj M — Mon, 16 Dec 2024 09:15:35 GMT

do you have phone and PC both connected to the port ? try connecting just PC and share your port config and switch log.

Re: Port Err-Disable cisco switch usually happens on Dot1x user with I

oumodom — Mon, 16 Dec 2024 09:45:36 GMT

Can see only the Err-Disable status.
Don't know which it the root cause.

Re: Port Err-Disable cisco switch usually happens on Dot1x user with I

oumodom — Mon, 16 Dec 2024 09:47:16 GMT

Yes, we configure multi-auth with phone and pc.
But for disable error happen only with pc only.

Re: Port Err-Disable cisco switch usually happens on Dot1x user with I

Ambuj M — Mon, 16 Dec 2024 09:54:33 GMT

share the port config and switch log, make sure cdp is enabled on the port, this will help VoIP phone to inform it about the dedicated voice VLAN

Re: Port Err-Disable cisco switch usually happens on Dot1x user with I

MHM Cisco World — Mon, 16 Dec 2024 10:00:08 GMT

Ok'

Show authentication session interface x/x detail

MHM

Re: Port Err-Disable cisco switch usually happens on Dot1x user with I

oumodom — Mon, 16 Dec 2024 10:41:43 GMT

CDP is disable due to security purpose.

Re: Port Err-Disable cisco switch usually happens on Dot1x user with I

Aref Alsouqi — Mon, 16 Dec 2024 11:51:27 GMT

Could you please share the output of the "sh run interface < one of the interfaces where the err-disable happens" for review? you might have switch port security applied to those ports and a violation is triggered when more than a device is connected to the port. If you have switch port security configured on those ports then the recommendation would be to remove it and rely only on dot1x.

Re: Port Err-Disable cisco switch usually happens on Dot1x user with I

Marcelo Morais — Mon, 16 Dec 2024 12:57:17 GMT

Hi @oumodom ,

please take a look at Recovery ErrDisable Port State on Cisco IOS Platform.

Hope this helps !!!

Re: Port Err-Disable cisco switch usually happens on Dot1x user with I

thomas — Mon, 16 Dec 2024 16:08:33 GMT

See to help us help you.

Re: Port Err-Disable cisco switch usually happens on Dot1x user with I

oumodom — Tue, 17 Dec 2024 02:16:08 GMT

We don't have port security applies.

Re: Port Err-Disable cisco switch usually happens on Dot1x user with I

oumodom — Tue, 17 Dec 2024 03:15:44 GMT

I will share the status then with above info @Marcelo Morais