topic Random MAC address between IP-Phone & supplicant the same switch port in Network Access Control

Random MAC address between IP-Phone & supplicant the same switch port

oumodom — Thu, 30 Jan 2025 04:22:14 GMT

We would like to seek your support on issue with IP Phone generate randomly the MAC address every 1 sec with endpoint profile (Xerox or Unknown device).

Syndrome of issue happen as one switch port connect to IP Phone (MAB), and another spare port on IP-Phone connect to endpoint which using Dot1x authentication.

Please note that, It doesn't generate MAC address all ports connected with IP-Phone, just less amount.

Re: Random MAC address between IP-Phone & supplicant the same swit

oumodom — Thu, 30 Jan 2025 07:12:14 GMT

@thomas Do you have any experience with this issue please?

Re: Random MAC address between IP-Phone & supplicant the same swit

ahollifield — Thu, 30 Jan 2025 11:59:50 GMT

What is the actual IP Phone? Is it running the latest firmware? Is anything plugged in behind the IP phone? What is the NAD? Is this only occurring on one port? Only on one Phone?

https://community.cisco.com/t5/security-documents/how-to-ask-the-community-for-help/ta-p/3704356

Re: Random MAC address between IP-Phone & supplicant the same swit

thomas — Fri, 31 Jan 2025 00:17:04 GMT

An IP phone should never generate a random MAC addresses like this.

Does it do work properly without the windows workstation plugged in?

Does it work with other devices plugged in behind the phone?

Has this phone ever worked properly? What changed or is different now?

Upgrade to the latest firmware as @ahollifield suggested.

You have not provided any switch configuration details so I don't know what the switch is configured to do with multiple devices on a port.

What is the reason the phone is failed every time? Why is it not allowed?

So many missing details. Call TAC.

Re: Random MAC address between IP-Phone & supplicant the same swit

oumodom — Fri, 31 Jan 2025 03:42:35 GMT

The both windows workstation and IP phone are working properly.
Windows workstation works behind IP phone.
Configuration on switch is Multi-auth.

The reason IP phone failed authentication since the MAC address out of profiling, it generates randomly most out with Xerox and unknown.

Re: Random MAC address between IP-Phone & supplicant the same swit

oumodom — Fri, 31 Jan 2025 03:46:05 GMT

IP Phone is the MAB authentication, and latest version of firmware.
It connect directed with switch port, while workstation(wired Dot1.x) runs behind IP phone spare port.

Re: Random MAC address between IP-Phone

ahollifield — Fri, 31 Jan 2025 11:06:47 GMT

What exact brand and model is the phone? Is it Android based?

Re: Random MAC address between IP-Phone & supplicant the same swit

MHM Cisco World — Sat, 01 Feb 2025 14:56:53 GMT

Mostly this issue from PC it run some kind of VM that generates random Mac.

MHM