topic I have configured the in Network Access Control

802.1X Authentication issues when moving between switch ports

Grant McBride — Mon, 11 Mar 2019 05:22:08 GMT

Hi Guys,

We are having some issues at our office where when users move from one switch to another, the 802.1X authentication does not want to take place. The PC just gets an APIPA address. Now I have read about features that MAC Move and MAC replace but they seem to be used when moving from one port a switch to another port on that same switch. Will MAC move help for issues between switches? And should I focus my attention on the switch's configuration or have a look at the NPS server that might be blocking that authentication as the user is already authenticated?

My configuration we have on the switch ports look as follows:

authentication host-mode multi-domain
authentication order dot1x mab
authentication priority dot1x mab
authentication port-control auto

dot1x pae authenticator

Your help is greatly appreciated.

Grant

Grant-

nspasov — Thu, 22 Jan 2015 15:38:58 GMT

Grant-

authentication mac-move permit only

Only affects ports/sessions on that switch:

http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3750/software/release/12-2_52_se/command/reference/3750cr/cli1.html#wp12015821

Can you:

- Post your Radius and entire switchport config

- Tell us the model of the switch and the version of code that is running

- The type of Radius server that you are using

- Provide output from

debug radius authentication

Thank you for rating helpful posts!

Hi Neno, Thanks for the reply

Grant McBride — Fri, 23 Jan 2015 09:57:29 GMT

Hi Neno,

Thanks for the reply. We are using NPS on a Server 2008 R2 virtual machine. The switches are stacked 2960S-48FPS-L running 15.0(2)SE. I will quickly do the debugs and get back to you.

Here is the config:

aaa group server radius customer-nps
server name radius1
server name radius2

aaa authentication dot1x default group radius

dot1x system-auth-control

radius server radius1
address ipv4 172.28.130.52 auth-port 1645 acct-port 1646
key 7 05392415365959251C283630083D2F0B3B2E22253A
!
radius server radius2
address ipv4 172.28.131.52 auth-port 1645 acct-port 1646
key 7 107C2B031202052709290B092719181432190D000C

interface GigabitEthernet1/0/1
switchport access vlan 300
switchport mode access
switchport voice vlan 2
srr-queue bandwidth share 1 30 35 5
queue-set 2
priority-queue out
authentication host-mode multi-domain
authentication order dot1x mab
authentication priority dot1x mab
authentication periodic
authentication timer reauthenticate 28800
authentication timer inactivity 1800
mab
no snmp trap link-status
mls qos trust cos
dot1x pae authenticator
auto qos trust cos
storm-control broadcast level 1.00
storm-control multicast level 1.00
spanning-tree portfast
spanning-tree bpdufilter enable
!

I have configured the

Grant McBride — Fri, 23 Jan 2015 11:48:04 GMT

I have configured the "authentication violation replace" command on all the switches and now I no longer get an authentication issue. It seems the switch put the port into an err-disabled state for some reason. I assume it's because it already has an authentication session for another MAC on that port or because it sees your MAC is authenticated on another port.

%PM-4-ERR_DISABLE_VP: security-violation error detected on Gi1/0/46, vlan 300. Putting in err-disable state.

Good job on finding out a

nspasov — Sun, 25 Jan 2015 03:41:12 GMT

Good job on finding out a solution to your problem and thank you for taking the time to come back here and post the solution (+5 from me).

Real quick, I suspect that if you changed your port to authentication host-mode multi-host then the issue would probably go away. Then you can change the security to authentication violation restrict.

Nonetheless, your solution is also valid! So if your issue is resolved, please mark the thread as "answered" 🙂