cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements
 
Register for the monthly ISE Webinars to learn about ISE configuration and deployment.
Choose one of the topics below to view our ISE Resources to help you on your journey with ISE

This community is for technical, feature, configuration and deployment questions.
For production deployment issues, please contact the TAC! We will not comment or assist with your TAC case in these forums.
Please see How to Ask the Community for Help for other best practices.

524
Views
20
Helpful
5
Replies
Contributor

802.1x Authentication and Port-Security simultaneously in multi-auth mode

We were trying to determine if there is a solution to limit then number of MAC addresses learned on a port if 802.1x is deployed in multi-auth mode. I had previously read not to use 802.1x and port-security.  I have also read that is not a supported solution. 

1 ACCEPTED SOLUTION

Accepted Solutions
Rising star

Re: 802.1x Authentication and Port-Security simultaneously in multi-auth mode

to my knowledge cisco best practice is not to configure 1.x with port-security. unless they change this practice or i gone too old.

please do not forget to rate.
5 REPLIES 5
Rising star

Re: 802.1x Authentication and Port-Security simultaneously in multi-auth mode

to this date there is no solution to combine the 802.1x with port security. and it still stand not combine the port-security and dot1x on same port. as port-security is at switch level and 1.x is ISE feature.

please do not forget to rate.
Rising star

Re: 802.1x Authentication and Port-Security simultaneously in multi-auth mode

In a previous job we had a similar requirement. We manually implement port-security on 8021x host facing ports. However, the requirement we required from end users/different labs was how many hosts will you want on specific ports. From there we would implement port-sec and set the max to whatever the number was that got approved. It definitely created issues from time to time with end users being unaware or missing information, and simply moving hosts to other ports causing them to go err-disabled.

HTH!
Rising star

Re: 802.1x Authentication and Port-Security simultaneously in multi-auth mode

to my knowledge cisco best practice is not to configure 1.x with port-security. unless they change this practice or i gone too old.

please do not forget to rate.
Highlighted
Beginner

Re: 802.1x Authentication and Port-Security simultaneously in multi-auth mode

That's correct. And I've seen some issues with 802.1X and port-security enabled combined with MAB IP-Phones and 1X endpoints behind them where the switchport was err-disabled when a computer was plugged in the phone pass-through port.
Contributor

Re: 802.1x Authentication and Port-Security simultaneously in multi-auth mode

I have read that it was not a best practice. I just wanted to make sure.