multiple MAB on a switch port connecting to an AP

[harrzhan]

We have seen a strange issue:

On a switch port (3850) we have put dot1x and MAB on, and the device is an Cisco AP. We have seen 10+ MAB authentication on this port for the wireless end devices MAB, all failing because of the policy.

Why is the port trying to authenticate the wireless endpoints?

the port is configured as multi-host, and it is an access port. The AP is in LOCAL mode. someone suggest to put it on multi-domain to solve it, but this does not make sense in the first place

[Surendra]

I believe the packets are being centrally switched in which case all the traffic from the wireless endpoints be tunnelled to the WLC for them to be switched. Ideally all of those mac addresses should not be seen on the switch port. Would suggest to take a SPAN capture on the port to see what those mac addresses are.

[harrzhan]

We can see the MAC addresses, and they are the wireless MACs from the wireless devices.

We are using 16.6.4 code on 3850. We do not see this behavior on 3750.

[Surendra]

I did not find any known issues related to such an issue (Data Traffic leak) in my research barring the fact you are on a code which has service impacting defects like memory leaks etc. the closest to the problem or defect on this case that I could see is insufficient power being grated to the APs over PoE. Not sure if that would affect the APs capability to tunnel traffic.

[Dustin Anderson · Accepted solution]

APs usually drop a radio if there is not enough power. It almost sounds like the AP is acting like it's in FlexConnect where it does the routing and only tunnels command info back to the WLC. A normal AP should capwap tunnel everything back to the WLC and the switch should not see any of the traffic.

May be a TAC call.