802.1x port security violation with authentication host-mode multi-domain

[Majed Zouhairy]

Peace, i want to use 802.1x for voice and data, but when ever i configure

authentication host-mode multi-domain

the port becomes error disabled with reason security, which is 802.1x

if i switch it to

authentication host-mode multi-host

then the port stays up but the ip phone bypasses the authentication.

here is the port configuration:
interface GigabitEthernet1/0/25
description test
switchport access vlan 21
switchport mode access
switchport voice vlan 20
authentication host-mode multi-domain
dot1x pae authenticator
spanning-tree portfast
spanning-tree bpduguard enable

ios version:

Cisco IOS Software, C2960X Software (C2960X-UNIVERSALK9-M), Version 15.0(2a)EX5, RELEASE SOFTWARE (fc3)

is it a bug or a misconfiguration?

[Mohammed al Baqari]

What is connected behind this port. Multi-Domain will allow single MAC for data and single MAC for voice. If you have VMs running or softphone it will cause error

[Majed Zouhairy]

well i know that multi-domain is used for voip and so i configured it with a ip phone and a pc.

[Mohammed al Baqari]

But what I said that you need to verify how many macs are beind the port per vlan. It will allow one mac per vlan

[Majed Zouhairy]

Well it seems you do not know that the ip phone appears in the data vlan also. so perhaps the problem is that there are 3 macs?

[Mohammed al Baqari]

Ip phones shouldn't appear in voice vlan if it's configured in the switch port unless I am missing something 

[Mohammed al Baqari]

Kust to confirm, are you using cisco ip phone

[Majed Zouhairy]

since cdp is enabled, you can conclude it is a cisco phone.

check this out:
skorini-48-2960X#sh mac address-table interface g1/0/25
          Mac Address Table
-------------------------------------------

Vlan    Mac Address       Type        Ports
----    -----------       --------    -----
  20    2c0b.e914.3872    DYNAMIC     Gi1/0/25
  21    2c0b.e914.3872    DYNAMIC     Gi1/0/25
  21    c46e.1f15.8009    DYNAMIC     Gi1/0/25
Total Mac Addresses for this criterion: 3

[Majed Zouhairy]

what is bewildering, is that, the phone gets authenticated on the data vlan:
Vlan    Mac Address       Type        Ports
----    -----------       --------    -----
  20    2c0b.e914.3872    DYNAMIC     Drop
  21    2c0b.e914.3872    STATIC      Gi1/0/25
  21    c46e.1f15.8009    DYNAMIC     Drop

before the prot gets error diabled.

[MEB]

Hi...Any Luck in Solving such issues As i am suffering from a very Similar one 

Below is the associated discussion 

************************

https://supportforums.cisco.com/t5/lan-switching-and-routing/catalyst-45-series-sup8e-802-1x-ports-getting-error-disabled/m-p/3338773#M406548

***************************

Bregards