cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
3957
Views
20
Helpful
5
Replies

802.1x Authentication and Port-Security simultaneously in multi-auth mode

Alex Pfeil
Level 7
Level 7

We were trying to determine if there is a solution to limit then number of MAC addresses learned on a port if 802.1x is deployed in multi-auth mode. I had previously read not to use 802.1x and port-security.  I have also read that is not a supported solution. 

1 Accepted Solution

Accepted Solutions

to my knowledge cisco best practice is not to configure 1.x with port-security. unless they change this practice or i gone too old.

please do not forget to rate.

View solution in original post

5 Replies 5

to this date there is no solution to combine the 802.1x with port security. and it still stand not combine the port-security and dot1x on same port. as port-security is at switch level and 1.x is ISE feature.

please do not forget to rate.

Mike.Cifelli
VIP Alumni
VIP Alumni
In a previous job we had a similar requirement. We manually implement port-security on 8021x host facing ports. However, the requirement we required from end users/different labs was how many hosts will you want on specific ports. From there we would implement port-sec and set the max to whatever the number was that got approved. It definitely created issues from time to time with end users being unaware or missing information, and simply moving hosts to other ports causing them to go err-disabled.

HTH!

to my knowledge cisco best practice is not to configure 1.x with port-security. unless they change this practice or i gone too old.

please do not forget to rate.

That's correct. And I've seen some issues with 802.1X and port-security enabled combined with MAB IP-Phones and 1X endpoints behind them where the switchport was err-disabled when a computer was plugged in the phone pass-through port.

I have read that it was not a best practice. I just wanted to make sure.