802.1x Authentication and Port-Security simultaneously in multi-auth mode

[Alex Pfeil]

We were trying to determine if there is a solution to limit then number of MAC addresses learned on a port if 802.1x is deployed in multi-auth mode. I had previously read not to use 802.1x and port-security.  I have also read that is not a supported solution. 

[Sheraz.Salim]

to this date there is no solution to combine the 802.1x with port security. and it still stand not combine the port-security and dot1x on same port. as port-security is at switch level and 1.x is ISE feature.

[Mike.Cifelli]

In a previous job we had a similar requirement. We manually implement port-security on 8021x host facing ports. However, the requirement we required from end users/different labs was how many hosts will you want on specific ports. From there we would implement port-sec and set the max to whatever the number was that got approved. It definitely created issues from time to time with end users being unaware or missing information, and simply moving hosts to other ports causing them to go err-disabled.

HTH!

[Sheraz.Salim · Accepted solution]

to my knowledge cisco best practice is not to configure 1.x with port-security. unless they change this practice or i gone too old.

[Maxee]

That's correct. And I've seen some issues with 802.1X and port-security enabled combined with MAB IP-Phones and 1X endpoints behind them where the switchport was err-disabled when a computer was plugged in the phone pass-through port.

[Alex Pfeil]

I have read that it was not a best practice. I just wanted to make sure.