Hi Everyone,
Wanted to see if anyone has observed this design issue I have been noticing. (Across multiple code trains).
Most of my testing at this point has been done on 9200 Compact, but issues seems to be persistent on different hardware.
Goal: Restrict port to One Workstation, One Phone, using host-mode multi-domain.
Important to note the Interface is operating in open mode from an ISE authentication perspective
Issue: Enforcement behavior differences between "restrict" and "protect"
Restrict mode does not seem to properly enforce the expected behavior with Access-session host-mode multi-domain
1) Protect works as expected, and is properly enforcing the port to One Workstation, One Phone
protect - silently drop violating packets
2) Restrict mode seems to be operating in a very buggy pattern, and not enforcing (sort of)
restrict - drop violating packets and generate a syslog
To my understanding, both options should do enforcement, restrict mode also providing syslogging on the failure.
Details on findings:
On the surface, both modes seem to be doing the same thing. Here are the similarities (what's working)
1) Both modes restrict allowed authentications to 2 devices.
show access-session interface gigabitEthernet 1/0/8
Security violation caused by 1111.2222.3333: Violation action is (restrict or protect)
Interface MAC Address Method Domain Status Fg Session ID
Gi1/0/8 1111.1111.1111 dot1x VOICE Auth XXXXXXXXX
Gi1/0/8 2222.2222.2222 mab DATA Auth XXXXXXXXX
2) Both modes limit the mac address table to 2 devices
show mac address-table | include 1/0/8
10 1111.1111.1111 STATIC Gi1/0/8
13 2222.2222.2222 STATIC Gi1/0/8
Here is what's not working / buggy? (Restrict mode only)
1) Device-Tracking Database is learning about additional devices
show device-tracking database | inc 1/0/8
ARP 10.10.13.1 2222.2222.2222 Gi1/0/8 13 0005 1s REACHABLE
DH4 10.10.10.1 1111.1111.1111 Gi1/0/8 10 0024 41s REACHABLE
DH4 10.10.13.2 1111.2222.3333 Gi1/0/8 13 0024 3s REACHABLE
Now this is where things get weird
- Running restrict mode, only 2 devices are authenticated
- Only 2 MACs are learned in the MAC address table (matching the authenticated devices
- All 3 devices are still pingable / reachable
What this looks like to me, is while restrict mode is preventing additional devices from showing up in the MAC address table, it is NOT actually dropping traffic as described. Protect mode does not have the same issue.
Any thoughts on this fun one? !
