Hi Expert,
Recently, one port on our 9200 switch went to err-disable state and the status LEDs are all off.
The port configuration is as below: it is connected to a desktop PC
The logs is as below, it looks before it goes to err-disable state, the port up and down for many times. seems the user was rebooting the machine
during error, checked the controller:
The machine authentication in ISE is not responded:
I just found this link seems the same issue, but not sure why the pc's MAC changed?
https://github.com/inverse-inc/packetfence/issues/1588
It occurred the second time, and can be resolved by shutdown/no shutdown to reset the port.
But we still need to find out the root cause. Any ideas about it?
Thanks
Just found another port the same error at several days ago ( we moved the same desktop to the new port), but the MAC address is not the same
Also I checked the port-security, it seems not enabled,
but the MAC address learnt from this port is showing "STATIC"
I assume the "sticky" is still on? or it is because below: authentication violation default is "shutdown"?
Steps
11001 Received RADIUS Access-Request
11017 RADIUS created a new session
15049 Evaluating Policy Group
15008 Evaluating Service Selection Policy
15048 Queried PIP - Normalised Radius.RadiusFlowType
15048 Queried PIP - DEVICE.Device Type
11507 Extracted EAP-Response/Identity
12500 Prepared EAP-Request proposing EAP-TLS with challenge
12625 Valid EAP-Key-Name attribute received
11006 Returned RADIUS Access-Challenge
11001 Received RADIUS Access-Request
11018 RADIUS is re-using an existing session
12502 Extracted EAP-Response containing EAP-TLS challenge-response and accepting EAP-TLS as negotiated
12800 Extracted first TLS record; TLS handshake started
12545 Client requested EAP-TLS session ticket
12542 The EAP-TLS session ticket received from supplicant while the stateless session resume is disabled. Performing full authentication
12805 Extracted TLS ClientHello message
12806 Prepared TLS ServerHello message
12807 Prepared TLS Certificate message
12808 Prepared TLS ServerKeyExchange message
12809 Prepared TLS CertificateRequest message
12810 Prepared TLS ServerDone message
12505 Prepared EAP-Request with another EAP-TLS challenge
11006 Returned RADIUS Access-Challenge
11001 Received RADIUS Access-Request
11018 RADIUS is re-using an existing session
12504 Extracted EAP-Response containing EAP-TLS challenge-response
12505 Prepared EAP-Request with another EAP-TLS challenge
11006 Returned RADIUS Access-Challenge
11001 Received RADIUS Access-Request
11018 RADIUS is re-using an existing session
12504 Extracted EAP-Response containing EAP-TLS challenge-response
12505 Prepared EAP-Request with another EAP-TLS challenge
11006 Returned RADIUS Access-Challenge
11001 Received RADIUS Access-Request
11018 RADIUS is re-using an existing session
12504 Extracted EAP-Response containing EAP-TLS challenge-response
12505 Prepared EAP-Request with another EAP-TLS challenge
11006 Returned RADIUS Access-Challenge
11001 Received RADIUS Access-Request
11018 RADIUS is re-using an existing session
12504 Extracted EAP-Response containing EAP-TLS challenge-response
12505 Prepared EAP-Request with another EAP-TLS challenge
11006 Returned RADIUS Access-Challenge
11001 Received RADIUS Access-Request
11018 RADIUS is re-using an existing session
12504 Extracted EAP-Response containing EAP-TLS challenge-response
12505 Prepared EAP-Request with another EAP-TLS challenge
11006 Returned RADIUS Access-Challenge
11001 Received RADIUS Access-Request
11018 RADIUS is re-using an existing session
12504 Extracted EAP-Response containing EAP-TLS challenge-response
12505 Prepared EAP-Request with another EAP-TLS challenge
11006 Returned RADIUS Access-Challenge
11001 Received RADIUS Access-Request
11018 RADIUS is re-using an existing session
12504 Extracted EAP-Response containing EAP-TLS challenge-response
12505 Prepared EAP-Request with another EAP-TLS challenge
11006 Returned RADIUS Access-Challenge
11001 Received RADIUS Access-Request
11018 RADIUS is re-using an existing session
12504 Extracted EAP-Response containing EAP-TLS challenge-response
12505 Prepared EAP-Request with another EAP-TLS challenge
11006 Returned RADIUS Access-Challenge
12935 Supplicant stopped responding to ISE during EAP-TLS certificate exchange (step latency=120000 ms Step latency=120000 ms)
61025 Open secure connection with TLS peer
5411 Supplicant stopped responding to ISE
Hi
Thanks very much for your reply.
It happened again today, with another new MAC address been seen. That's very strange, I can't find the new MAC coming from where...
We don't have IP phones or HUB or deck for the PC.
Maybe we can set it to authentication violation restrict or replace, because we use Windows 10 machine certificate and user certificate for authentication, we don't mind what MAC address it is.
Today morning the issue happened again. The same issue same desktop, and we can see that there are some up and downs yesterday afternoon, the last state at yesterday is UP, and suddenly it went to err-disable at today morning, other new MAC address appeared. The user is working from home and RDP to the desktop. no other devices at all.. where is the MAC address from..
I found this bug: https://bst.cisco.com/quickview/bug/CSCus17694 but our version is:
Cisco IOS XE Software, Version 17.09.04a
Cisco IOS Software [Cupertino], Catalyst L3 Switch Software (CAT9K_LITE_IOSXE), Version 17.9.4a, RELEASE SOFTWARE (fc3)
is it possible to verify whether the memory is leaky or not , when it happened or after I fixed it?
A work around might be setup the err-disable recovery to 5 seconds?
