Cisco 9200 err-disable AUTHMGR-5-SECURITY_VIOLATION

[117222400]

Hi Expert,

Recently, one port on our 9200 switch went to err-disable state and the status LEDs are all off. 

The port configuration is as below: it is connected to a desktop PC

The logs is as below, it looks before it goes to err-disable state, the port up and down for many times. seems the user was rebooting the machine

during error, checked the controller:

The machine authentication in ISE is not responded:

I just found this link seems the same issue, but not sure why the pc's MAC changed?

https://github.com/inverse-inc/packetfence/issues/1588

It occurred the second time, and can be resolved by shutdown/no shutdown to reset the port.

But we still need to find out the root cause. Any ideas about it?

Thanks 

[Arne Bier]

Wow - I hope it's not a bug - I guess one way to find out is to reboot the switch and then observe - if it's a slow memory leak then you might not see this issue for a while. To be honest, I have never seen an err-disable on any of my NAC deployments, because I only use  host mode "multi-auth".   The only time I have seen err-disable in NAC deployments, was in the lab when I configured host mode multi-domain and then provoked the switch to cause the issue.

If you're 100% sure you have configured multi-auth, then you should NOT ever encounter err-disable.  Unless there is some other funky thing I didn't know about port security.  Have you opened a TAC case?

[117222400]

Thanks for your reply, we've opened a case to TAC, and they collected some packets on the port. 

We also changed the data port on the user's desk and the network cable that connected to the user's PC, the issue didn't occur for a week now. not sure if it is a cable or patching panel issue.