Cisco ISE and Cisco phone result in voice VLAN MAC-address drop

[andre]

Goodmorning,

Have a ISE deployment with Meraki switches and Cisco phones, these authenticate ok. Phone start in the voice VLAN. Result contains voice domain permission and able to push the voice VLAN.

When using a Cisco cat 3650 (16.09.03) the phone gets authenticated, see the correct result being pushed with voice domain permission. However the phone MAC-addres is visible in data VLAN and voice VLAN. In voice VLAN the MAC-address is showing DYNAMIC Drop, in data VLAN it shows STATIC Gi2/0/5 (which is port number phone is connected to). 

Any idea what is causing this?

Thanks in advance. 

Kind regards

[balaji.bandi]

check this may help you :

https://community.cisco.com/t5/network-access-control/mac-address-table-showing-drop-on-voice-vlan-when-critical/td-p/4101860

[Arne Bier]

Check CDP on the switch and phone. The voice VLAN is signalled via CDP (or LLDP in other vendors). If this is broken, then the phone has no idea what VLAN to tag the phone traffic with.