Hello @alliasneo1
Some adjustments...
Problem 1:
The issue occurs because the StarTech docking station's MAC address is detected and sent to ISE during the initial 802.1X authentication process. When a compliant laptop is connected and successfully authenticates, the docking station's MAC address is incorrectly logged under the PC's name. This happens because the switch first sees the dock's MAC address before the laptop establishes its 802.1X identity. Additionally, devices like docks and phones can interfere with the normal operation of 802.1X when they don’t authenticate via 802.1X themselves.
You could create an exception for the dock's MAC address using MAC Authentication Bypass (MAB) in ISE. Configure a policy to allow the dock's MAC address in a specific profile, marking it as an "IT-approved device" or similar. This prevents the dock from being logged incorrectly under the PC. Alternatively, you could use profiling in ISE to classify the dock as an "Unknown Device" and assign it a separate policy with limited network access. Another approach is to enable multi-authentication mode on the switchport, which allows the phone, dock, and laptop to authenticate independently, ensuring proper separation of identities in ISE.
Problem2:
When an unauthorized laptop is connected, the laptop fails authentication, but ISE continues to log the dock’s MAC address repeatedly, even after the laptop is disconnected. This likely happens because the Mitel phone keeps the switchport link active to maintain connectivity with the network, causing the switch to repeatedly attempt MAB for the dock. Since the dock doesn’t have activity lights without a connected laptop, the issue is exacerbated by the phone maintaining the port's operational state.
You should enable authentication control directions on the switchport. Configure the port to authenticate devices only on the ingress (incoming traffic) direction, ensuring the dock's MAC isn’t repeatedly sent after the laptop is unplugged. Additionally, enable port security to limit the number of MAC addresses allowed on the port. Set a timeout for stale MAC entries so the dock’s MAC address ages out after disconnection. On ISE, you can configure a re-authentication timer to avoid persistent attempts for inactive devices. If the phone requires persistent network access, place the phone in a separate VLAN or use a dedicated authentication policy to distinguish it from other devices.
Best regards
.ı|ı.ı|ı. If This Helps, Please Rate .ı|ı.ı|ı.
