Hello,
I am seeing a strange intermittent connectivity issue for a dot1x session I'm testing out. We are currently using ISE 2.3 with patch 4. I'm testing out MDA for a Win10 machine and a Mitel 5320e IP phone. Each receive it's own authorization profile. The PC authenticates in the DATA domain (via dot1x) and the phone in the VOICE domain (via MAB). Each works as expected when connected to it's own port. However, when I place the PC behind the phone so that they both authenticate on the same port, I tend to lose connectivity randomly. I ran a constant ping on both tests and get no packet loss on separate ports but around 1% when on the same port. I also notice a brief bump in my connection to network applications. I have the machine authorization policy common task configured to reauthenticate every 4 hours but no reauthentication for the IP phone authZ profile. Here is a copy of the port config:
interface GigabitEthernet0/1
switchport mode access
switchport nonegotiate
switchport voice vlan 30
ip device tracking probe count 1
ip device tracking probe interval 30
ip device tracking maximum 2
srr-queue bandwidth share 1 30 35 5
priority-queue out
authentication control-direction in
authentication event fail action next-method
authentication event server dead action authorize
authentication event server dead action authorize voice
authentication event server alive action reinitialize
authentication host-mode multi-domain
authentication order dot1x mab
authentication priority dot1x mab
authentication port-control auto
authentication periodic
authentication timer reauthenticate server
authentication violation restrict
mab
mls qos trust cos
dot1x pae authenticator
dot1x timeout tx-period 10
auto qos trust
spanning-tree portfast edge
spanning-tree bpduguard enable
end
As stated before, they work as expected with no drops in connectivity when on separate ports but when together, that's when intermittent connectivity issues occur. Let me know if you have any additional questions or need any further info.
Terence
