cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
749
Views
0
Helpful
2
Replies

ISE-switchport session remain authenticated

sudheere
Level 1
Level 1

I am facing a problem during deployment. Customer is using Avaya IP phone. If an autheticated workstation/laptop shift from one phone to another, the old switchport session remain there. The laptop acquire IP from new phone but even fail to ping gateway. If I do old phone reset or do 'clear authen sess interface', then laptop ping gateway. 'Clear arp' or 'clear mac-add table dynam' doesnt solve the issue. How can the ISE detect removal of a workstation to clear the authentication.

2 Replies 2

tomi.sirait
Level 1
Level 1

two ways:

  1. CDP enhancement for second port disconnect (Cisco phones) 
  2. Proxy EAPoL-Logoff + inactivity timer (non-Cisco phones)

http://www.cisco.com/en/US/docs/solutions/Enterprise/Security/TrustSec_1.99/Dot1X_Deployment/Dot1x_Dep_Guide.html

Stephen McBride
Level 1
Level 1

authentication mac-move permit