Limiting number of MACs with MAB and Multi-Auth (ISE 2.4)

[Ditter]

Hi to all,

i have done some searching about this and i only found the following thread:

https://community.cisco.com/t5/identity-services-engine-ise/802-1x-authentication-and-port-security-simultaneously-in-multi/td-p/3482843      but i could not reach to a result by reading this thread.

In addition, as mentioned by Cisco,   port-security and 802.1x/MAB authentications are not compatible to each other , so are we in a dead end if we want to use MAB and limit the number of data MAC addresses? 

Thanks,

Ditter.

[ognyan.totev]

Hi , with authentication host-mode multiauth you can't restrict the mac address ,the switch will try to authenticate every mac address that switch see on port ,i don't know what is the limit of mac .

If you chose multidomain it will allow you 1 mac address by data Vlan and 1 for voice

[Damien Miller · Accepted solution]

I'm not sure the best way to go about this if you need more than a single phone and endpoint. I'll echo that dot1x and port security is a pain, it's serious ugly to troubleshoot. I've seen some really weird behavior when port security config is left on dot1x ports.

That said, Cisco has documentation around using 802.1x with port security, it's not unsupported, they actually describe the expected behavior when both are used in tandem in the past catalyst configuration guides I have read.

[Ditter]

Thanks Damien, i am a little bit confused about MAB in combination with port security.

Probably it depends on the platform of catalyst swithes and/or the IOS?

My current platform is Cat4500 (SUP6L) with 152-2.E8.

Ditter.

[kthiruve]

It could platform specific as you mentioned. Please move this email thread to the switching community.

-Krishnan