NAC Mac Static

[hs08]

It's normal when we integrate the port switch to nac then the mac showing as static like below picture?

[balaji.bandi]

STATIC means someone explicitly configured those exact MAC addresses manually into the switch's configuration, or a specific security feature bound them permanently.

In a healthy, standard 802.1X or MAB NAC deployment, running the show mac add command should display the type as DYNAMIC

check what is configured on the port - show running-config interface Gi1/0/1

[hs08]

Here my config

switchport access vlan 37

 switchport mode access

 switchport voice vlan 111

 authentication host-mode multi-domain

 authentication order  dot1x mab

 authentication port-control auto

 authentication periodic

 mab

 snmp trap mac-notification change added

 snmp trap mac-notification change removed

 dot1x pae authenticator

 spanning-tree portfast

[balaji.bandi]

Configuration seems to be ok

• Multi-Domain Authentication ( multi-domain): This tells the switch to allow exactly one device in the data domain (VLAN 250) and one device in the voice domain (VLAN 111) on the same port. This is standard for a PC daisy-chained behind an IP phone.
• MAB and 802.1X (dot1x map): When these devices authenticate, the Cisco switch receives a success message from your NAC. To secure the port and ensure no other device hijacks those specific roles, the switch dynamically programs those authenticated MAC addresses into its MAC table as STATIC entries for the duration of the session.

Check some improvements for reference like multi-auth and priority (based on IBSN)

https://community.cisco.com/t5/security-knowledge-base/ise-secure-wired-access-prescriptive-deployment-guide/ta-p/3641515

[charliemak]

I get the same result, whenever the switchports use 802.1x authentication, mac address shows STATIC