port security config camera not working

[warner1]

Hello all

after port security configuration in the switch my cameras are not working. 

all the other devices in the same switch are working like Biometric.

please help me out in this regards.

[balaji.bandi]

Camera will be MAB authentication, can you post one of the port configuraiton where Camera connected and not working

what you see on the Logs of switch and ISE ?

[Marcelo Morais]

Hi @warner1 

 take a look at the following link: ISE Secure Wired Access Prescriptive Deployment Guide  ... search for port-security.

Hope this helps !!!

[warner1]

still i didnt get this....? please help me out in this.

Even though the port-security interface command enforces MAC address limit, it is not compatible with the authentication/dot1x configurations on the switch port. In general, we recommend that you do not enable port security when IEEE 802.1x is enabled.

[Marcelo Morais]

Hi @warner1 

 the port-secutiy is at Switch Level ... and the 802.1x is an ISE feature (in your case you are using the DOT1X/MAB configuration), that's why it's not recommended to use port-security with 802.1x.

Hope this helps !!!

[warner1]

Thanks @Marcelo Morais for your reply

now what i have to do for configuration of port security as it is necessary for me to configure it without going off the cameras.

i will be thankful to you for your support.

[ahollifield]

Are you trying to use both port-security and 802.1X or just port security?

[Marcelo Morais]

Hi @warner1 

 could you please share why the port-security is a must for you? Why not configuring MAB on the port?

For port-security configuration: How to configure port-security.

For MAB configuration: Steps to configure ISE for MAB.

Hope this helps !!!

[warner1]

Hi @Marcelo Morais 

As my manager said to configure port security to all the ports in the switch and i configured all the ports except for the camera ports. i spoke with the camera team as well but they to dont have any idea of it. what would be the best solution in your view.

please guide me in this scenario.

[ahollifield]

Do you have both 802.1X/MAB and Port security enabled on the switchport?  Please share your switchport configuration.

[Marcelo Morais · Accepted solution]

Hi @warner1 

 if my understanding is correct, your issue is not configuring MAB with ISE ... the point is, you have to configure port-security, but there is an issue between the port-security configuration and the Camera.

 To troubleshoot port-security:

debug port-security

Try some simple configurations like:

interface <interface>
 shut
 switchport access vlan <VLAN>
 switchport mode access
 switchport port-security maximum 3
 switchport port-security violation  restrict
 switchport port-security
 spanning-tree portfast
 no shut

then you can use the Camera MAC Addr:

interface <interface>
 shut
 no switchport port-security maximum 3
 switchport port-security mac-address stick [MAC Addr]
 no shut

Hope this helps !!!

[ahollifield]

Do you mean port-security like the built in sticky MAC, etc. on the switch.  Or are you configuring 802.1X/MAB on the switchport?

[warner1]

i tried both of it but still not working my cameras are going off.

[ahollifield]

Port-security is not supported with 802.1X.  You should either choose to use 802.1X pointed at ISE or authentication or port-security.