Random MAC address between IP-Phone & supplicant the same switch port

[oumodom]

We would like to seek your support on issue with IP Phone generate randomly the MAC address every 1 sec with endpoint profile (Xerox or Unknown device). 

Syndrome of issue happen as one switch port connect to IP Phone (MAB), and another spare port on IP-Phone connect to endpoint which using Dot1x authentication.

Please note that, It doesn't generate MAC address all ports connected with IP-Phone, just less amount. 

[oumodom]

@thomas Do you have any experience with this issue please? 

[thomas]

An IP phone should never generate a random MAC addresses like this.

Does it do work properly without the windows workstation plugged in?

Does it work with other devices plugged in behind the phone?

Has this phone ever worked properly? What changed or is different now?

Upgrade to the latest firmware as @ahollifield suggested.

You have not provided any switch configuration details so I don't know what the switch is configured to do with multiple devices on a port.

What is the reason the phone is failed every time? Why is it not allowed?

So many missing details. Call TAC.

[oumodom]

The both windows workstation and IP phone are working properly.
Windows workstation works behind IP phone.
Configuration on switch is Multi-auth.

The reason IP phone failed authentication since the MAC address out of profiling, it generates randomly most out with Xerox and unknown.  

[ahollifield]

What exact brand and model is the phone? Is it Android based?

[MHM Cisco World]

Mostly this issue from PC it run some kind of VM that generates random Mac. 

MHM

[ahollifield]

What is the actual IP Phone?  Is it running the latest firmware?  Is anything plugged in behind the IP phone?  What is the NAD?  Is this only occurring on one port?  Only on one Phone?  

https://community.cisco.com/t5/security-documents/how-to-ask-the-community-for-help/ta-p/3704356

[oumodom]

IP Phone is the MAB authentication, and latest version of firmware.
It connect directed with switch port, while workstation(wired Dot1.x) runs behind IP phone spare port.