vlan leak into other vlans

[originalCox]

have been trying to troubleshoot our network. problem is, vlans used to communicate in their respective vlan IDs. but after deployment of cisco ISE, the vlans started overlapping where by a vlan like vlan 40 for data allows traffic for internet vlan 50 and vice verser. end after powering down the cisco ISE, the problem is still there. what could be the possible problem and solution here?

[balaji.bandi]

Check your ISE Deployment, make sure you have correct Matrix and Right VLAN Tagged to 40 or 50, is the IP address coming to right IP address where 40 and 50,

Is this working before ISE deployment ?

is this till issue after you remove dot1.x deployment ?

if your switch configured for Openfail that mean it should work as expected.

connect laptop and check with VLAN 50 and 40 has correct IP address where they belong to is the starting point

provide more information and config of the switch VLAN 40 and 50 also IP address to understand better.

[originalCox]

everything was fine before ise deployment. but after ise deployment, vlans started seeing each other and leaking into each other. The problem now is that , we have shutdown Cisco ise for the moment to find out the problem. but even after shutting down the ise, the problem has remained there on the network from the distribution switches all the way to the access switches that were configured with ise client settings

[pieterh]

I don't think ISE itself is the problem. there will have been another network config change to implement ISE
but you provide very little specific information about your topology. and the problem

- what traffic do you observe?
- where does it come from? (host, mac address switchport)
- where should it come from?
First check if no-one connected a vlan40 port into a vlan50-port !

and than again you do not have any routing from vlan40 to vlan50 ?

[originalCox]

traffic is normal but the ise client settings are still there

[MHM Cisco World]

I think the problem is on dACL from ISE

ISE dACL make connection between both VLAN

[originalCox]

well, we shut down cisco ise but problem is still there on distribution and access switches

[balaji.bandi]

If the ACL if already distributed on working port with ISE policy, that need to be removed to work. by removing ISE or shutdown the ISE may not work.

please post one of the configs of the switch to understand what changes ISE made?