Hello, I have 802.1x configured as follows:
Yesterday we had about 15 PCs generate 'err-disable' on the 802.1x switchports.
I suspect this was due the PC's Dell docking stations having had a firmware upgrade
My theorty is that this caused the docking stations to send their MAC address to the switchport. The switchport saw this unrecognised third MAC address on the port and thus shutdown the port with err-disable.
Does this sound feasible to you - and if so, would changing the command 'authentication violation restrict' to 'authentication violation replace' prevent the port from 'err-disabling' ?
switchport access vlan 10
switchport mode access
switchport voice vlan 110
ip flow monitor NETFLOW-TRAFFIC input
authentication event fail action next-method
authentication event server dead action authorize vlan 10
authentication event server dead action authorize voice
authentication host-mode multi-domain
authentication order mab dot1x
authentication priority dot1x mab
authentication violation restrict
mab
dot1x pae authenticator
dot1x timeout tx-period 10
spanning-tree portfast
end
Thank you.
