Showing results for 
Search instead for 
Did you mean: 

Cat 2960 shows mac address port as "Drop"


Hi all

I am configuring a Cat 2960 port for connecting a VOIP phone, authenticated by MAB.  On connecting the phone, I get the port authenticated and assigned to the correct VLAN, with LLDP-MED advertising the correct voice vlan.  However, I then see no traffic from the phone on the switch.  I can see the MAC address of the phone is learned in the right VLANs, but the mac address is showing as "Drop", which normally means the address is statically configured to be blocked.  There is no static mac address table blocking configured on the switch.   Can anyone suggest why this is happening?

Switch Version

Switch Ports Model              SW Version            SW Image

------ ----- -----              ----------            ----------

*    1 50    WS-C2960-48TC-L    15.0(1)SE3            C2960-LANBASEK9-M

Port configuration

interface FastEthernet0/1

description "Standard user port"

switchport access vlan 9

switchport mode access

network-policy 1

no logging event link-status

srr-queue bandwidth share 5 10 40 55

priority-queue out

authentication host-mode multi-auth

authentication order dot1x mab

authentication priority dot1x mab

authentication port-control auto

authentication timer reauthenticate server

mab eap

mls qos trust dscp

no snmp trap link-status

macro description vanilla_port

dot1x pae authenticator

dot1x timeout tx-period 3

dot1x timeout supp-timeout 3

spanning-tree portfast


LLDP-MED network-policy

network-policy profile 1

voice vlan 835

Authentication (debug radius) result

Jul 30 11:42:19.600: %AUTHMGR-5-START: Starting 'mab' for client (0004.f297.6668) on Interface Fa0/1 AuditSessionID 0AF0042200000063616A0592

Jul 30 11:42:19.650: %MAB-5-SUCCESS: Authentication successful for client (0004.f297.6668) on Interface Fa0/1 AuditSessionID 0AF0042200000063616A0592

Jul 30 11:42:19.650: %AUTHMGR-7-RESULT: Authentication result 'success' from 'mab' for client (0004.f297.6668) on Interface Fa0/1 AuditSessionID 0AF0042200000063616A0592

Jul 30 11:42:20.682: %AUTHMGR-5-SUCCESS: Authorization succeeded for client (0004.f297.6668) on Interface Fa0/1 AuditSessionID 0AF0042200000063616A0592

Resulting Switchport config - voice vlan is 835

CLBdg640Test-AS2960-0#show int fa0/1 switchport

Name: Fa0/1

Switchport: Enabled

Administrative Mode: static access

Operational Mode: static access

Administrative Trunking Encapsulation: dot1q

Operational Trunking Encapsulation: native

Negotiation of Trunking: Off


Trunking Native Mode VLAN: 1 (default)

Administrative Native VLAN tagging: enabled

Voice VLAN: 835 (VOICE)

Administrative private-vlan host-association: none

Administrative private-vlan mapping: none

Administrative private-vlan trunk native VLAN: none

Administrative private-vlan trunk Native VLAN tagging: enabled

Administrative private-vlan trunk encapsulation: dot1q

Administrative private-vlan trunk normal VLANs: none

Administrative private-vlan trunk associations: none

Administrative private-vlan trunk mappings: none

Operational private-vlan: none

Trunking VLANs Enabled: ALL

Pruning VLANs Enabled: 2-1001

Capture Mode Disabled

Capture VLANs Allowed: ALL

Protected: false

Unknown unicast blocked: disabled

Unknown multicast blocked: disabled

Appliance trust: none

LLDP neighbor info showing voice vlan 835

CLBdg640Test-AS2960-0#sh lldp neighbors fa0/1 detail


Chassis id:

Port id: 0004.f297.6668

Port Description - not advertised

System Name - not advertised

System Description - not advertised

Time remaining: 3558 seconds

System Capabilities: T

Enabled Capabilities: T

Management Addresses - not advertised

Auto Negotiation - supported, enabled

Physical media capabilities:





Media Attachment Unit type - not advertised

Vlan ID: - not advertised

MED Information:

    MED Codes:

          (NP) Network Policy, (LI) Location Identification

          (PS) Power Source Entity, (PD) Power Device

          (IN) Inventory

    Inventory information - not advertised

    Capabilities: NP

    Device type: Endpoint Class III

    Network Policy(Voice): VLAN 835, tagged, Layer-2 priority: 5, DSCP: 46

    PD device, Power source: PSE, Power Priority: High, Wattage: 6.5

    Location - not advertised

Total entries displayed: 1

MAC address table showing "Drop" port for learned address in VLAN 835

CLBdg640Test-AS2960-0#sh mac address-table address 0004.f297.6668

          Mac Address Table


Vlan    Mac Address       Type        Ports

----    -----------       --------    -----

   9    0004.f297.6668    STATIC      Fa0/1

835    0004.f297.6668    DYNAMIC     Drop

Total Mac Addresses for this criterion: 2

8 Replies 8


Found the problem.  Needed to send the Cisco VSA "device-traffic-class=voice" via Radius.

I am having this issue, could you share how you configured this solutions ?

found the settings on ISE,

i am also having same issue..


could you please tell me where i have to modify the settings in ISE ? because in switch port i have configured aaa authentication.


if i remove aaa config from the switch port and add the required access vlan to the switch port, is it works ?


have you got solution for interface status DROP?.

please let me know if you got it.



From ISE....Policy --> Policy Elements --> Results --> Authorization --> Authorization Profile

Whichever profile you create for the phone/voice you check the box for "Voice Domain Permission".



Hope this help.


HI, Could you please elaborate a little bit more of the solution? 


Thanks for updating the problem raarons!

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: