Multiple MAC on the same interface (802.1x)

[Hevin27]

Hi Guys,

Recently ran into a problem. I enabled a simple 802.1x authentication on the switch and recently noticed that some ports had a large number of MAC addresses, when in fact only one PC was connected to that interface. Do you have any suggestions? The show mac address below shows only a subset of the macs under this interface, and each MAC has an authenticated session.

The following logs also appear:  %DOT1X-5-FAIL: Switch 1 R0/0: sessmgrd: Authentication failed for client

interface GigabitEthernet2/0/22
switchport access vlan 8
switchport mode access
switchport voice vlan 80
device-tracking attach-policy Tracking_Policy
authentication host-mode multi-auth
authentication order dot1x mab
authentication priority dot1x mab
authentication port-control auto
mab
dot1x pae authenticator
dot1x timeout server-timeout 5
dot1x timeout tx-period 3
dot1x timeout supp-timeout 3
dot1x max-req 3
dot1x max-reauth-req 3
spanning-tree portfast
spanning-tree bpduguard enable

B4-5F2-C9300Lx5_8.86#sh mac address | in 2/0/22
8 8469.939c.88bf STATIC Gi2/0/22
990 0000.0000.010a STATIC Gi2/0/22
990 0000.0000.011a STATIC Gi2/0/22
990 0000.0000.012d STATIC Gi2/0/22
990 0000.0000.014c STATIC Gi2/0/22
990 0000.0000.015e STATIC Gi2/0/22
990 0000.0000.016f STATIC Gi2/0/22
990 0000.0000.017f STATIC Gi2/0/22
990 0000.0000.018a STATIC Gi2/0/22
990 0000.0000.019e STATIC Gi2/0/22
990 0000.0000.01b8 STATIC Gi2/0/22
990 0000.0000.01c8 STATIC Gi2/0/22
990 0000.0000.01e1 STATIC Gi2/0/22
990 0000.0000.01e4 STATIC Gi2/0/22
990 0000.0000.01f2 STATIC Gi2/0/22
990 0000.0000.0214 STATIC Gi2/0/22
990 0000.0000.0275 STATIC Gi2/0/22
990 0000.0000.02ac STATIC Gi2/0/22
990 0000.0000.02d5 STATIC Gi2/0/22
990 0000.0000.02e4 STATIC Gi2/0/22
990 0000.0000.031f STATIC Gi2/0/22
990 0000.0000.0333 STATIC Gi2/0/22
990 0000.0000.033f STATIC Gi2/0/22
990 0000.0000.0341 STATIC Gi2/0/22
990 0000.0000.0350 STATIC Gi2/0/22
990 0000.0000.040f STATIC Gi2/0/22
990 0000.0000.0436 STATIC Gi2/0/22
990 0000.0000.04b8 STATIC Gi2/0/22
990 0000.0000.04c9 STATIC Gi2/0/22
990 0000.0000.052a STATIC Gi2/0/22
990 0000.0000.052c STATIC Gi2/0/22
990 0000.0000.052d STATIC Gi2/0/22
990 0000.0000.054b STATIC Gi2/0/22
990 0000.0000.0573 STATIC Gi2/0/22
990 0000.0000.0592 STATIC Gi2/0/22
990 0000.0000.05bd STATIC Gi2/0/22
990 0000.0000.0739 STATIC Gi2/0/22
990 0000.0000.0797 STATIC Gi2/0/22
990 0000.0000.07c1 STATIC Gi2/0/22
990 0000.0000.07d7 STATIC Gi2/0/22
990 0000.0000.0828 STATIC Gi2/0/22
990 0000.0000.096c STATIC Gi2/0/22
990 0000.0000.097d STATIC Gi2/0/22
990 0000.0000.0a36 STATIC Gi2/0/22
990 0000.0000.0b34 STATIC Gi2/0/22
990 0000.0000.0b5d STATIC Gi2/0/22
990 0000.0000.0bfe STATIC Gi2/0/22
990 0000.0000.0d3d STATIC Gi2/0/22
990 0000.0000.154d STATIC Gi2/0/22
990 0000.0000.1585 STATIC Gi2/0/22
990 0000.0000.1847 STATIC Gi2/0/22
990 0000.0000.195a STATIC Gi2/0/22
990 0000.0000.1996 STATIC Gi2/0/22
990 0000.0000.1ac6 STATIC Gi2/0/22
990 0000.0000.1c2d STATIC Gi2/0/22
990 0000.0000.1cd1 STATIC Gi2/0/22
990 0000.0000.1d8a STATIC Gi2/0/22
990 0000.0000.1e81 STATIC Gi2/0/22
990 0000.0000.1ec2 STATIC Gi2/0/22
990 0000.0000.2081 STATIC Gi2/0/22
990 0000.0000.215c STATIC Gi2/0/22
990 0000.0000.21b1 STATIC Gi2/0/22
990 0000.0000.23ba STATIC Gi2/0/22
990 0000.0000.2601 STATIC Gi2/0/22
990 0000.0000.2799 STATIC Gi2/0/22
990 0000.0000.29af STATIC Gi2/0/22
990 0000.0000.2b2e STATIC Gi2/0/22
990 0000.0000.2b40 STATIC Gi2/0/22
990 0000.0000.2d91 STATIC Gi2/0/22
990 0000.0000.2dae STATIC Gi2/0/22
990 0000.0000.2dd2 STATIC Gi2/0/22
990 0000.0000.2f56 STATIC Gi2/0/22
990 0000.0000.31e7 STATIC Gi2/0/22
990 0000.0000.328b STATIC Gi2/0/22
990 0000.0000.39c4 STATIC Gi2/0/22
990 0000.0000.3b01 STATIC Gi2/0/22
990 0000.0000.3b04 STATIC Gi2/0/22
990 0000.0000.3f5e STATIC Gi2/0/22
990 0000.0000.40d3 STATIC Gi2/0/22
990 0000.0000.446a STATIC Gi2/0/22
990 0000.0000.4572 STATIC Gi2/0/22
990 0000.0000.4da5 STATIC Gi2/0/22
990 0000.0000.4e7c STATIC Gi2/0/22
990 0000.0000.54ba STATIC Gi2/0/22
990 0000.0000.551e STATIC Gi2/0/22
990 0000.0000.56e4 STATIC Gi2/0/22
990 0000.0000.57ec STATIC Gi2/0/22

[marce1000]

 - Strange address , look at https://mac-address.alldatafeeds.com/mac-address-lookup/jRGqWdE956 , right column , seems to be related to some kind virtual service , offering load balancing or connectivity (e.g.) , 

 M.

[Hevin27]

On the other port, it has these MACs, I don't know what happened. When I shutdown and no shutdown the interface, the addresses disappear and reappear after a while.

990 18f7.6496.4d97 STATIC Gi2/0/46
990 1a35.9fb5.63e2 STATIC Gi2/0/46
990 1cef.3e0f.ebc2 STATIC Gi2/0/46
990 1e12.efc1.6e52 STATIC Gi2/0/46
990 1e6d.fb7d.123e STATIC Gi2/0/46
990 1ef9.6552.0719 STATIC Gi2/0/46
990 202f.6363.6d5f STATIC Gi2/0/46
990 20ff.e325.bfe8 STATIC Gi2/0/46
990 220e.d02c.c2c7 STATIC Gi2/0/46
990 223e.4568.bff4 STATIC Gi2/0/46
990 2278.2638.4740 STATIC Gi2/0/46
990 22a1.829a.aba7 STATIC Gi2/0/46
990 22a7.a56b.d99d STATIC Gi2/0/46
990 260c.3800.0088 STATIC Gi2/0/46
990 2867.e888.7430 STATIC Gi2/0/46
990 2879.6828.269c STATIC Gi2/0/46
990 2aae.d25c.9ea0 STATIC Gi2/0/46
990 2c74.c016.8dcd STATIC Gi2/0/46
990 2cd9.5270.9eaf STATIC Gi2/0/46
990 2cf7.d4c6.31a2 STATIC Gi2/0/46
990 2e1e.ecfe.0e1c STATIC Gi2/0/46
990 2e46.5e59.0d7c STATIC Gi2/0/46
990 3053.7856.f985 STATIC Gi2/0/46
990 3057.4e47.3662 STATIC Gi2/0/46
990 3082.0739.a103 STATIC Gi2/0/46
990 322d.617a.7363 STATIC Gi2/0/46
990 326a.9196.f118 STATIC Gi2/0/46
990 3280.f5f6.f807 STATIC Gi2/0/46
990 32bb.d1e9.cf66 STATIC Gi2/0/46
990 344f.0db1.21b3 STATIC Gi2/0/46
990 34a3.3fee.181d STATIC Gi2/0/46
990 34a9.1a33.ca7e STATIC Gi2/0/46
990 34e9.a08c.dadc STATIC Gi2/0/46
990 3671.3a56.9cec STATIC Gi2/0/46
990 36d2.8f59.f80f STATIC Gi2/0/46
990 3a33.373a.3234 STATIC Gi2/0/46
990 3c00.0000.3b00 STATIC Gi2/0/46
990 3c3f.786d.6c20 STATIC Gi2/0/46
990 3e00.3200.3000 STATIC Gi2/0/46
990 3eb2.8e33.784b STATIC Gi2/0/46
990 3ec8.97c6.fb76 STATIC Gi2/0/46
990 4009.09a5.ed55 STATIC Gi2/0/46
990 4030.b1d6.2e0c STATIC Gi2/0/46
990 409e.c40f.17c5 STATIC Gi2/0/46
990 40f3.32ce.9934 STATIC Gi2/0/46

[marce1000]

    - Make sure  that you don't have a loop and or that spanning tree is properly setup for vlan 990 , 

 M.

[MHM Cisco World]

authentication host-mode multi-auth <<- 
if the first host is auth and success then all other host can auth and authz 
but for mac address check if PC run any VM

[MHM Cisco World]

https://community.cisco.com/t5/switching/multiple-mac-addresses-found-in-one-interface/td-p/2289317/page/2

the Cisco TAC recommend use DHCP snooping & DAI 
so either this PC have VM or there is virus in PC 

[MHM Cisco World]

please check my other comment 

[Flavio Miranda]

Hi

 Seems you have a switch connected to this port or a server running multples virtual machines.

[Hevin27]

Hi Flavio,

No, I've checked the connections and there is only one PC connected to this port.

[Flavio Miranda]

Weird. One PC with so  many Mac address

[Hevin27]

Don't know what happened, there are more than 10,000 clients in the intranet, and only a few PCs have this problem