Issue:
When port security is enabled, no traffic is being passed from single device (no other devices connected). As soon as port security is disabled, traffic flows properly.
Port configuration as follows:
interface GigabitEthernet3/0/21
description UserPort
switchport access vlan 131
switchport mode access
switchport voice vlan 41
switchport port-security maximum 50
switchport port-security
switchport port-security aging time 1
switchport port-security violation restrict
switchport port-security aging type inactivity
power inline auto max 15400
srr-queue bandwidth share 1 30 35 5
priority-queue out
macro description CISCO_CUSTOM_EVENT
spanning-tree portfast
service-policy input AUTOQOS-SRND4-CISCOPHONE-POLICY
ip dhcp snooping limit rate 15
end
Switch#show port-security interface gig 3/0/21
Port Security : Enabled
Port Status : Secure-up
Violation Mode : Restrict
Aging Time : 1 mins
Aging Type : Inactivity
SecureStatic Address Aging : Disabled
Maximum MAC Addresses : 50
Total MAC Addresses : 0
Configured MAC Addresses : 0
Sticky MAC Addresses : 0
Last Source Address:Vlan : b00c.d136.fa81:131
Security Violation Count : 25
So if there are no mac addresses, why am I still seeing violations?
MAC address connected to the port is b00c.d136.fa81
Switch#show mac address-table address b00c.d136.fa81
Mac Address Table
-------------------------------------------
Vlan Mac Address Type Ports
---- ----------- -------- -----
Doesn't show up on any interfaces.
Switch#show mac address-table interface gig 3/0/21
Mac Address Table
-------------------------------------------
Vlan Mac Address Type Ports
---- ----------- -------- -----
Doesn't show up on the interface in question.
But, if I disable port security on that port using a "no switchport port-security" resulting in the following:
interface GigabitEthernet3/0/21
description UserPort
switchport access vlan 131
switchport mode access
switchport voice vlan 41
switchport port-security maximum 50
switchport port-security aging time 1
switchport port-security violation restrict
switchport port-security aging type inactivity
power inline auto max 15400
srr-queue bandwidth share 1 30 35 5
priority-queue out
macro description CISCO_CUSTOM_EVENT
spanning-tree portfast
service-policy input AUTOQOS-SRND4-CISCOPHONE-POLICY
ip dhcp snooping limit rate 15
end
Packets are flowing again.
Switch#show mac address-table address b00c.d136.fa81
Mac Address Table
-------------------------------------------
Vlan Mac Address Type Ports
---- ----------- -------- -----
131 b00c.d136.fa81 DYNAMIC Gi3/0/21
Total Mac Addresses for this criterion: 1
Switch#show mac address-table interface gig 3/0/21
Mac Address Table
-------------------------------------------
Vlan Mac Address Type Ports
---- ----------- -------- -----
131 b00c.d136.fa81 DYNAMIC Gi3/0/21
Total Mac Addresses for this criterion: 1
Any ideas why this would be taking place?
It's just a single laptop connected to a single port.
Previously (last week) this port was connected to a dumb switch. It was looped on our network by mistake (two Cisco interfaces going to two dumb switchports), but the interfaces in question, including this one Gi3/0/21, have been shut/no shut a few times since. Also cleared out all addresses for that interface using the clear port-security command.
What I can't tell is WHY this interface in violation. Aging is set, max MAC's is 50 even though this interface only has 1 MAC.... Just not sure. I'm usually a Juniper person, so Cisco has me scratching my head for cases like this.
Any help is appreciated.
