Port Security

[hs08]

The port switch connected to the ipphone and if i plug endpoint to the port of the ipphone then the port switch is shutdown even there are no port security in the port switch. Anyone know why? Idk if this violation from the switch or from nac.

The switch use Cisco 9200 and Radius using FortiNac.

Jul 20 14:30:13: %AUTHMGR-5-SECURITY_VIOLATION: Security violation on the interface GigabitEthernet2/0/1, new MAC address (f4a8.0d3d.5aeb) is seen.AuditSessionID  11C8640A000038317E6EAFB7

 switchport access vlan 251
 switchport mode access
 authentication host-mode multi-domain
 authentication order mab dot1x
 authentication priority dot1x mab
 authentication port-control auto
 authentication periodic
 authentication timer reauthenticate 180
 mab
 snmp trap mac-notification change added
 snmp trap mac-notification change removed
 dot1x pae authenticator
 dot1x timeout quiet-period 10
 dot1x timeout server-timeout 30
 dot1x timeout tx-period 10
 spanning-tree portfast

[Mark Elsen]

  - @hs08                 If  multiple users can access the port then you also need : authentication host-mode multi-host

 M.

[hs08]

If we only use ipphone and one laptop/endpoint, isn't we use multi-domain?

[Mark Elsen · Accepted solution]

  - @hs08             authentication host-mode multi-domain   only allows one mac address on the port (remove it)

  M.

[Jonatan Jonasson]

You can use multi-domain, but the phone and the PC must be in different vlans, and by default multi-domain will allow for 1 mac address in each domain (data & voice).

Based on your config snippet, there is no voice vlan configured, so if the phone is being authenticated to the data vlan, then when you connect a computer to the phone, a second device will be authenticated to the data vlan and this may trigger a violation.

---

ref guide:

If more than one device attempts authorization on either the voice or the data domain of a port, it is error disabled.

---

And when the phone is authenticated, the switch should be receiving the device-traffic-class=voice RADIUS attribute in the accept packet.

Take a look at the multidomain authentication section in this guide for reference:

https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst9200/software/release/16-9/configuration_guide/sec/b_169_sec_9200_cg/configuring_ieee_802_1x_port_based_authentication.html#ID948

You could verify this by looking at the authentication when only the phone is connected to see if it's authenticated on the data or voice domain.