query on sh mac-add

[pokwan]

Hi,

We have IP phones connected to the 3750 switches and here is the configuration of one of the port fa2/0/27

interface FastEthernet2/0/27

switchport access vlan 217

switchport mode access

switchport voice vlan 192

speed 100

duplex full

srr-queue bandwidth share 10 10 60 20

srr-queue bandwidth shape 10 0 0 0

mls qos trust device cisco-phone

mls qos trust cos

auto qos voip cisco-phone

Can please explain why when I did a sh mac-add int fa2/0/27, the IP phone mac add is in both the voice and data vlan (see below)?

sh mac-address-table int fa 2/0/27

Mac Address Table

-------------------------------------------

Vlan Mac Address Type Ports

---- ----------- -------- -----

217 000a.b81a.583b DYNAMIC Fa2/0/27

217 0014.85ce.e770 DYNAMIC Fa2/0/27

192 000a.b81a.583b DYNAMIC Fa2/0/27

Total Mac Addresses for this criterion: 3

TIA.

PF

[pokwan]

Thanks very much Ankur.

PF

[m-haddad]

Hello Guys,

Even without port-security I am seeing this behavior where the phone MAC is learned on two VLANs, the data and voice. THe main problem with this is that if you do packet capture on the PC connected to the phone you will see voice traffic reaching the PC. THis defeats the concept of having layer 2 security with voice vlan and data vlan.

If you issue the command show mac-address-table | inc "phone mac" multiple times, you will see the mac hoping between data, then voice, then data and voice, then disappaers and again goes the cycle every two seconds. THis is causing the switch to flood the traffic sometimes on the data and voice VLAN. That's why the PC see some voice packets such as skinny keep alives and skinny control messages on it's port destined to phones in the voice VLAN.

I opened a case with Cisco and they said it is normal behavior!!! However, where is the security if some traffic is getting flooded!!! I have tried the latest IOS version and same behavior.

Port security as explained in the post hides this behavior and my customer doesn't want to enable port security in the meantime!

Please advise if there is a possible solution to this security breach and flooding,

Regards,

[m-haddad]

Hello Guys,

Each phases of the cycle explained above happens every twenty seconds and not two, a typo mistake.

Thanks in advance for any clarifications,