Seeing extra Te1/1/1 entries in authentication session output

[RIYAJOSHI]

Hi All,

Can anyone help me here ?

I configured my access switch(9300) with do1x config and my connected endpoints are authenticating correctly by ISE server.

But not sure why I can see Te1/1/1 entries too in the output of authentication session.

Logs:-

1092-b1f4-as5-lan#sh authentication sessions
Interface MAC Address Method Domain Status Fg Session ID
--------------------------------------------------------------------------------------------
Te1/1/1 0000.0c07.ac86 N/A UNKNOWN Unauth 0F86470A00000D15CF960823
Te1/1/1 0000.0c07.acc3 N/A UNKNOWN Unauth 0F86470A00000D12CF960743
Te1/1/1 0000.0c07.accc N/A UNKNOWN Unauth 0F86470A00000D1CCF960CBB
Te1/1/1 0000.0c07.acd0 N/A UNKNOWN Unauth 0F86470A00000D10CF9606F3
Te1/1/1 000a.d501.f75e N/A UNKNOWN Unauth 0F86470A00000DBDCFA37DF7
Te1/1/1 000a.d501.f84f N/A UNKNOWN Unauth 0F86470A00000DBACFA37997
Te1/1/1 000a.d501.f868 N/A UNKNOWN Unauth 0F86470A00000DBCCFA37A27
Te1/1/1 0015.5dcf.1402 N/A UNKNOWN Unauth 0F86470A00000DEBD0ECC668
Te1/1/1 0015.5dcf.dc00 N/A UNKNOWN Unauth 0F86470A00000D51CF96A7C2
Te1/1/1 0015.5dcf.dc05 N/A UNKNOWN Unauth 0F86470A00000DF2D1815A64
Te1/1/1 0015.5dcf.dc06 N/A UNKNOWN Unauth 0F86470A00000DF3D181AACB
Te1/1/1 0015.5dcf.dc07 N/A UNKNOWN Unauth 0F86470A00000DF4D18206E3
Te1/1/1 0015.5dcf.dc0e N/A UNKNOWN Unauth 0F86470A00000D7FCF979871
Te1/1/1 0015.5dcf.dc0f N/A UNKNOWN Unauth 0F86470A00000D2DCF96262B
Te1/1/1 0015.5dcf.dc10 N/A UNKNOWN Unauth 0F86470A00000D70CF973E59
Te1/1/1 0068.eb65.ece1 N/A UNKNOWN Unauth 0F86470A00000DF9D1D86BDB
Te1/1/1 0068.eb65.fcba N/A UNKNOWN Unauth 0F86470A00000DECD103E105
Gi1/0/9 00bb.c1cb.2c39 N/A do1x auth 0F86470A00000E2BD2981409

Is this kind of abnormal behavior of my switch ? Please suggest

Regards

Riya

[balaji.bandi]

Is the TE 1/1/1 is uplink port ?  i see the MAC address are different, can you check those MAC address really orginating from Switch ?

[RIYAJOSHI]

Hi Balaji,

Thank you for your reply.

Is the TE 1/1/1 is uplink port ? Yes

i see the MAC address are different, can you check those MAC address really orginating from Switch ? Yeah all mac I checked it was  stick the same switch...

It did't happend in rest of the access switches not sure what actually was happening.

Regards

Riya

[camihern]

Hi Riya,

Can you share "show version", "show runn interface Te1/1/1" and "show run aaa"?

Regards,

Camilo H.

[RIYAJOSHI]

Hi Camilo,

Please find the below details..

Switch #sh running-config interface te1/1/1
Building configuration...

Current configuration : 135 bytes
!
interface TenGigabitEthernet1/1/1
switchport trunk allowed vlan 134,195,204,208
switchport mode trunk
switchport nonegotiate
end

----

in1092-b1f4-as5-lan#show running-config aaa
!
aaa authentication login default group tacacs+ local
aaa authentication dot1x default group ISE
aaa authentication attempts login 5
aaa authorization exec default group tacacs+ local
aaa authorization network default group ISE
aaa authorization network auth-list group ISE
aaa accounting exec default start-stop group tacacs+
aaa accounting commands 1 default start-stop group tacacs+
aaa accounting commands 15 default start-stop group tacacs+
aaa accounting dot1x default start-stop group ISE
aaa accounting update newinfo periodic 2880
username admin privilege 15 password 7 02540A550F5209231A
!
!
!
!
aaa server radius dynamic-author
client 10.70.84.12 server-key 7 091D7A1B0A1113412F1A077F
client 10.71.133.31 server-key 7 06573B335F5A0D4A2101115E
client 10.163.78.16 server-key 7 03556F19151B251F6A1F1A50
client 10.158.4.31 server-key 7 0257304918120B7268580A4C
!
!
radius server in1093-isepsn01
address ipv4 10.70.84.12 auth-port 1812 acct-port 1813
automate-tester username Micron-AAA-test ignore-acct-port probe-on
key 7 00552714174F0F552B374F1B
!
radius server in1092-isepsn01
address ipv4 10.71.133.31 auth-port 1812 acct-port 1813
automate-tester username Micron-AAA-test ignore-acct-port probe-on
key 7 091D7A1B0A1113412F1A077F
!
radius-server attribute 6 on-for-login-auth
radius-server attribute 6 support-multiple
radius-server attribute 8 include-in-access-req
radius-server attribute 25 access-request include
radius-server dead-criteria time 5 tries 3
radius-server deadtime 5
tacacs-server directed-request
tacacs-server host 10.160.20.54
tacacs-server host 137.201.132.81
tacacs-server key 7 1456433F08007E1C372C3D6263
!
aaa group server radius ISE
server name in1092-isepsn01
server name in1093-isepsn01
!
!
!
!
aaa new-model
aaa session-id common
!
!

------------------------

SWitch #sh ver
Cisco IOS XE Software, Version 16.09.04
Cisco IOS Software [Fuji], Catalyst L3 Switch Software (CAT9K_IOSXE), Version 16.9.4, RELEASE SOFTWARE (fc2)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2019 by Cisco Systems, Inc.
Compiled Thu 22-Aug-19 18:14 by mcpre

Cisco IOS-XE software, Copyright (c) 2005-2019 by cisco Systems, Inc.
All rights reserved. Certain components of Cisco IOS-XE software are
licensed under the GNU General Public License ("GPL") Version 2.0. The
software code licensed under GPL Version 2.0 is free software that comes
with ABSOLUTELY NO WARRANTY. You can redistribute and/or modify such
GPL code under the terms of GPL Version 2.0. For more details, see the
documentation or "License Notice" file accompanying the IOS-XE software,
or the applicable URL provided on the flyer accompanying the IOS-XE
software.

ROM: IOS-XE ROMMON
BOOTLDR: System Bootstrap, Version 16.8.1r [FC4], RELEASE SOFTWARE (P)

in1092-b1f4-as5-lan uptime is 1 week, 2 hours, 3 minutes
Uptime for this control processor is 1 week, 2 hours, 9 minutes
System returned to ROM by Reload Command at 13:56:21 GMT Sat Mar 14 2020
System restarted at 14:04:11 GMT Sat Mar 14 2020
System image file is "flash:cat9k_iosxe.16.09.04.SPA.bin"
Last reload reason: Reload Command

[RIYAJOSHI · Accepted solution]

Hi Balla/Camelio,

Thanks you both for providing me your helping hands for resolving my query.

This issue <so called abnormal behavior> got resolved by upgrading this switch.

Hope we all meet to face other challenges in future with new interesting queries.

Regards

Riya