Switchport Port-Security Issue

[fodmidoid]

Greetings,

We are currently running a Cisco WS-C4510R Switch and recently decided to apply port-security to all the user ports in our infrastructure. Two mornings in a row, a user's computer port was disabled. It showed a violation in the show port-security [interface] command, but the mac address was correct.

• Replaced her old PC with a brand new one: Same Results
• Moved her to a different switch port: Same Results
• Changed her Ethernet cable: Same Results
• Changed the switch-port violation from Shutdown to Restrict and saw that the violation count kept climbing. 

I finally disabled port-security for that port after 173 violations and I can't find an answer anywhere. I'd like to add that I haven't had any problems with any of the other 78 ports with port-security enabled.

I could use some help. Thanks very much in advance.

• • core1#sh run int gigabitEthernet 4/30
    Building configuration...

    Current configuration : 242 bytes
    !
    interface GigabitEthernet5/32
     switchport access vlan 2
     switchport mode access
     switchport port-security
     switchport port-security mac-address sticky
     switchport port-security mac-address sticky 7446.a0bb.383c
     spanning-tree portfast
    end

  • core1#sh port-security interface GigabitEthernet 4/30
    Port Security              : Enabled
    Port Status                : Secure-down
    Violation Mode             : Shutdown
    Aging Time                 : 0 mins
    Aging Type                 : Absolute
    SecureStatic Address Aging : Disabled
    Maximum MAC Addresses      : 1
    Total MAC Addresses        : 0
    Configured MAC Addresses   : 0
    Sticky MAC Addresses       : 0
    Last Source Address:Vlan   : xxxx.xxxx.xxxx:2
    Security Violation Count   : 173

• core1#sh ver
  Cisco IOS Software, Catalyst 4500 L3 Switch Software (cat4500-ENTSERVICESK9-M), Version 15.0(2)SG7, RELEASE SOFTWARE (fc2)
  Technical Support: http://www.cisco.com/techsupport
  Copyright (c) 1986-2013 by Cisco Systems, Inc.
  Compiled Wed 01-May-13 18:06 by prod_rel_team
  Image text-base: 0x10000000, data-base: 0x123AB54C

  ROM: 12.2(20r)EW1
  Dagobah Revision 226, Swamp Revision 34

  core1 uptime is 1 year, 28 weeks, 5 days, 14 hours, 11 minutes
  Uptime for this control processor is 1 year, 28 weeks, 5 days, 13 hours, 50 minutes
  System returned to ROM by power-on
  System image file is "bootflash:cat4500-entservicesk9-mz.150-2.SG7.bin"

[Zach S]

Is this PC hanging off any other device, like a VoIP phone?

[fodmidoid]

Thanks for the reply.

No, the phones are cabled independently of the PCs.

[Zach S]

So, if you have nothing else hanging off that port, and you already switched out the PC to determine that it isn't the issue, then source of your trouble is likely to be the port on the switch. If you have a spare port try switching the equipment off of gig 4/30 and swap it to different port.

If that fixes your issue then you have a port that's doing something screwy with MAC addresses, possibly hardware issue.

[fodmidoid]

I swapped it to a different port and getting the same results. I also changed her Ethernet cable, and still no change.

[Zach S]

Well, that is odd. Have you tried changing the maximum amount of allowed MAC addresses to a higher number? I think the command is something along the lines of switchport port-security maximum.

[fodmidoid]

Yes...it's very odd, isn't it?

I haven't changed the maximum to a higher number as of yet, but I shouldn't have to. All of the other ports are fine as they are with a maximum of 1. If I increase that maximum to 2, it basically defeats the purpose of applying the port-security to protect against users plugging in another device.

Is it possible the problem does not lie within the switch, but rather the RJ-45 jack at the cubicle, the cabling between that jack and the patch panel, or the patch cable from the panel to the switch port, itself? There have been no other problems in regards to this connection. Only with port-security. It doesn't make sense that a bad cable/jack would cause this.

[Zach S]

You've eliminated every thing but your patching. I'm not sure why a messed up patch would change MAC data, but anything is possible when your physical layer is screwed up.

Just for troubleshooting sake setting a higher mac allowed limit would show if you if anything else is showing up, but if you set the MAC limit to say four, and it still goes into error disabled, then you may want to spend some time looking into your patching, or bust out a cable tester if you have one..

[fodmidoid]

That's good thinking.

I'll increase the maximum on Monday and let you know the results.

In the meantime, I have to leave port-security disabled for this user.

Thanks.

[Jon Marshall]

Is it possible the problem does not lie within the switch, but rather the RJ-45 jack at the cubicle, the cabling between that jack and the patch panel, or the patch cable from the panel to the switch port, itself? 

I think you have already ruled all the above by changing the cable, trying a different switch port etc.

Perhaps the switch just doesn't like her :-)

When you tried a different port did you remove the sticky entry with mac address from the original port configuration.

Also when you get the violation what does the mac address table on the switch show ?

Jon

[fodmidoid]

That's the craziest part of all. When there's a violation, it shows the same mac address that was applied via sticky.

I negated all of the switchport commands and then reapplied them before/after shutdown/no shutdown the interface.

core1(config-if)#shut
core1(config-if)#no shut
core1(config-if)#no switchport port-security maximum 1
core1(config-if)#no switchport port-security mac-address sticky
core1(config-if)#no switchport port-security
core1(config-if)#switchport port-security maximum 1
core1(config-if)#switchport port-security mac-address sticky
core1(config-if)#switchport port-security

Maybe you're right, it jut doesn't like her ;)

[adamlhayman]

Did you ever find an answer to this issue?
I'm running into the same thing at one of my branches.
First it was with a ShoreTel phone on port 9, but then it also started happening to a phone that moved to port 4. Rebooting the switch after hours made port 9 behave, but I still have no idea on port 4. 

On mine however, the MAC never registers for sticky. I get 1 (or 2, or any number I set) of allowed MACs, 0 found MACs, and umteen violations. When I set the MAC statically, I get the MAC that triggers the violation as the same MAC that is allowed.