switchport UP/UP but no mac address or traffic seen

[tachyon05]

What would cause this condition where the port is UP/UP but client not able to communicate with anything?  The last input shows hours and sometimes days ago.  These are smart TVs.  Power cycle them do not fix the issue.  We have some working TVs but most are not working and have this behavior.  If I disconnect the network cable from a non-working TV and plug it into my laptop configured with the same IP as the TV, my laptop can connect without issues - I think this physical layer and network is all good.  If I connect the TV and laptop via a cable, remove the gateway on both devices and set for different IP but same subnet, they can ping each out fine - I think this means the TV is able to talk.

c9300#sh int g2/0/40 | i connect|Last input
GigabitEthernet2/0/40 is up, line protocol is up (connected)
Last input 09:06:35, output 00:00:00, output hang never
c9300#sh mac addr int g2/0/40
Mac Address Table
-------------------------------------------

Vlan Mac Address Type Ports
---- ----------- -------- -----
c9300#

[DanielP211]

Hello!

This is normal behavior for some devices, if no traffic is seen the mac address is removed from the mac address table. You can check the timeout of this with the command: show mac-address-table aging-time.

I wouldnt extend the aging timeout, but I would setup some sort of communication between the TV's and some other system in your network. As you can se the last input was 9 hours ago, so make sure the TV is communicating with a monitoring system or something.

BR 

[M02@rt37]

Hello @tachyon05 

If the TVs are configured to obtain IP addresses dynamically, check the DHCP configuration. Ensure that the DHCP server is operational and provide correct IP config. Also, verify that the smart TVs are in the correct VLAN. 

Check IGMP snooping. This specific feature on the switch is a relevant step when dealing with smart TVs, especially if they rely on multicast traffic, which is common for services like streaming.

IGMP snooping helps switches intelligently forward multicast traffic only to the ports where the interested receivers (in this case, the smart TVs) are located. If IGMP snooping is not functioning correctly, multicast traffic might not reach the intended devices, leading to communication issues.

[MHM Cisco World]

Sw learn mac from inbound frame not from outbound frame

The TV is silent it not send traffic except when TV ask about IP from DHCP

So there is different between leased time of dhcp and aging of MAC in SW.

The aging is shorter than leased time and hence the SW not learn mac of TV.

Ypu need way to make TV send any inbound traffic' try wake on lan 

This I think make TV send inbound and SW learn it MAC

MHM

[balaji.bandi]

what speed it negotiating, what TV Model ?

i would try speed with duplex option, some TV do not do auto negotiation,

show complete output of :

sh int g2/0/40

sh run int g2/0/40

show version

[tachyon05]

Thanks Everyone.  See output below.  Note the port config is standard and is identical to ports for working TV and laptop.  As mentioned, laptop can connect to this port and get on network (static or dhcp).   Both TV and laptops get on via ISE MAB.  All TVs are static IPs and are various NEC models and sizes, and some of the same model/size TVs work but others don't.  It seems like if the TVs don't send any packet, mac address can't be learned by the switch.  Without the mac address, IP communication can't happen. 

c9300#sh ver | i 9300|SOFTWARE
Cisco IOS Software [Cupertino], Catalyst L3 Switch Software (CAT9K_IOSXE), Version 17.9.4a, RELEASE SOFTWARE (fc3)
BOOTLDR: System Bootstrap, Version 17.9.2r, RELEASE SOFTWARE (P)
cisco C9300-48U (X86) processor with 1310642K/6147K bytes of memory.
Model Number : C9300-48U
* 1 65 C9300-48U 17.09.04a CAT9K_IOSXE INSTALL
2 65 C9300-48U 17.09.04a CAT9K_IOSXE INSTALL
3 65 C9300-48U 17.09.04a CAT9K_IOSXE INSTALL
4 65 C9300-48U 17.09.04a CAT9K_IOSXE INSTALL
..............

c9300#sh int g2/0/40
GigabitEthernet2/0/40 is up, line protocol is up (connected)
Hardware is Gigabit Ethernet, address is f4ee.31be.5428 (bia f4ee.31be.5428)
Description: ****TBD******
MTU 9198 bytes, BW 100000 Kbit/sec, DLY 100 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation ARPA, loopback not set
Keepalive set (10 sec)
Full-duplex, 100Mb/s, media type is 10/100/1000BaseTX
input flow-control is on, output flow-control is unsupported
ARP type: ARPA, ARP Timeout 04:00:00
Last input 21:30:14, output 00:00:00, output hang never
Last clearing of "show interface" counters never
Input queue: 0/2000/0/0 (size/max/drops/flushes); Total output drops: 0
Queueing strategy: Class-based queueing
Output queue: 0/40 (size/max)
5 minute input rate 0 bits/sec, 0 packets/sec
5 minute output rate 1000 bits/sec, 1 packets/sec
10247 packets input, 3759847 bytes, 0 no buffer
Received 2864 broadcasts (2374 multicasts)
0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
0 watchdog, 2374 multicast, 0 pause input
0 input packets with dribble condition detected
1551575 packets output, 125740302 bytes, 0 underruns
Output 50295 broadcasts (1034896 multicasts)
0 output errors, 0 collisions, 6 interface resets
6 unknown protocol drops
0 babbles, 0 late collision, 0 deferred
0 lost carrier, 0 no carrier, 0 pause output
0 output buffer failures, 0 output buffers swapped out

interface GigabitEthernet2/0/40
switchport access vlan 30
switchport mode access
switchport voice vlan 32
device-tracking attach-policy IPDT_POLICY
no logging event link-status
authentication periodic
authentication timer reauthenticate server
access-session host-mode multi-domain
access-session control-direction in
access-session closed
access-session port-control auto
mab
snmp trap mac-notification change added
snmp trap mac-notification change removed
trust device cisco-phone
dot1x pae authenticator
dot1x timeout tx-period 10
auto qos voip cisco-phone
spanning-tree portfast
spanning-tree bpduguard enable
service-policy type control subscriber ISE-PMAP-1
service-policy input AutoQos-4.0-CiscoPhone-Input-Policy
service-policy output AutoQos-4.0-Output-Policy
ip nbar protocol-discovery
ip dhcp snooping limit rate 33
end

[MHM Cisco World]

The issue now clear I think

You use dhcp snooping and the TV get IP manually' did you add any static mac-ip in dhcp snooping table?

MHM

[balaji.bandi]

So All TV are manually configured with Static IP - you have ISE as 802.1x for the port ?

Looks for me These TV are silent host -  when the device connected do you see any sessions initiated :

Then same model working some and some not working, then we need to test and monitor and apply the same.

show authentication sessions

May be try  Use the access-session control-direction command to set the port control to either unidirectional or bidirectional.

The in keyword configures a port as unidirectional, allowing a device on the network to “wake up” the client and force it to reauthenticate. The port can send packets to the host but cannot receive packets from the host.

authentication control-direction in

check guide lines :

https://community.cisco.com/t5/security-knowledge-base/ise-secure-wired-access-prescriptive-deployment-guide/ta-p/3641515#toc-hId-785487082

[tachyon05]

Would you please clarify how DHCP snooping comes into play here?  The TVs use static IPs.  How would I check DHCP snooping table?  

Am I correct that the first step is for the switch to learn a mac address from the client?  Without that, any potential issue, such as IP conflict, routing, ACL, doesn't even come into play, right?

[tachyon05 · Accepted solution]

I found out these TVs have LAN1 and LAN2, and their doc talks about giving priority to LAN1 (not sure what that means).  Vendor connected cables to LAN2 on all TVs.  TVs don’t send any packets for unknown reason. Some of the TVs have not sent any packets to switches for 7+ weeks. What got them to send packets appear to be power cycle locally or a prolonged shut down of the switchports they connect to.  Also strange is even with one cable, either in LAN1 or LAN2, switch can see, over time, mac of both LAN1 and LAN2, but it decides which mac to use.  I told vendor to research if LAN2 is needed and disable it if not.  Thanks for all your help.