Solved: Re: Wireless Phone Flapping between ports

Huddles18 · ‎11-02-2017

Hey everyone,

So I saw a couple posts on this already, but I was unable to find something that pertained to a wireless phone.

We have a couple of Cisco 7925's still laying around, but one in particular is causing trouble. When I look at the logging on one of our access switches, I see this:

%SW_MATM-4-MACFLAP_NOTIF: Host 10f3.11xx.xxxx in vlan 30 is flapping between port Gi2/0/47 and port Gi1/0/47

One of those ports is to one of our WAPs and the other goes to our core switch. On another access switch, I am receiving the same issue. So it's my understanding that the phone is bouncing over to different access points.

I know that's not a big deal, but was curious if there is something I can do about the logging that's happening, or if I can improve on something that could prevent this.

Mark Malone · ‎11-02-2017

Hi
that's normal with wireless phone , only thing you can do is turn off mac flap notifications , whats happening is mac is learned in 1 port then the phone goes off to another part of network gets learned through another port but CAM table already sees it as learned in the other port ,so lets you know its a mac flap move in case its not legitimate which sometimes they aren't but with wireless phones you can expect that or even users that move around with laptops

no mac address-table notification mac-move

View solution in original post

Mark Malone · ‎11-02-2017

Hi
that's normal with wireless phone , only thing you can do is turn off mac flap notifications , whats happening is mac is learned in 1 port then the phone goes off to another part of network gets learned through another port but CAM table already sees it as learned in the other port ,so lets you know its a mac flap move in case its not legitimate which sometimes they aren't but with wireless phones you can expect that or even users that move around with laptops

no mac address-table notification mac-move

Huddles18 · ‎11-02-2017

Thanks. Yeah, I don't know if I want to turn it off completely in case we have an actual issue in the future, but then again, I can't see this being something that would pertain to a larger issue.

Mark Malone · ‎11-03-2017

Ye you can use it to track rogue wireless devices , but there's software for that too , you could also just remove it from logging through using discriminator but keep the feature on stop it flooding logs if its causing an issue in syslog

Huddles18 · ‎11-03-2017

Yeah, we already use a separate program for Rouge APs. I went ahead and setup a discriminator to drop the message. Looks like that cleared it up. It was exactly what I was looking for. Thanks!