I was in San Diego, unfortunately did not attend this session. Very useful session indeed. Thank you again for your help. ... View more

Thank you for your assist. I did it in the ISE.   authentication timer reauthenticate server Now PEAP Session Timeout is 60 sec. Thank you a lot. ... View more

Proxy EAPoL-Logoff If your switch or phone does not support CDP Enhancement for Second Port Disconnect, Proxy EAPoL-Logoff can provide a partial solution for 802.1X-authenticated data devices. Proxy EAPoL-Logoff enables the phone to transmit an EAPoL-Logoff message on behalf of the data device when the phone detects that an 802.1X device has unplugged from behind the phone. The phone substitutes the MAC address of the data device, so the proxy EAPoL-Logoff message is indistinguishable from an actual EAPoL-Logoff from the data device itself. The switch immediately clears the session as soon as it receives the Logoff message. To support this feature, your phone must be capable of sending proxy EAPoL-Logoff messages. All Cisco IP phones and some third-party phones provide this functionality. No special functionality is required from the switch because the EAPoL-Logoff message is fully supported as per the IEEE standard. Although effective for 802.1X-authenticated endpoints, Proxy EAPoL-Logoff does not work for MAB or WebAuth, because these authentication methods do not use EAP to authenticate. Another method, such as the inactivity timer, must be used to ensure that MAB sessions are appropriately cleared. In other hand, some Cisco IP phones do not support this feature. Ex. 7912. I am still confused how can I achieve to avoid this problem. ... View more

As we know, mac address aging time is default 300 sec. PC can be spoofed during this time means switch will not remove mac address from its table till the end of 5 minutes. ... View more

I am going to read the guide you presented. But till that time, I wonder if PC seats behind the phone. Surely if PC connects directly to the switch, once ports goes down and goes up, re-authentication process is started. I meant switch does not aware what happens behind the phone. Or Let`s suppose multi-auth method is used and  and PC seats behind the hub which friend mentions below. Is it possible to spoof that PC? ... View more

 This is an error during break Hub Feb  5 11:02:38: %CRYPTO-4-RECVD_PKT_INV_SPI: decaps: rec'd IPSEC packet has invalid spi for destaddr=Y.Y.Y.Y, prot=50, spi=0x91ECFD3B(2448227643), srcaddr=X.X.X.X, input interface=Port-channel1.450   Spoke  %CRYPTO-4-RECVD_PKT_INV_SPI: decaps: rec'd IPSEC packet has invalid spi for destaddr=X.X.X.X, prot=50, spi=0xC4A13E86(3298901638), srcaddr=Y.Y.Y.Y, input interface=GigabitEthernet0/0   It stops working for nearly 10 sec and revives again. ... View more

Show crypto isakmp sa HUB Y.Y.Y.Y      X.X.X.X     QM_IDLE          65942 ACTIVE Spoke Y.Y.Y.Y      X.X.X.X     QM_IDLE           1041 ACTIVE Show run HUB crypto isakmp policy 10  encr aes 256  authentication pre-share  group 2  lifetime 3600 ! crypto isakmp key ********* address X.X.X.X     crypto isakmp invalid-spi-recovery crypto isakmp keepalive 10 periodic ! crypto ipsec transform-set VPNtransform-set esp-aes 256 esp-md5-hmac  mode tunnel ! crypto map Spokes 10 ipsec-isakmp  set peer X.X.X.X  set security-association lifetime seconds 3500  set transform-set VPNtransform-set  set pfs group2  match address ACL_Branches  reverse-route  qos pre-classify ! crypto ipsec transform-set VPNtransform-set esp-aes 256 esp-md5-hmac  mode tunnel Spoke crypto isakmp policy 10  encr aes 256  authentication pre-share  group 2  lifetime 3600 crypto isakmp key ********** address Y.Y.Y.Y      crypto isakmp invalid-spi-recovery crypto isakmp keepalive 10 periodic         ! crypto ipsec transform-set VPNtransform-set esp-aes 256 esp-md5-hmac  mode tunnel ! crypto map Spokes 10 ipsec-isakmp  set peer Y.Y.Y.Y  set security-association lifetime seconds 3500  set transform-set VPNtransform-set  set pfs group2  match address ACL_Branches  qos pre-classify Interesting thing is that Spoke has another VPN connectivity with another router and it does not behave like this. ISO version:15.4(3)M5 Lifetime for phase1 is  3600 and 3500 for phase2. ACLs are definitely mirrored. ... View more

Any Idea? ... View more

Yes, DPD is enabled and ACLs are mirrored.Weird thing is that it occurs only between hub and one branch router. There are other routers which have same ios version, same model and nearly same traffic is passing through. ... View more