Hello pedro.miranda@l a.logicalis.com,
Please correct me if I'm wrong, but I believe this is what you are saying:
If you connect a PC directly to switchport 1 and then move it to switchport 2, no issue
you connect a PC to IP phone, then connect IP phone to switchport 1. Then you move PC to switchport 2 directly connected and it causes port-security violation
The first situation would be okay, because when you disconnect PC from switchport 1, the switchport goes to down/down state and deletes all mac addresses from the switchport interface. Then when you connect PC to switchport 2, the mac address of PC is learned new again.
In the second situation, the PC mac address is learned by switchport 1 when you connect PC to the IP phone. When you disconnect PC from IP phone, the switchport 1 never goes to down/down state since IP phone is still connected. When you connect PC to switchport 2, its mac address is still associated with switchport 1. This causes port-security violation because mac move is not allowed with port-security enabled ports.
To avoid this situation, you can set port-security aging time so that PC mac address gets deleted from interface after certain amount of time. If you are using a Cisco IP phone, some models support a feature called "CDP enhancement for 2nd port disconnect" (reference). This would clear the mac address immediately as switch would see PC port was disconnected from CDP advertisement that phone had sent.
Let me know if this information helps.
... View more
.jpg "VIP Advisor"){kind=icon}
