Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About James Drake
10-09-2017
Stats
Member since
11-21-2013
33
Posts
0
Helpful
0
Solutions
11-20-2014
06:48 AM
Sorry for the delayed response, but I wanted to wait until our next round of deployments.
This morning, I had a port with phone+desktop. Port security was set to 3 max, was showing 2 addresses for the port, but logging security violations and keeping the phone from registering.
Disconnected devices and started debug port-sec, but didn't get any output after connecting everything. However, this is the output from sh logging for that port this morning:
RVAPsw22#sh logg | i 3/0/10
Nov 20 09:23:33.372 EST: PSECURE: Install IP Phone 6cfa.8903.fc2c on interface GigabitEthernet3/0/10 on vlan 1022
Nov 20 09:23:33.372 EST: PSECURE: psecure_packet_enqueue: psecure receives a packet: addr = 6cfa.8903.fc2c, swidb = Gi3/0/10, vlan = 1022, linktype = NullPak
Nov 20 09:23:33.375 EST: PSECURE: swidb = GigabitEthernet3/0/10 mac_addr = 6cfa.8903.fc2c vlanid = 1022
Nov 20 09:23:33.375 EST: PSECURE: Adding 6cfa.8903.fc2c as dynamic on port Gi3/0/10 for vlan 1022
Nov 20 09:23:33.374 EST: %PORT_SECURITY-2-PSECURE_VIOLATION: Security violation occurred, caused by MAC address 6cfa.8903.fc2c on port GigabitEthernet3/0/10. (RVAPsw22-3)
Nov 20 09:23:39.484 EST: %PORT_SECURITY-2-PSECURE_VIOLATION: Security violation occurred, caused by MAC address 6cfa.8903.fc2c on port GigabitEthernet3/0/10. (RVAPsw22-3)
Nov 20 09:23:51.486 EST: %PORT_SECURITY-2-PSECURE_VIOLATION: Security violation occurred, caused by MAC address 6cfa.8903.fc2c on port GigabitEthernet3/0/10. (RVAPsw22-3)
Nov 20 09:24:07.498 EST: %PORT_SECURITY-2-PSECURE_VIOLATION: Security violation occurred, caused by MAC address 6cfa.8903.fc2c on port GigabitEthernet3/0/10. (RVAPsw22-3)
Nov 20 09:24:28.308 EST: %PORT_SECURITY-2-PSECURE_VIOLATION: Security violation occurred, caused by MAC address 6cfa.8903.fc2c on port GigabitEthernet3/0/10. (RVAPsw22-3)
Nov 20 09:24:33.734 EST: PSECURE: Install IP Phone 6cfa.8903.fc2c on interface GigabitEthernet3/0/10 on vlan 1022
Nov 20 09:24:33.734 EST: PSECURE: psecure_packet_enqueue: psecure receives a packet: addr = 6cfa.8903.fc2c, swidb = Gi3/0/10, vlan = 1022, linktype = NullPak
Nov 20 09:24:33.738 EST: PSECURE: swidb = GigabitEthernet3/0/10 mac_addr = 6cfa.8903.fc2c vlanid = 1022
Nov 20 09:24:33.738 EST: PSECURE: Adding 6cfa.8903.fc2c as dynamic on port Gi3/0/10 for vlan 1022
Nov 20 09:24:33.555 EST: %PORT_SECURITY-2-PSECURE_VIOLATION: Security violation occurred, caused by MAC address 6cfa.8903.fc2c on port GigabitEthernet3/0/10. (RVAPsw22-3)
Below is the output from 'sh auth sess' while the port was logging violations:
RVAPsw22#sh auth sess int gi3/0/10
Interface: GigabitEthernet3/0/10
MAC Address: 0019.bb46.70cc
IP Address: x.x.x.14
User-Name: xxxxx
Status: Authz Success
Domain: DATA
Oper host mode: multi-auth
Oper control dir: both
Authorized By: Authentication Server
Vlan Policy: N/A
ACS ACL: xACSACLx-IP-PERMIT_ALL_TRAFFIC-4fe7f797
Session timeout: N/A
Idle timeout: N/A
Common Session ID: 0A5F01160001E1CF9EC04C60
Acct Session ID: 0x000295A0
Handle: 0x210008AF
Runnable methods list:
Method State
dot1x Authc Success
mab Not run
----------------------------------------
Interface: GigabitEthernet3/0/10
MAC Address: 6cfa.8903.fc2c
IP Address: Unknown
User-Name: 6C-FA-89-03-FC-2C
Status: Authz Success
Domain: VOICE
Oper host mode: multi-auth
Oper control dir: both
Authorized By: Authentication Server
ACS ACL: xACSACLx-IP-PERMIT_ALL_TRAFFIC-4fe7f797
Session timeout: N/A
Idle timeout: N/A
Common Session ID: 0A5F01160001E1D09EC0562A
Acct Session ID: 0x000295A1
Handle: 0xF200084B
Runnable methods list:
Method State
dot1x Failed over
mab Authc Success
Below is the configuration for that port:
interface GigabitEthernet3/0/10
switchport access vlan 22
switchport mode access
switchport voice vlan 1022
switchport port-security maximum 3
switchport port-security
switchport port-security aging time 2
switchport port-security violation restrict
switchport port-security aging type inactivity
ip access-group ACL-ALLOW-ALL in
srr-queue bandwidth share 1 30 35 5
priority-queue out
authentication event fail action next-method
authentication event server dead action authorize vlan 22
authentication event server dead action authorize voice
authentication event server alive action reinitialize
authentication host-mode multi-auth
authentication open
authentication order dot1x mab
authentication priority dot1x mab
authentication port-control auto
authentication periodic
authentication timer reauthenticate server
authentication violation restrict
mab
no snmp trap link-status
mls qos trust device cisco-phone
mls qos trust cos
macro description cisco-phone
dot1x pae authenticator
dot1x timeout tx-period 10
auto qos voip cisco-phone
spanning-tree portfast
spanning-tree bpduguard enable
service-policy input AUTOQOS-SRND4-CISCOPHONE-POLICY
end
I bumped port security max on that port up to 4 and was able to get the phone to register, but this is not the desired configuration. If anyone is able to look at the config and make any suggestion, I would much appreciate it!
Thanks,
James
... View more
10-15-2014
10:57 AM
Hi all, We have 8 stacks of 2960Xs, which we installed earlier this year. For the past few months, we have been running into many issues with port security. It started with ports with IP phones. We originally used a port security max of 2 (one for phone and one for PC), but then found out that sometimes the phones use 2 MACs (one for data and one for voice), so we bumped them up to max of 3. Now we are running into issues where the switches are logging violations and even going err-disabled on ports with only a PC. The switches, on some ports, show a max of 2 with 1 in use, and still log violations (only one device connects to the port and no virts). I have had to bump ports up as high as max 5 for it to stop logging violations for 1 PC with no virts on it. We also have a port that is a max of 5 and showing 2 in use, but still logs violations. I have also seen ports with nothing connected logging port-security violations. It is not all of the stacks, but definitely our 5 heaviest used stacks. Has anyone run into this? Is this a software bug? Any advice? Thanks, James
... View more
Labels:
Created by
James Drake
in Wireless Security and Network Management
in Wireless Security and Network Management
06-12-2014
05:33 AM
06-12-2014
05:33 AM
Thanks Mohana!
... View more
Created by
James Drake
in Wireless Security and Network Management
in Wireless Security and Network Management
06-12-2014
05:31 AM
06-12-2014
05:31 AM
Thanks Najaf. Hadn't thought about that angle. I will do some testing.
... View more
Created by
James Drake
in Wireless Security and Network Management
in Wireless Security and Network Management
06-11-2014
11:42 AM
06-11-2014
11:42 AM
Hey everyone, As we get more users, we are starting to run out of IP addresses in our wireless subnet at one of our locations. We were thinking instead of just enlarging the subnet, creating a different subnet for each floor. While I can find plenty of documentation on Inter-controller inter-subnet roaming, I was wondering how this would be handled across a single controller. I read the Mobility chapter of the Wireless LAN Fundamentals book (http://www.ciscopress.com/articles/article.asp?p=102282&seqNum=3), which suggests that this can be done. Who has had experience doing this? What additional configuration (if any) had to be done? Edit: If you have implemented this, what is the user experience while roaming between floors?
... View more
Created by
James Drake
in Wireless Security and Network Management
in Wireless Security and Network Management
02-14-2014
01:13 PM
02-14-2014
01:13 PM
VLAN trunking across mesh has been very stable for a few weeks now! Thanks again Dhiresh!
... View more
Created by
James Drake
in Other Wireless - Mobility Subjects
in Other Wireless - Mobility Subjects
01-29-2014
12:41 PM
01-29-2014
12:41 PM
I'm curious about this, as well as OSX Mav users now getting bumped off.
... View more
Created by
James Drake
in Wireless Security and Network Management
in Wireless Security and Network Management
01-22-2014
11:43 AM
01-22-2014
11:43 AM
An update. On Friday, after speaking with TAC, I learned that the issue with my stranded MAP was most likely because of a bug with 7.2.x.x. I was given a small maintenance window to perform the upgrade from 7.2 to 7.5. After the 7.5 install, the stranded MAP was able to associate and is working correctly. I will have to dig into the trunking later this week. Snow and ice has kept me out of the office, and offsite.
... View more
Created by
James Drake
in Wireless Security and Network Management
in Wireless Security and Network Management
01-15-2014
06:15 AM
01-15-2014
06:15 AM
Awesome! This may be the answer to all of our problems!
... View more
01-14-2014
12:43 PM
Ravi, Sorry to dig up an old issue, but what are the compatability issues with 7.5 and NCS 1.1.1.24? We have a WLC that we would like to upgrade form 7.2.111.3 to 7.5. The compatability chart says that NCS only supports up to WLC 7.2, but we have WLCs on 7.4 and have had no issue as far as our scope of managment via NCS.
... View more
Created by
James Drake
in Wireless Security and Network Management
in Wireless Security and Network Management
01-14-2014
08:33 AM
01-14-2014
08:33 AM
One more question Dhiresh, If we use VLAN transparent on 7.5, and the switches' native vlan on both sides are the same VLAN as the MAP and RAP management VLAN, will the remote switch and its indoor access points have to be on a different VLAN than the native/MAP's management VLAN? If the native VLAN is vlan100. The MAP and RAP's management are both on vlan100. I need to know if the MAP or RAP will drop or pass frames if there are devices on the MAP/bridged side on vlan100.
... View more
Created by
James Drake
in Wireless Security and Network Management
in Wireless Security and Network Management
01-14-2014
05:44 AM
01-14-2014
05:44 AM
Thanks for that information Dhiresh. We were planning to upgrade the controller in this location this year. This information may prioritize this upgrade! Amjad and Scott, thanks to you two also. We ended up getting TAC involved with that MAP that we took down because things just didn't make sense. The TAC engineer agreed that the errors we were getting were unusual and that our settings looked correct. We wiped the MAP and started from the ground up, configuring it with TAC watching and we still had some issues, though it seemed to be moving in the right direction. We will keep working through these issues also.
... View more
Created by
James Drake
in Wireless Security and Network Management
in Wireless Security and Network Management
01-13-2014
11:09 AM
01-13-2014
11:09 AM
Thanks Scott, That is the document that has gotten me as far as I am now. The hard part is this is a campus where the network has been up and working for years, then mesh was installed a few months ago, and it was working fine, now the company wants to figure out how to get VLANs to trunk over mesh. The network was never designed for trunking over mesh, so thats why I think I'm running into so many issues. All of the devices on the campus are in the same managment subnet, and on many of the trunks, the native VLAN is the management VLAN.
... View more
Created by
James Drake
in Wireless Security and Network Management
in Wireless Security and Network Management
01-13-2014
07:46 AM
01-13-2014
07:46 AM
Thanks Dhiresh, My biggest problem right now is that devices that are on the same management VLAN as the mesh (switches and indoor APs) won't communicate over the bridge unless it is in "Normal" mode. Switching it to trunk allows devices on other VLANs to communicate, across the bridge, but we lose the switch's management interface, and the indoor APs can't reach the WLC. Dhiresh Yadav wrote: In 7.0 and from 7.5 , this has started behaving correctly. So here with Vlan tranparent enabled, RAP and MAP switchport configured properly and in the same way , all the vlans including native vlan will be bridged transparently. If I'm reading this correctly, if we upgrade to 7.5 and use VLAN transparent, all of our VLANs will bridge the mesh?
... View more
11-20-2014
Sorry for the delayed response, but I wanted to wait until our next
round of deployments. This morni...
10-15-2014
Hi all,We have 8 stacks of 2960Xs, which we installed earlier this year.
For the past few months, we...
Created by
James Drake
in Wireless Security and Network Management
06-12-2014
06-12-2014
Thanks Najaf.Hadn't thought about that angle. I will do some testing.
Created by
James Drake
in Wireless Security and Network Management
06-11-2014
06-11-2014
Hey everyone,As we get more users, we are starting to run out of IP
addresses in our wireless subnet...
02-14-2014
VLAN trunking across mesh has been very stable for a few weeks now!
Thanks again Dhiresh!
Created by
James Drake
in Other Wireless - Mobility Subjects
01-29-2014
01-29-2014
I'm curious about this, as well as OSX Mav users now getting bumped off.
01-22-2014
An update. On Friday, after speaking with TAC, I learned that the issue
with my stranded MAP was mos...
01-14-2014
Ravi, Sorry to dig up an old issue, but what are the compatability
issues with 7.5 and NCS 1.1.1.24?...
01-14-2014
One more question Dhiresh,If we use VLAN transparent on 7.5, and the
switches' native vlan on both s...
01-14-2014
Thanks for that information Dhiresh. We were planning to upgrade the
controller in this location thi...
01-13-2014
Thanks Scott,That is the document that has gotten me as far as I am now.
The hard part is this is a ...
Public Statistics
| Date Registered | 11-21-2013 07:11 AM |
| Date Last Visited | 10-09-2017 02:11 PM |
| Total Messages Posted | 33 |
Helpful Votes Given To
| User | Helpful Count |
|---|---|
| 5 | |
| 10 | |
| 8 | |
| 5 | |
| 5 |
.jpg "VIP Mentor"){kind=icon}
