Error Disable on port after applying .1X config

Question

Hi Guys,
I'm installing ISE 1.2 on the network and when testing with few machines, some of them reported "errdisable" status on the port after applying the .1X configuration. The config for the port I have is:
switchport access vlan 10
switchport mode access
switchport voice vlan 100
ip access-group Default-ACL in
authentication event fail action next-method
authentication event server alive action reinitialize
 authentication host-mode multi-domain
authentication order mab dot1x webauth
authentication priority dot1x mab webauth
authentication port-control auto
authentication periodic
authentication timer reauthenticate server
mab
snmp trap mac-notification change added
snmp trap mac-notification change removed
dot1x pae authenticator
dot1x timeout tx-period 2
spanning-tree portfast
spanning-tree bpduguard enable
When I remove the .1X config on the port it comes up fine. Shutting and un-shutting the port couldn't recover it. I don't have any port security configured.
Any ideas?
Thanks,
Mohammad

Answer 1

Hey Guys,
I have PC and IP phone connected to the port. Before applying .1x:
sh mac address-table int fa0/27
          Mac Address Table
Vlan    Mac Address       Type        Ports
100    580a.2098.3010    DYNAMIC     Fa0/27
108    2c27.d71d.4089    DYNAMIC     Fa0/27
Total Mac Addresses for this criterion: 2
In the switch log, it's complaining about security violation:
*Sep 28 00:41:45.855: %AUTHMGR-5-START: Starting 'mab' for client (580a.2098.3010) on Interface Fa0/27 AuditSessionID 8282822A000070AC3EC3F50E
*Sep 28 00:41:45.897: %MAB-5-SUCCESS: Authentication successful for client (580a.2098.3010) on Interface Fa0/27 AuditSessionID 8282822A000070AC3EC3F50E
*Sep 28 00:41:45.897: %AUTHMGR-7-RESULT: Authentication result 'success' from 'mab' for client (580a.2098.3010) on Interface Fa0/27 AuditSessionID 8282822A000070AC3EC3F50E
*Sep 28 00:41:46.568: %AUTHMGR-5-SUCCESS: Authorization succeeded for client (580a.2098.3010) on Interface Fa0/27 AuditSessionID 8282822A000070AC3EC3F50E
*Sep 28 00:42:44.811: %AUTHMGR-5-START: Starting 'mab' for client (2c27.d71d.4089) on Interface Fa0/27 AuditSessionID 8282822A000070AD3EC4F8CE
*Sep 28 00:42:44.836: %MAB-5-SUCCESS: Authentication successful for client (2c27.d71d.4089) on Interface Fa0/27 AuditSessionID 8282822A000070AD3EC4F8CE
*Sep 28 00:42:44.836: %AUTHMGR-7-RESULT: Authentication result 'success' from 'mab' for client (2c27.d71d.4089) on Interface Fa0/27 AuditSessionID 8282822A000070AD3EC4F8CE
*Sep 28 00:42:44.844: %AUTHMGR-5-SECURITY_VIOLATION: Security violation on the interface FastEthernet0/27, new MAC address (2c27.d71d.4089) is seen.AuditSessionID  8282822A000070AD3EC4F8CE
*Sep 28 00:42:44.844: %PM-4-ERR_DISABLE: security-violation error detected on Fa0/27, putting Fa0/27 in err-disable state
*Sep 28 00:42:45.876: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/27, changed state to down
*Sep 28 00:42:46.874: %LINK-3-UPDOWN: Interface FastEthernet0/27, changed state to down
Thanks,
Mohammad