We have an issue where the mac address of our 6509 VSS pair shows up as a static entry in the address-table of a Catalyst 3850 access switch. Usually it will show as a dynamic entry on the uplink ports. when this occurs, all traffic on that vlan is now forwarded to that workstation. We thought it was a bad driver on a computer, but it just occured on a port with only an IP phone connected. Once the port registers that mac address in the table, the log shows a failed authentication:
002567: Oct 7 15:05:34.672: %DOT1X-5-FAIL: Authentication failed for client (xxxx.xxxx.xxxx) on Interface Gi1/0/14 AuditSessionID
So we go in and shut/no shut the port and the problem clears up. Any ideas why this mac address is registering on the port?