×

Warning message

  • Cisco Support Forums is in Read Only mode while the site is being migrated.
  • Cisco Support Forums is in Read Only mode while the site is being migrated.

Mac address: 0000.0104.0000

Answered Question
Feb 24th, 2014
User Badges:

Hi,


I have a customer with large ISE/dot1x deployment were we just started doing some pilot testing on a few sites.

What we see now is a MAC address showing up on ports connected to Cisco AP's.

This MAC has in the last 24h made over 1200 sucsessfull attempts to authenitcate on diffrent swicthches on the test sites.

(We have the MAC address in the Endpoint DB)


It is only on ports going toward an AP and only on Cisco swicthes, we have Avaya as well.

We have seen this MAC before but not in this quantity as of today




Anyone seen this one before? 



MAC.png


On the switch we cant see the MAC adress in tha MAC address table but it show in show authentication session



xxxx-xxxxx-xxxxx-SW03#sh mac address-table int fa0/6

          Mac Address Table

-------------------------------------------


Vlan    Mac Address       Type        Ports

----    -----------       --------    -----

1100    xxxx.6a98.207f    STATIC      Fa0/6


xxx-xxxxx-xxxxx-SW03#sh authentication sessions


Interface  MAC Address     Method   Domain   Status         Session ID

Fa0/6      0000.0104.0000  mab      DATA     Authz Failed   xxxxxxxxxxx499

Fa0/3      xxxx.xxxx.f1ba  dot1x    VOICE    Authz Success  xxxxxxxxxxCF2

Fa0/6      xxxx.xxxx.207f  mab      DATA     Authz Success  xxxxxxxxxxx858

Fa0/1      xxxx.xxxx.8b4a  dot1x    DATA     Authz Success  xxxxxxxxxx7E3




Cheers


Message was edited

Correct Answer by Saravanan Lakshmanan about 3 years 4 months ago

yes, this that's the referenced bug CSCud97325 and it is fixed on 7.5.102.0, 7.4.121.X esc and 7.3.x.x esc build. If you don't want to update to 7.5.102.0 then open TAC case to get one of these fixed build.

Correct Answer by jimbostan about 3 years 4 months ago

Hi all,

     Check out bug CSCud97325............................thx...........J

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (2 ratings)
Loading.
jimbostan Fri, 03/28/2014 - 05:06
User Badges:

Mikael,

       I've just noticed a similar issue where this MAC (0000.0104.0000) shows up as well.  Were you able to resolve the issue?.....thx.......J

Mikael Gustafsson Fri, 03/28/2014 - 05:27
User Badges:

 

No, we have put this on suppress in the log for now. Short of time just now.

If you find anything please let me know :-)

Cheers

 

 

Jeff Deibel Fri, 03/28/2014 - 11:09
User Badges:

We have experienced an issue with this MAC address as well.

It appeared for a brief time on multiple ports connected to Cisco AP's and actually triggered port security violations, causing the AP's to disassociate from the controller.

I have not yet found the cause of this issue.

3750X - 12.2(58) SE2

5508 WLC - 7.2.111.3

2600 Series AP's

Correct Answer
jimbostan Tue, 04/01/2014 - 07:34
User Badges:

Hi all,

     Check out bug CSCud97325............................thx...........J

Correct Answer
Saravanan Lakshmanan Tue, 04/01/2014 - 08:48
User Badges:
  • Cisco Employee,

yes, this that's the referenced bug CSCud97325 and it is fixed on 7.5.102.0, 7.4.121.X esc and 7.3.x.x esc build. If you don't want to update to 7.5.102.0 then open TAC case to get one of these fixed build.

Actions

This Discussion

Related Content

 

 

Trending Topics - Security & Network