I have a C3750G-24PS where a printer appears to have gone off the network, but the ARP cache still shows it in the list, (rather then stating incomplete) and in the MAC address table where I would expect to see the port number, I see the word drop. See below;
#sh arp | i 31
Internet 10.32.68.31 198 0021.b7fc.e414 ARPA Vlan10
#sh mac- | i e414
10 0021.b7fc.e414 DYNAMIC Drop
Is it simply a case of the device going off the network and this is a transition state before the ARP states incomplete, or is there some other reason for this?
Since the printer is off network, the mac address table showing as DYNAMIC drop and this is not any kind of transition state.
Did you configure any port-security on the interface?
When a switchport port-security maximum command is configured on a port, the port learns the MAC addresses of the devices connected to the port. You can also manually enter the addresses, up to the specified number of allowed MAC addresses. If the switchport port-security maximum command is configured on the 2940, 2950 and 2955, 2970, 3550 or 3750 series of switches, then the addresses do not age out until the switch is reset. If another device is connected to the port after the maximum number has been reached, the port will not permit the new MAC address, even if one or more of the original MAC addresses are inactive.
To avoid having to manually delete the existing secure MAC address, the switchport port-security aging time
We are seeing similar behavior with cisco's new 8845 phone connected to a 3750. However we have no port security and like the other person on this thread we are using 802.1x via cisco ISE. Cisco ISE is fully integrated in this deployment. What is interesting in our case is that even after a switch reset the port will come back DROP on our voice vlan and phone will show up on our data vlan.
After many hours of the phone just setting there in a "detecting networking" state the phone will final join the voice vlan and everything is fine then.
It's almost like these new phones won't auth with MAB at first and are trying 802.1x. There is no ISE policy for 802.1x for the phones we are using MAB for the phones.
We are seeing similar behavior with cisco's new 8845 phone connected to a 3750. However we have no port security and like the other person on this thread we are using 802.1x via cisco ISE. Cisco ISE is fully integrated in this deployment. What is interesting in our case is that even after a switch reset the port will come back DROP on our voice vlan and phone will show up on our data vlan.
After many hours of the phone just setting there in a "detecting networking" state the phone will final join the voice vlan and everything is fine then.
It's almost like these new phones won't auth with MAB at first and are trying 802.1x. There is no ISE policy for 802.1x for the phones we are using MAB for the phones.
.png "Arumugam Muthaiah"){kind=avatar}
