00:00:00:00:00:00 as MAC address in authentication session

[umahar]

Hi,

We are seeing huge number logs on ISE coming from MAC address 00:00:00:00:00:00 from different switches

The show authentication session output from the switch is shown below

The interface is configured with multi-auth and the phones and machines are working properly in DATA and VOICE domain.

Has anyone observed these logs before ?

What could be source of these requests ?

I do not see any such entry in the mac address table from that interface

[thomas]

Assuming your endpoints aren't spoofing 0000.0000.0000, your switch is clearly not picking up the correct MAC address from the endpoint or is garbling it at some point since your IOS auth-session output shows 0000.0000.0000. Garbage in, garbage out to ISE. Most likely a switch bug.

Highly recommend you upgrade your switch software to the recommended version in the ISE Compatibility Guides.