Comware

Your port mode explains most of this. With port-security port-mode userlogin-secure-or-mac the port is multi-client by design, so every MAC that ever authenticates there gets its own AUTH entry, and those entries don't age (that's the N in your output). Notice almost all of them sit in VLAN 4090, which in your config is simultaneously the PVID, guest, auth-fail and critical VLAN. Combined with re-authenticate server-unreachable keep-online, that's the exact fingerprint of clients getting parked in the critical VLAN during a ClearPass outage and then kept online: stale entries pile up and stay.

So first, check whether these switches lost reachability to ClearPass recently, and look at Access Tracker for those MACs. Second, several of those MAC prefixes look like HPE Aruba hardware rather than PCs, so check what's physically on those ports; an AP or a small switch behind a port bridges every client MAC onto it. And if there's a downstream switch on a port carrying stp edged-port, you've disabled the protection that would catch a loop moving MACs between ports.

I'd hold off capping with port-security max-mac-count until you know what those MACs are, a cap on a port with an AP behind it takes out real users.

Hello DB86,

thank you for replying, vlan VLAN 4090 is for untrust device, yes the switches can reach to ClearPass. in Access Tracker this mac are connect to switch in another location and different port.

the port only one PC connect or IP Phone and PC, this problem happen on many switch.

Thank you

Your port mode explains most of this. With port-security port-mode userlogin-secure-or-mac the port is multi-client by design, so every MAC that ever authenticates there gets its own AUTH entry, and those entries don't age (that's the N in your output). Notice almost all of them sit in VLAN 4090, which in your config is simultaneously the PVID, guest, auth-fail and critical VLAN. Combined with re-authenticate server-unreachable keep-online, that's the exact fingerprint of clients getting parked in the critical VLAN during a ClearPass outage and then kept online: stale entries pile up and stay.

So first, check whether these switches lost reachability to ClearPass recently, and look at Access Tracker for those MACs. Second, several of those MAC prefixes look like HPE Aruba hardware rather than PCs, so check what's physically on those ports; an AP or a small switch behind a port bridges every client MAC onto it. And if there's a downstream switch on a port carrying stp edged-port, you've disabled the protection that would catch a loop moving MACs between ports.

I'd hold off capping with port-security max-mac-count until you know what those MACs are, a cap on a port with an AP behind it takes out real users.

Thanks, that changes the picture. If ClearPass is reachable and Access Tracker shows those same MACs live on a different switch in another location, then what you're seeing on this port is MAC movement: frames with those source MACs are physically arriving inbound on GE2/0/21, getting MAC-authed there, and parking. With one PC on the port, something in the network is replaying that traffic into your access layer.

Pick one victim MAC and run display mac-address for it on several switches at the same time. If it flips between sites, you've got a loop or a bridging device joining two segments, often an unmanaged desk switch or a wall jack patched back to another jack somewhere. Check your uplinks for topology change counters around the times new entries appear. And look hard at whether VLAN 4090 stretches across all these locations, a flat untrust VLAN spanning sites is exactly the highway this kind of churn rides.

If the MACs flap in sync across switches, chase the loop, not the auth config. The auth is just faithfully reporting what the wire delivers.

Hello DB86,

thank you for replying, vlan VLAN 4090 is for untrust device, yes the switches can reach to ClearPass. in Access Tracker this mac are connect to switch in another location and different port.

the port only one PC connect or IP Phone and PC, this problem happen on many switch.

Thank you

Your port mode explains most of this. With port-security port-mode userlogin-secure-or-mac the port is multi-client by design, so every MAC that ever authenticates there gets its own AUTH entry, and those entries don't age (that's the N in your output). Notice almost all of them sit in VLAN 4090, which in your config is simultaneously the PVID, guest, auth-fail and critical VLAN. Combined with re-authenticate server-unreachable keep-online, that's the exact fingerprint of clients getting parked in the critical VLAN during a ClearPass outage and then kept online: stale entries pile up and stay.

So first, check whether these switches lost reachability to ClearPass recently, and look at Access Tracker for those MACs. Second, several of those MAC prefixes look like HPE Aruba hardware rather than PCs, so check what's physically on those ports; an AP or a small switch behind a port bridges every client MAC onto it. And if there's a downstream switch on a port carrying stp edged-port, you've disabled the protection that would catch a loop moving MACs between ports.

I'd hold off capping with port-security max-mac-count until you know what those MACs are, a cap on a port with an AP behind it takes out real users.