Security

Hi All,

I have a switch port here that is blocked by port access, the interface is configured with mac-auth, all is well before an upgrade. Issue only happens after upgrade. We can only make it work by removing mac-auth and assigning static vlan. Logs below. 

Clearpass access tracker radius authentication indicates successful as well. 

Prev firmware : FL.10.13.1110
Upgraded firmware : FL.10.13.1161

interface 2/1/2
    no shutdown
    no routing
    vlan access 70
    spanning-tree bpdu-guard
    spanning-tree port-type admin-edge
    aaa authentication port-access client-limit 8
    aaa authentication port-access mac-auth
        reauth
        reauth-period 300
        enable
    power-over-ethernet pre-std-detect
    exit

show port-access int 2/1/2 status

 Port             Interface        Status
 ---------------- ---------------- ------------
 2/1/2            2/1/2            Blocked

show int 2/1/2

Interface 2/1/2 is up (Blocked)
 Admin state is up
 Link state: up for 1 minute (since Fri Jun 12 17:27:48 +08 2026)
 Link transitions: 51
 Description: B1, SIA Theather Exit - 179
 Persona:
 Hardware: Ethernet, MAC Address: 
 MTU 1500
 Type 5G-SmartRate
 Full-duplex
 qos trust none
 Speed 100 Mb/s
 Auto-negotiation is on
 Flow-control: off
 Error-control: off
 MDI mode: MDIX
 Leader-follower mode: preferred-leader
 VLAN Mode: access
 Access VLAN: 70
 Rate collection interval: 300 seconds

 Rate                               RX                   TX        Total (RX+TX)
 ---------------- -------------------- -------------------- --------------------
 Mbits / sec                      0.00                 0.00                 0.00
 KPkts / sec                      0.00                 0.00                 0.00
   Unicast                        0.00                 0.00                 0.00
   Multicast                      0.00                 0.00                 0.00
   Broadcast                      0.00                 0.00                 0.00
 Utilization %                    0.00                 0.00                 0.00

 Statistic                          RX                   TX                Total
 ---------------- -------------------- -------------------- --------------------
 Packets                           196               616996               617192
   Unicast                          31                19219                19250
   Multicast                         0               150264               150264
   Broadcast                       165               447513               447678
 Bytes                           59352             85261233             85320585
 Jumbos                              0                    0                    0
 Dropped                             0                    0                    0
 Pause Frames                        0                    0                    0
 Errors                              0                    0                    0
   CRC/FCS                           0                  n/a                    0
   Collision                       n/a                    0                    0
   Runts                             0                  n/a                    0
   Giants                            0                  n/a                    0

show aaa authentication port-access int 2/1/2 client-status

Port Access Client Status Details

RADIUS overridden user roles are suffixed with '*'

Client 
======================================
  Session Details
  ---------------
    Port         : 2/1/2
    Session Time : 123s
    IPv4 Address :
    IPv6 Address :
    Device Type  :

  Authentication Details
  ----------------------
    Status          : mac-auth Authenticated
    Auth Precedence : dot1x - Not attempted, mac-auth - Authenticated
    Auth History    : mac-auth - Authenticated, 123s ago

  Authorization Details
  ----------------------
    Role   : ArubaCX_DUR_CCTV-3091-2
    Status : Download Failed

2026-06-12T17:27:35.194661+08:00   port-accessd[5482]: Event|10533|LOG_INFO|CDTR|1|Interface 2/1/2 is blocked by port-access.
2026-06-12T17:27:39.362429+08:00   intfd[936]: Event|404|LOG_INFO|UKWN|1|Link status for interface 2/1/2 is down - Administratively down
2026-06-12T17:27:39.393155+08:00   port-accessd[5482]: Event|10534|LOG_INFO|CDTR|1|Interface 2/1/2 is unblocked by port-access.
2026-06-12T17:27:44.234434+08:00   intfd[936]: Event|403|LOG_INFO|UKWN|1|Link status for interface 2/1/2 is up at 100 Mbps
2026-06-12T17:27:44.264998+08:00   port-accessd[5482]: Event|10541|LOG_INFO|CDTR|1|Interface 2/1/2 is blocked by port-access. Reason - No authorized clients.
2026-06-12T17:27:44.265121+08:00   port-accessd[5482]: Event|10533|LOG_INFO|CDTR|1|Interface 2/1/2 is blocked by port-access.
2026-06-12T17:27:46.215298+08:00   intfd[936]: Event|404|LOG_INFO|UKWN|1|Link status for interface 2/1/2 is down
2026-06-12T17:27:46.243310+08:00   port-accessd[5482]: Event|10534|LOG_INFO|CDTR|1|Interface 2/1/2 is unblocked by port-access.
2026-06-12T17:27:48.225257+08:00   intfd[936]: Event|403|LOG_INFO|UKWN|1|Link status for interface 2/1/2 is up at 100 Mbps
2026-06-12T17:27:48.256896+08:00   port-accessd[5482]: Event|10541|LOG_INFO|CDTR|1|Interface 2/1/2 is blocked by port-access. Reason - No authorized clients.
2026-06-12T17:27:48.257195+08:00   port-accessd[5482]: Event|10533|LOG_INFO|CDTR|1|Interface 2/1/2 is blocked by port-access.
2026-06-12T17:29:52.081619+08:00   intfd[936]: Event|404|LOG_INFO|UKWN|1|Link status for interface 2/1/2 is down
2026-06-12T17:29:52.112938+08:00   port-accessd[5482]: Event|10534|LOG_INFO|CDTR|1|Interface 2/1/2 is unblocked by port-access.
2026-06-12T17:29:54.109643+08:00   intfd[936]: Event|403|LOG_INFO|UKWN|1|Link status for interface 2/1/2 is up at 100 Mbps
2026-06-12T17:29:54.144221+08:00   port-accessd[5482]: Event|10541|LOG_INFO|CDTR|1|Interface 2/1/2 is blocked by port-access. Reason - No authorized clients.
2026-06-12T17:29:54.144357+08:00   port-accessd[5482]: Event|10533|LOG_INFO|CDTR|1|Interface 2/1/2 is blocked by port-access.

so if you downgrade to the previous version, int 2/1/2 would work fine?

------------------------------
If my post was useful accept solution and/or give kudos.
Any opinions expressed here are solely my own and not necessarily that of HPE or Aruba.
------------------------------

Not sure about that as we havent try rolling back. Apparently the mac is authenticated but unable to download role from clearpass. 

Error is SAN/CN doesnt match the peer name. TAC is looking in to it now. Unsure what doesnt match, the CN looks the same on both clearpass and switch. 

Original Message:
Sent: Jun 17, 2026 08:12 PM
From: AP-e172d8
Subject: Port blocked by port access

so if you downgrade to the previous version, int 2/1/2 would work fine?

------------------------------
If my post was useful accept solution and/or give kudos.
Any opinions expressed here are solely my own and not necessarily that of HPE or Aruba.
------------------------------

If you are having issues with cert, I would start there. 

I did just want to comment that I had issues with cx series in general and it was due to some radius attributes that were returned. It seemed the cx series was more strict then some of the other vendors when the Radius:IETF:User-Name is returned in 2 different formats. We had some cases that endpoints did not contain the dhcp hostname although insightdb did. 

You can do a debug for portaccess 

debug portaccess radius
debug portaccess role
debug portaccess services
debug destination buffer
show debug buffer reverse

You should see a line that states... "failed authorization with role.... " 

In my case there was no valid profile and no valid error which made it hard to troubleshoot. 

Original Message:
Sent: Jun 21, 2026 11:18 PM
From: HA-7sR358
Subject: Port blocked by port access

Not sure about that as we havent try rolling back. Apparently the mac is authenticated but unable to download role from clearpass. 

Error is SAN/CN doesnt match the peer name. TAC is looking in to it now. Unsure what doesnt match, the CN looks the same on both clearpass and switch. 

Original Message:
Sent: Jun 17, 2026 08:12 PM
From: AP-e172d8
Subject: Port blocked by port access

so if you downgrade to the previous version, int 2/1/2 would work fine?

------------------------------
If my post was useful accept solution and/or give kudos.
Any opinions expressed here are solely my own and not necessarily that of HPE or Aruba.
------------------------------

Your 2/1/2 client-status output indicates that the port is authenticated; at the time the command was entered, the session had been active for 123 seconds.

The port is not blocked by port-access, but for another reason. Have you enabled spanning-tree?

------------------------------
Regards,

Waldemar
ACCX # 1377, ACEP, ACX - Network Security
If you find my answer useful, consider giving kudos and/or mark as solution
------------------------------

if the downloadable user role is failing check the following in the switch

• clearpass server cert is still there,
• clearpass download user role credentials are still in place and correct
• date and time are correct 

------------------------------
If my post was useful accept solution and/or give kudos.
Any opinions expressed here are solely my own and not necessarily that of HPE or Aruba.
------------------------------

Original Message:
Sent: Jun 19, 2026 08:34 AM
From: WR-b1fc8f
Subject: Port blocked by port access

Your 2/1/2 client-status output indicates that the port is authenticated; at the time the command was entered, the session had been active for 123 seconds.

The port is not blocked by port-access, but for another reason. Have you enabled spanning-tree?

------------------------------
Regards,

Waldemar
ACCX # 1377, ACEP, ACX - Network Security
If you find my answer useful, consider giving kudos and/or mark as solution
------------------------------