1

I'm playing with Dot1x port authentication, the interface G2/0/2 is connected to a PC and is authenticated/authorized successfully:

SW1-2960#show authentication sessions int g2/0/2 det
            Interface:  GigabitEthernet2/0/2
          MAC Address:  <hidden>
         IPv6 Address:  Unknown
         IPv4 Address:  10.13.2.12
            User-Name:  nicole
               Status:  Authorized
               Domain:  DATA
       Oper host mode:  multi-auth
     Oper control dir:  both
      Session timeout:  900s (local), Remaining: 215s
       Timeout action:  Reauthenticate
      Restart timeout:  N/A
Periodic Acct timeout:  N/A
       Session Uptime:  688s
    Common Session ID:  0A304A190000004026FD9FC8
      Acct Session ID:  0x00000020
               Handle:  0x8A000026
       Current Policy:  POLICY_Gi2/0/2

Local Policies:
        Service Template: DEFAULT_LINKSEC_POLICY_SHOULD_SECURE (priority 150)

Server Policies:
              ACS ACL:  xACSACLx-IP-TEMP_ACL-60b7be60 <From ISE>

Method status list:
      Method            State

      dot1x              Authc Success

IP device tracking shows that the IP/MAC binding is successful using ARP:

SW1-2960#show ip device tracking all
Global IP Device Tracking for clients = Enabled
Global IP Device Tracking Probe Count = 3
Global IP Device Tracking Probe Interval = 30
Global IP Device Tracking Probe Delay Interval = 0
-----------------------------------------------------------------------------------------------
  IP Address    MAC Address   Vlan  Interface           Probe-Timeout      State    Source
-----------------------------------------------------------------------------------------------
10.13.2.12     <Hidden>        1    GigabitEthernet2/0/2   30              ACTIVE   ARP

However, this isn't reflected on the ARP table:

SW1-2960#show arp | i g2/0/2
SW1-2960#

What could be the reason?

My configuration under the interface is basic:

SW1-2960#show running-config int g2/0/2
Building configuration...

Current configuration : 404 bytes
!
interface GigabitEthernet2/0/2
 switchport mode access
 ip access-group BLOCK in
 authentication host-mode multi-auth
 authentication open
 authentication order dot1x mab
 authentication priority dot1x mab
 authentication port-control auto
 authentication periodic
 authentication timer reauthenticate 900
 authentication timer restart 2
 mab
 dot1x pae authenticator
 spanning-tree portfast edge
end

SW1-2960#

The BLOCK ACL is overridden by the ACL xACSACLx-IP-TEMP_ACL-60b7be60 which is provided by ISE.

ARP table shows only bindings for the interface G2/0/45:

SW1-2960#show ip arp
Protocol  Address          Age (min)  Hardware Addr   Type   Interface
Internet  <hidden ip>              0  <hidden MAC>    ARPA   GigabitEthernet2/0/45
Internet  <hidden ip>             29  <hidden MAC>    ARPA   GigabitEthernet2/0/45
Internet  <hidden ip>            67   <hidden MAC>    ARPA   GigabitEthernet2/0/45
Internet  <hidden ip>             -   <hidden MAC>    ARPA   GigabitEthernet2/0/45
Internet  <hidden ip>             0   <hidden MAC>    ARPA   GigabitEthernet2/0/45
Internet  <hidden ip>            66   <hidden MAC>    ARPA   GigabitEthernet2/0/45
...........

SW1-2960#show running-config int g2/0/45
Building configuration...

Current configuration : 92 bytes
!
interface GigabitEthernet2/0/45
 no switchport
 ip address <Some IP address> 255.255.254.0
end

SW1-2960#

Is there a way to show all ARP bindings?

1
  • Just because a device connects to a switch interface does not mean the switch has an ARP entry for it. A layer-2 interface will not use ARP. It could have a CAM table entry if the device sends a frame into the switch, but ARP is only for layer-3 interfaces, not layer-2 interfaces. – Ron Maupin Jun 13 at 15:01
1

Do not confuse layer-2 interfaces with layer-3 interfaces. Only layer-3 interfaces have ARP tables. The layer-2 interfaces feed the CAM tables, but not the ARP tables.

Your switch interface in question is a layer-2 interface based on the configuration you show:

interface GigabitEthernet2/0/2
 switchport mode access

That interface will not have an ARP table. If you have a layer-3 SVI for the VLAN of that interface, you may have the ARP information of devices connected to that layer-2 interface in the ARP table of the layer-3 SVI. That depends on any layer-3 communications, or lack of, between any devices on the layer-2 interface and the SVI layer-3 interface.

Basically, you are looking for an ARP table on an interface that does not have an ARP table.

2
  • Ok thank you for the explanation, but why is the device tracking showing the source as ARP on the interface? – Somayyah Mohammed Jun 13 at 16:25
  • It is showing the interface where the device is connected. That is tracking the device, but it is not showing the ARP table, only that it got the IP address from ARP probes. The ARP table will be on a layer-3 interface. A layer-2-only switch will not have an ARP table, a layer-2 switch with a layer-3 management interface will have an ARP table for the layer-3 management interface, and a layer-3 switch will have an ARP table for each layer-3 interface. – Ron Maupin Jun 13 at 16:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.