Wireless Access

last person joined: 14 hours ago 

Access network design for branch, remote, outdoor, and campus locations with HPE Aruba Networking access points and mobility controllers.
Expand all | Collapse all

what does :authmgr MAC=78:4f:43:54:3a:bb IP=172.25.163.234 IP Spoof from MAC=78:4f:43:54:3c:4a roll

This thread has been viewed 2 times
  • 1.  what does :authmgr MAC=78:4f:43:54:3a:bb IP=172.25.163.234 IP Spoof from MAC=78:4f:43:54:3c:4a roll

    Posted Jan 12, 2017 06:12 PM

    what is it this message is telling me:

     

    authmgr    MAC=78:4f:43:54:3a:bb IP=172.25.163.234 IP Spoof from MAC=78:4f:43:54:3c:4a role=authenticated   and where is it comming from?   we are running 6.4.4.8 code on a 7200 controller with 325 ap's

    we are using clear pass for our authentication server and we are using Certificates on the mac book pros to do the authentication.   is this message saying that the two machines have the same cert in them and using it to authenticate?



  • 2.  RE: what does :authmgr MAC=78:4f:43:54:3a:bb IP=172.25.163.234 IP Spoof from MAC=78:4f:43:54:3c:4a roll

    EMPLOYEE
    Posted Jan 12, 2017 06:16 PM
    That is when two devices have or attempt to have the same IP address.

    What is the output of "show AAA timer"?


  • 3.  RE: what does :authmgr MAC=78:4f:43:54:3a:bb IP=172.25.163.234 IP Spoof from MAC=78:4f:43:54:3c:4a roll

    Posted Jan 12, 2017 06:19 PM

    Colin,  thanks for the response.   the output is :

     

    (ortamc01w) #show aaa timer

    Global User idle timeout = 300 seconds
    Auth Server dead time = 10 minutes
    Logon user lifetime = 10 minutes
    User Interim stats frequency = 600 seconds



  • 4.  RE: what does :authmgr MAC=78:4f:43:54:3a:bb IP=172.25.163.234 IP Spoof from MAC=78:4f:43:54:3c:4a roll

    EMPLOYEE
    Posted Jan 12, 2017 06:32 PM
    Okay. What is your DHCP server lease time on that subnet?


  • 5.  RE: what does :authmgr MAC=78:4f:43:54:3a:bb IP=172.25.163.234 IP Spoof from MAC=78:4f:43:54:3c:4a roll

    Posted Jan 12, 2017 07:05 PM
    8 hours



    Sent via the Samsung Galaxy S® 6, an AT&T 4G LTE smartphone


  • 6.  RE: what does :authmgr MAC=78:4f:43:54:3a:bb IP=172.25.163.234 IP Spoof from MAC=78:4f:43:54:3c:4a roll

    Posted Jan 12, 2017 07:05 PM
    8 hours



    Sent via the Samsung Galaxy S® 6, an AT&T 4G LTE smartphone


  • 7.  RE: what does :authmgr MAC=78:4f:43:54:3a:bb IP=172.25.163.234 IP Spoof from MAC=78:4f:43:54:3c:4a roll

    EMPLOYEE
    Posted Jan 12, 2017 07:36 PM

    For some reason, a user is attempting to join with the ip address of another device and it was not allowed.  Sometimes devices attempt to use the last ip address that they had before, but I would open a TAC case to see how extensive this is to see if it is a real concern.



  • 8.  RE: what does :authmgr MAC=78:4f:43:54:3a:bb IP=172.25.163.234 IP Spoof from MAC=78:4f:43:54:3c:4a roll
    Best Answer

    Posted Jan 13, 2017 02:48 PM

    what we found was that clients were getting duplicate ip addresses due to the fact that we were using the same client id on all boxes so the dhcp server was seeing that id and giving them the same ip address.  once we made the client id on the macs be uinique this stopped happening.