Cisco switches reporting connected Sigma devices using more than one MAC Address.

[Product_Support]

Issue

Cisco switches reporting connected Sigma devices using more than one MAC Address which appear to be transmitted from the Sigma device connected to the port. 

The error alarm reported "%PORT_SECURITY-2-PSECURE_VIOLATION: Security violation occurred, caused by MAC address 0050.b401.1e46 on port FastEthernet1/0/35"

Environment

All ARM7 Sigma Ethernet devices

• Cisco Catalyst 3550 Series Switches
• Cisco Catalyst 3560 Series Switches
• Cisco Catalyst 3560-E Series Switches
• Cisco Catalyst 3750-E Series Switches

Cause

1. Sigma controllers broadcasting high number of Sigma globals (typically 40 per second). Upgrading BAS2800+ systems to Sigma can result in higher levels of Sigma global data than seen previously.
2. Cisco switch set to 10Mb half duplex which mistakes the source MAC address of the Sigma global from a controller on one port with that of a controller on another port.
3. Cisco switch has Layer 2 Security feature enabled, see Click Here
4. High collision rates may also be seen at the switch.

Resolution

1. Identify those Sigma objects that are broadcasting global data at high rates and suppress the rate of change of the Sigma object.
   This can be achieved by:
   1. Running Wire Shark Ethernet trace program to record the Sigma broadcast Ethernet packs per Ethernet sub-LAN.
   2. Email each of the saved capture files (per LAN) to your local product support for a global analysis report.
2. If possible then increase the connection speed of the Cisco ports.
3. New firmware for the ARM processors has been created to addresses the issue. You can find the firmware and release note on the Exchange