When using checkpoint auto, the switch creates a temporary rollback point.
If you make a configuration change -- such as modifying the control-plane ACL -- you must commit the checkpoint for the change to become permanent.
Without running checkpoint commit, the switch keeps the configuration in a pending state, and after the auto-rollback timer expires, the switch restores the previous (less restrictive) ACL, which is why all networks are still allowed.

To profile devices using ClearPass with SPAN mode, you configure a mirror session that forwards traffic from the source interface to a designated destination port where ClearPass is connected, allowing it to inspect network traffic.

To detect physical cabling issues, you need alerts that indicate errors caused by bad terminations, damaged cables, or mismatched capabilities. The most relevant alerts are:
Switch Port Input Errors -- catches CRC errors, alignment errors, and other indicators of cable faults.
Switch Port Duplex Mode -- detects duplex mismatches, a common symptom of wiring or negotiation problems.
These two alerts provide the clearest visibility into physical-layer cabling issues.