topic Do not push device class in Network Access Control

ISE Dynamic Voice Vlan Assignment using MAB

alex.fana1 — Mon, 11 Mar 2019 06:53:37 GMT

Hello Everyone,

I've just configured the ISE and the switch to do the authentication for my voice vlan telephones and users. The issue that I'm having is assigning a dynamic Voice vlan for my VTC units

The authentication and authorization is working good with ISE and I'm able to assign the users vlan, but I'm having issues with the voice vlan.

Any help would be appreciated!

Thanks!

Do not push device class

Jagdeep Gambhir — Mon, 27 Jun 2016 18:40:35 GMT

Do not push device class=voice attribute for this authorization rule. Only vlan id is needed.

Regards,

~JG

Hi Jag,

alex.fana1 — Tue, 28 Jun 2016 14:43:46 GMT

Hi Jag,

I tried and the voice vlan is not changing.

====Config=====

!
interface GigabitEthernet0/16
switchport access vlan 153
switchport mode access
switchport voice vlan 210
srr-queue bandwidth share 1 30 35 5
priority-queue out
authentication event fail action authorize vlan 225
authentication event server dead action authorize
authentication event no-response action authorize vlan 225
authentication event server alive action reinitialize
authentication port-control auto
mab
mls qos trust device cisco-phone
mls qos trust cos
macro description doj-dot1x | doj-dot1x
dot1x pae authenticator
dot1x timeout quiet-period 3
dot1x timeout tx-period 15
auto qos voip cisco-phone
spanning-tree portfast
spanning-tree bpduguard enable
service-policy input AUTOQOS-SRND4-CISCOPHONE-POLICY
end

==========

Alex,

Jagdeep Gambhir — Thu, 30 Jun 2016 12:59:34 GMT

Alex,

We cannot setup more then one voice vlan. Is that what you are trying to achieve?

Do not push any vlan id in the authorization rule. Pushing class=voice attribute will assign vlan 210 (voice vlan) .

Only data vlan should be assigned dynamically.

Hope that helps

Regards,

~JG

Do rate helpful posts