topic Re: 802.1x with Vlan assignment and IP phone and PC in Network Access Control

802.1x with Vlan assignment and IP phone and PC

raul.cuevas — Sun, 10 Mar 2019 21:56:22 GMT

I have a Catalyst 4510R and I want to im plement 802.1x with dynamic VLAN assignment via Radius server. I am going to plug to switch ports Cisco IP phones and PCs (PCs are plugged in the IP phone).

For this implementation I need to configure the switch port in mode trunk because I have voice vlan corresponding IP phone and data vlan corresponding to PC.

However I have read that I can not enable 802.1x on a trunk port.

How could I configure this?

I need that when the PC is authenticated correctly is assigned to his cooresponding data vlan and the IP phone is in the voice vlan.

Thanks

Re: 802.1x with Vlan assignment and IP phone and PC

jafrazie — Tue, 23 Jan 2007 16:08:09 GMT

You should configure the port as an access port with an aux-vlan. Here's an example:

interface GigabitEthernet2/2

switchport access vlan 701

switchport mode access

switchport voice vlan 702

load-interval 30

qos trust device cisco-phone

qos trust cos

auto qos voip cisco-phone

dot1x pae authenticator

dot1x port-control auto

tx-queue 3

bandwidth percent 33

priority high

shape percent 33

spanning-tree portfast

spanning-tree bpduguard enable

service-policy output autoqos-voip-policy

Hope this helps,

Re: 802.1x with Vlan assignment and IP phone and PC

raul.cuevas — Wed, 24 Jan 2007 08:05:26 GMT

Thanks for your help and for your example.

I have one question about this.

In the configuration example if you put "switchport access vlan 701" you are forcing the PC which is plugged to the Cisco IP Phone to be assigned to the data vlan 701 and I would like that this dynamic assignment was done for Microsoft IAS (Radius server) ,previously configured, according to the username and password set.

Re: 802.1x with Vlan assignment and IP phone and PC

jafrazie — Wed, 24 Jan 2007 16:42:24 GMT

It doesn't matter either way. If you put "switchport access vlan 701" on the port, that just means 701 is whats configured. You can configure a VLAN from RADIUS with this just fine. It can be the same VLAN, a different VLAN, etc.

If you didn't have "switchport access vlan 701" configured, then you might as well have "switchport access vlan 1" configured anyway (which is the default, and wouldn't be recommended from a security best-practice anyway).

Hoep this helps,