topic 802.1x Authentication and Phones in Network Access Control

802.1x Authentication and Phones

astockton — Mon, 11 Mar 2019 06:26:18 GMT

Catalyst 3750G new configuration for 802.1x authentication does not allow Cisco Phone on Voice VLAN

Hi,

hdussa — Fri, 29 Jan 2016 10:25:34 GMT

Hi,

authentication with PC and Phone needs "authentication host-mode multi-domain". You con use the MAC-Adress or 802.1X (username & password) for authentication of IP-Phone.

The authenticatipo profile must send "device-traffic-class=voice." to the switch. Then PC is in DATA-DOMAIN and Phone in VOICE-Domain.

see attachment:

Yes you can do that. When a

Jatin Katyal — Sun, 31 Jan 2016 15:10:54 GMT

Yes you can do that. When a Cisco IP phone is plugged into a port that is configured with a voice VLAN and single-host mode, the phone is silently allowed onto the network by way of a feature known as CDP Bypass. The phone, or any device, that sends the appropriate type-length-value (TLV) messages in a CDP message is allowed access to the voice VLAN. CDP Bypass is a legacy feature that has been deprecated in favor of MDA for these reasons.

HTH

~ Jatin

Jatin and hdussa,

astockton — Tue, 02 Feb 2016 19:13:37 GMT

Jatin and hdussa,

thank you both for the answers. They both pointed me in the right direction and I was able to make MAB work.

Arch

Re: Yes you can do that. When a

amin.amor — Thu, 28 Sep 2017 13:38:33 GMT

Hi,

The CDP Bypass feature is stoneage solution that is only supported on the old platforms like 2960/3750 but not 3750X. Do you know any other options that can be used to authenticate only the PC but not IP-Phone?

Exluding:

MIC

MAB