topic Re: Unable to see MAC address of IP Phone in ISE in Network Access Control

Unable to see MAC address of IP Phone in ISE

dgaikwad — Wed, 20 Jun 2018 06:44:32 GMT

Hi All,

Been configuring the HP 5130 switch with ISE.

I am able to get the normal Dot1X authentication working fine.

Now when I am configuring the switch to do a MAB, using the Cisco IP phone.

What I see that is, the phone gets registered, but there are no traces of it the live logs on ISE.

Also, if I connect a computer via the phone, I can see that computer MAC address and other details in the live logs just fine.

Following is the setup:

ISE ver 2.3.0.298 patch 3

Switch Hp H3C Comware 7

Port config:

interface GigabitEthernet1/0/4

port link-type hybrid

undo port hybrid vlan 1

port hybrid vlan 230 untagged

port hybrid pvid vlan 230

voice-vlan 260 enable

mac-vlan enable

undo stp enable

stp edged-port

port bridge enable

poe enable

dot1x

undo dot1x handshake

dot1x handshake reply enable

dot1x mandatory-domain ciscoise

undo dot1x multicast-trigger

dot1x unicast-trigger

mac-authentication max-user 5

mac-authentication domain ciscoise

mac-authentication timer auth-delay 15

mac-authentication host-mode multi-vlan

mac-authentication parallel-with-dot1x

Any idea what could be going on here?

Re: Unable to see MAC address of IP Phone in ISE

gbekmezi-DD — Wed, 20 Jun 2018 14:14:42 GMT

Maybe these could help?

https://community.hpe.com/t5/Switches-Hubs-and-Modems/MAC-amp-802-1x-on-the-same-network/td-p/4620649

https://networkguy.de/?p=1649

Do you need this?

port-security port-mode userlogin-secure-or-mac-ext

I’d do a tcpdump on the psn to see if the switch is sending any radius requests when the phone connects (is it even attempting man?).

Warning: I either dictated this to my device, or typed it with my thumbs. Erroneous words are a feature, not a typo.

Re: Unable to see MAC address of IP Phone in ISE

Craig Hyps — Thu, 21 Jun 2018 11:54:24 GMT

It sounds like the switch is performing a CDP or LLDP bypass like function. The CDP Bypass function that was introduced by Cisco many years ago basically uses CDP to detect phone and authorize it to the Voice VLAN without authorization. We no longer recommend its use since it bypasses (as name suggests) authentication so you will not get record of it in the Live log. If HP switch is performing a similar function, then it will bypass RADIUS auth.

Re: Unable to see MAC address of IP Phone in ISE

dgaikwad — Thu, 21 Jun 2018 14:21:43 GMT

Was able to resolve it.

As pointed out chyps, the switch was running LLDP.
Disabled it and then was able to get the MAC addresses of the IP phones connected to this HP switch.

Re: Unable to see MAC address of IP Phone in ISE

dgaikwad — Thu, 21 Jun 2018 14:22:55 GMT

Thank you!

Disabled LLDP.

Was able to see the MAC addresses of the phone in ISE.

Dinesh

Re: Unable to see MAC address of IP Phone in ISE

Craig Hyps — Thu, 21 Jun 2018 14:41:17 GMT

Glad that you were able to confirm LLDP "bypass" was the culprit. Of course, profiling will not be able to use LLDP for profiling although DHCP is usuallty sufficient for phones. I would check with HPE to see if option to disable the bypass function so that you can continue to leverage LLDP and phone auth.

Re: Unable to see MAC address of IP Phone in ISE

dgaikwad — Thu, 21 Jun 2018 14:59:45 GMT

That would be really great!