topic Re: ISe 2.1 : PCs (dot1.x) behind IP Phone (7911-G,MAB) connected to Switch 4510R+E ios firmware 03.08.05 get 169.x.x.x address in Network Access Control

ISe 2.1 : PCs (dot1.x) behind IP Phone (7911-G,MAB) connected to Switch 4510R+E ios firmware 03.08.05 get 169.x.x.x address

issmoussa1 — Sun, 28 Jan 2018 09:36:58 GMT

Hello dear community,

since we changed our Switch 3850 to 4510R+E all PCs (802.1x) behind 7911-G (MAB) phones that authenticate at the ISE get addresses 169.x.x.x. you have to disconnect and reconnect the cable from the phone so that the PC has a good DHCP address. Every mornong, all users that use 7911-G have to disconnect and reconnect cable in order to get a good address.

the rest of the PCs connected to 7942, 7821, 6921 are working normally and have the correct DHCP addresses.

Does anyone already encounter this kind of issue?

Re: ISe 2.1 : PCs (dot1.x) behind IP Phone (7911-G,MAB) connected to Switch 4510R+E ios firmware 03.08.05 get 169.x.x.x address

Jason Kunst — Sun, 28 Jan 2018 12:38:14 GMT

Would suggest a tac case as well

Re: ISe 2.1 : PCs (dot1.x) behind IP Phone (7911-G,MAB) connected to Switch 4510R+E ios firmware 03.08.05 get 169.x.x.x address

hslai — Sun, 28 Jan 2018 23:07:20 GMT

End-of-Sale and End-of-Life Announcement for the Cisco Unified IP Phone 7911G shows that phone model has reached the last date of support on HW. Thus, it would be good that you replace them with a newer model.

Other than that, please take care why it happening each morning. Are the phones resetting at the time? It would be good if you have a good way to recreate the issue so Cisco TAC may debug and analyze. If the replaced 3850 still around, it's good to capture on both the new and the old.

Re: ISe 2.1 : PCs (dot1.x) behind IP Phone (7911-G,MAB) connected to Switch 4510R+E ios firmware 03.08.05 get 169.x.x.x address

ognyan.totev — Mon, 29 Jan 2018 05:32:19 GMT

I have 7911G in mine deployment,but the difference is that i authenticate them throughout DOT1X . And the PC too . Are u sure you did not miss something in Access list on switchport ?

Show us a port configuration .

Re: ISe 2.1 : PCs (dot1.x) behind IP Phone (7911-G,MAB) connected to Switch 4510R+E ios firmware 03.08.05 get 169.x.x.x address

issmoussa1 — Mon, 29 Jan 2018 10:03:28 GMT

following the port configuration :

int gx/x/x

switchport access vlan X

switchport mode access

switchport voice vlan 2

authentication event fail action authorize vlan Y

authentication event server dead action authorize vlan Z

authentication event no-response action authorize vlan W

authentication host-mode multi-auth

authentication order dot1x mab

authentication priority dot1x mab

authentication periodic

authentication timer reauthenticate server

authentication timer inactivity 3600

authentication violation restrict

mab

dot1x pae authenticator

dot1x timeout tx-period 10

spanning-tree portfast

spanning-tree bpduguard enable

Re: ISe 2.1 : PCs (dot1.x) behind IP Phone (7911-G,MAB) connected to Switch 4510R+E ios firmware 03.08.05 get 169.x.x.x address

ognyan.totev — Mon, 29 Jan 2018 10:21:55 GMT

ok as i see you dont use access list ,there is missing command authentication open. And i use access list like Access group name in.i would suggest you to look switch configuration guide here in community. I write this on phone but after 20 minutes i share a link.

Re: ISe 2.1 : PCs (dot1.x) behind IP Phone (7911-G,MAB) connected to Switch 4510R+E ios firmware 03.08.05 get 169.x.x.x address

issmoussa1 — Mon, 29 Jan 2018 10:59:09 GMT

Ok It will be great,

In my conf, I use DACL form of ACL with a permit any any statement, for the purpose to be sure that ACL does not cause the trouble.

Re: ISe 2.1 : PCs (dot1.x) behind IP Phone (7911-G,MAB) connected to Switch 4510R+E ios firmware 03.08.05 get 169.x.x.x address

ognyan.totev — Tue, 30 Jan 2018 05:22:44 GMT

How To: Universal 3850 Wired Class-based Policy Language (C3PL) Configuration for ISE

Re: ISe 2.1 : PCs (dot1.x) behind IP Phone (7911-G,MAB) connected to Switch 4510R+E ios firmware 03.08.05 get 169.x.x.x address

Jason Kunst — Tue, 30 Jan 2018 12:44:58 GMT

Agree unless super secure you should always be using authentication open

Re: ISe 2.1 : PCs (dot1.x) behind IP Phone (7911-G,MAB) connected to Switch 4510R+E ios firmware 03.08.05 get 169.x.x.x address

issmoussa1 — Mon, 05 Feb 2018 18:05:50 GMT

Hi,

Unfortunaltely, It doesn't work. We are now in the process to change all 7911-G that are in our Network.

Tank you all