topic Re: Cisco IP Communicator not triggering MAB in Network Access Control

Cisco IP Communicator not triggering MAB

muhammad_2013331 — Fri, 21 Feb 2020 18:32:53 GMT

Please can someone confirm that will Cisco IPC trigger MAB as a normal Cisco IP Phone or just the PC on which it is installed should trigger MAB. Moreover, as a Cisco IP Phone has a three-port switch , if we want to connect a second PC behind the real Phone, in Cisco IPC is that PC (in access VLAN) the PC on which this IPC software is installed or another PC connected to the PC on which IPC is installed?

Re: Cisco IP Communicator not triggering MAB

Mohammed al Baqari — Sat, 26 Aug 2017 10:59:36 GMT

Hi, CIPC will be detected as Cisco IP Phone if you have CDP driver installated and detected on your workstation. Now if you use your NIC MAC for CIPC, your workstation will be classified wrongly as IP Phone. I suggest to use seperate MAC in CIPC settings. This will have the switch port to have two seperate MAB sessions for workstation and IP Phone.

Regarding the 2nd point, its all about how many mac addresses you have. If you configure your CIPC to use seperate MAC address then you have 1 mac for IP Phone, 1 mac for PC and 1 mac for CIPC.

Re: Cisco IP Communicator not triggering MAB

muhammad_2013331 — Sun, 03 Sep 2017 11:05:46 GMT

Thank you so much for replying...and sorry for me replying late..but.

Question # 1:

How do you hardcode MAC address of CIPC?

Question # 2:

You said one MAC for CIPC and one for Windows OS...but how does it forms three MAC addresses 1 for CIPC, one for PC and one for IP Phone?

Re: Cisco IP Communicator not triggering MAB

muhammad_2013331 — Sun, 03 Sep 2017 11:37:38 GMT

I have the following topology in VIRL:

Cisco CIPC ------IOSvL2-------CUCM

When i have the following configuration on IOSvL2 port connecting to CIPC:

int g0/x

switch mode access

switch acce vlan 64

switch voice vlan 5

Phone should connect to the VLAN 5 SVI on Cisco IOSvL2 and PC traffic should connect to VLAN 64 SVI. but unfortunately only access mode traffic is passed i.e. VLAN 64. Therefore, when i remove Voice VLAN from port, i can correctly connect the phone to CUCM (i.e. i use VLAN 64 to connect to CUCM), which implies that CIPC traffic passes over access VLAN.

Is it normal behavior or VIRL does not support Voice VLANs yet?

Re: Cisco IP Communicator not triggering MAB

Mohammed al Baqari — Mon, 04 Sep 2017 08:06:51 GMT

Its a problem with windows. switches add voice vlan as dot1q header to voice frames while windows drop strips dot1q header. Additionally, do you see cipc in cdp neighbor. If not then you don't have cdp driver installed on you machine.

I haven't worked on VIRL but this how it works in real switches

Re: Cisco IP Communicator not triggering MAB

Mohammed al Baqari — Mon, 04 Sep 2017 08:09:13 GMT

I don't have cipc installed now but you can do this from cipc settings > network tab. Then you can bind a interface to cipc or enter manual mac.

Regarding 2nd question, you can have multiple macs in same vlan as long as your switchport doesn't have security settings to stop this.

Re: Cisco IP Communicator not triggering MAB

muhammad_2013331 — Mon, 04 Sep 2017 12:23:20 GMT

When all tagging is removed(on ESXi) yes it shows as a CDP neighbor with "H P" (host and Phone). I tried the following to make it work:

As Voice Vlan packets are tagged i added a tag 5 in Windows VM vmxnet3 adapter

As Access VLAn packets are untagged i left that adpter at default

Then it ping'd the SVI's on the IOSvL2...but with this configuration:

int g0/x

sw mode trunk

sw trunk encap dot1q

sw trunk native vlan <access vlan of PC>

sw voice vlan <vlan of Phone i.e.5>

Re: Cisco IP Communicator not triggering MAB

Mohammed al Baqari — Mon, 04 Sep 2017 12:49:26 GMT

Good. This configuration is equivalent to access + voice vlan. If you are getting cdp and able to ping the SVI then you should be able to have CIPC connecting using MAB.