topic 802.1X NPS SERVER / CISCO 7800 SERIES in Network Access Control

802.1X NPS SERVER / CISCO 7800 SERIES

yvanderunes802438600 — Sun, 28 Mar 2021 20:15:00 GMT

Hi there,

I'm trying to deploy 802.1X infrastructure for the first time.

I have one network with two VLAN one for the data and one for the voice.

I configure my NPS with EAP-TLS and certificate for the authentification.

The certificate are auto enroll via GPO for all the computer.

Everything is working well for Wifi, Switch except one thing.

The IP Phones only authentificate if one supplicant computer is connect behind.

I want to know the best practice to auth the IP Phones too.

The switches are netgear ... not my choice but it's the switches 😄

I never use this kind of ip phones. The easy way to allow and the less secure is to do a NPS Mac auth bypass ? to allow this equipements ? What about install certificate on this equipement ?

Regards

Re: 802.1X NPS SERVER / CISCO 7800 SERIES

balaji.bandi — Sun, 28 Mar 2021 22:43:11 GMT

Depends on the phone, some phones support Certificate, some are not, So best practice MAB - rather complicating things.

Hoping since you posted in the cisco community NPS is ISE or MS NPS(NPAS)?

here is the voice and Data deployment guide ISE point of you :

https://community.cisco.com/t5/security-documents/ise-secure-wired-access-prescriptive-deployment-guide/ta-p/3641515

Re: 802.1X NPS SERVER / CISCO 7800 SERIES

yvanderunes802438600 — Mon, 29 Mar 2021 09:15:16 GMT

Thank you for your answer. I'm using Microsoft NPS services.

Re: 802.1X NPS SERVER / CISCO 7800 SERIES

Marcelo Morais — Mon, 29 Mar 2021 11:23:39 GMT

Hi @yvanderunes802438600

please take a look at the link: 7800 Series Phone Security. for more information on the Cisco IP Phone 7800 Series.

Note: the IP Phone 7800 Series can be connect to the Cisco Communication Manager Call Control or with a Third-Party Call Control, please double check what is your case.

Hope this helps !!!

Re: 802.1X NPS SERVER / CISCO 7800 SERIES

yvanderunes802438600 — Mon, 29 Mar 2021 15:46:04 GMT

Thank you for the advice. I found this link : https://social.technet.microsoft.com/Forums/en-US/6d78c698-a087-48cb-bc73-9566aa61bf10/using-nps-with-cisco-ip-phones?forum=winserverNAP

I'm going to follow indication to do auth ip phones with the MIC certificate cisco and map after on username.