topic Configuring Multi-auth host mode for IP Phones and APs / switches in Network Access Control

Configuring Multi-auth host mode for IP Phones and APs / switches

SMD28316 — Fri, 16 Jul 2021 12:36:25 GMT

Is it possible to authenticate APs / small switches and also Voice on the same port as clients?

as far as I know:

* APs and switches : authentication host-mode multi-host

* IP Phone + PC on the same port: authentication host-mode multi-auth.

Is it possible to have the same configuration on all ports? Can I use multi-auth to authenticate the phones and the APs / switches as well?

Configuring Multi-auth host mode for IP Phones and APs / switches

SMD28316 — Fri, 16 Jul 2021 12:43:08 GMT

Is it possible to authenticate APs / small switches and also Voice on the same port as clients?

as far as I know:

* APs and switches : authentication host-mode multi-host

* IP Phone + PC on the same port: authentication host-mode multi-auth.

Is it possible to have the same configuration on all ports? Can I use multi-auth to authenticate the phones and the APs / switches as well?

Re: Configuring Multi-auth host mode for IP Phones and APs / switches

IsmailDandashi1800 — Fri, 16 Jul 2021 12:44:40 GMT

yes you can since APs will use MAB as authentication method and DATA as a domain, using authentication host-mode multi-auth. will allow only one voice domain and multiple data domain.

Re: Configuring Multi-auth host mode for IP Phones and APs / switches

SMD28316 — Fri, 16 Jul 2021 13:13:14 GMT

So I can apply a port template that has "authentication host-mode multi-auth" for both AP / Switches ports and for ports connected to IP Phones?

What if the port is configured as trunk? what will be the affect?

Re: Configuring Multi-auth host mode for IP Phones and APs / switches

IsmailDandashi1800 — Fri, 16 Jul 2021 13:48:12 GMT

yes you can use "authentication host-mode multi-auth", I don't recommend to apply dot1x configuration on trunk port

Re: Configuring Multi-auth host mode for IP Phones and APs / switches

thomas — Sat, 07 Aug 2021 01:32:27 GMT

Yes. That is the goal for consistency and we call that the universal switchport configuration.

Please read the ISE Secure Wired Access Prescriptive Deployment Guide which has our best practice configurations to handle all types of endpoints. Always use Multi-Auth.