topic Re: Authentication issue in Network Access Control

Authentication issue

ShareefKooliyodan0444 — Wed, 12 Jul 2023 09:46:29 GMT

is there any solution to authenticate multiple mac address for voice i mean for IP phone into the ISE .

My switch is connected with 6 ip phones cisco 2960 , and this switch is connected to cisco other switch model C9410R-is port number and conf details as below,

interface GigabitEthernet3/0/24
switchport mode access
dot1x timeout tx-period 7
dot1x max-reauth-req 3
source template DefaultWiredDot1xClosedAuth
spanning-tree portfast
spanning-tree bpduguard enabl

Re: Authentication issue

MHM Cisco World — Wed, 12 Jul 2023 09:55:07 GMT

Multi auth what you need

Dot1x host-mode multi auth

This can make each mac auth MAB to ISE

Re: Authentication issue

ShareefKooliyodan0444 — Wed, 12 Jul 2023 09:53:26 GMT

Yes I need muti- auth for IP phones

Re: Authentication issue

MHM Cisco World — Wed, 12 Jul 2023 09:54:46 GMT

Dot1x host-mode multi auth

This command what you need then

Re: Authentication issue

ShareefKooliyodan0444 — Wed, 12 Jul 2023 10:18:57 GMT

which cmd i should from below ?

(config-if)#dot1x host-mode ?
multi-domain Multiple Domain Mode
multi-host Multiple Host Mode
single-host Single Host Mode

Re: Authentication issue

MHM Cisco World — Wed, 12 Jul 2023 10:50:42 GMT

this SW not support multi auth ? only these mode available?
what is SW platform and IOS ver.
thanks
MHM

Re: Authentication issue

Rob Ingram — Wed, 12 Jul 2023 11:53:01 GMT

@ShareefKooliyodan0444 Multi-auth supports 1 device in the voice domain and multiple devices in the data domain, so you cannot authenticate multiple phones to the voice domain on the same interface (if that's what you are doing).

Re: Authentication issue

Aref Alsouqi — Wed, 12 Jul 2023 12:37:53 GMT

Are the phone ports configured to do dot1x or MAB? also, could you please share the configuration of the template "DefaultWiredDot1xClosedAuth" for review? in case you need to change the host mode you should do it from within the "DefaultWiredDot1xClosedAuth" template as you seem to be using C3PL on that switch.

Re: Authentication issue

MHM Cisco World — Wed, 12 Jul 2023 16:53:37 GMT

domain is use to separate data and voice connect to same PORT
@ShareefKooliyodan0444 are you connect PC and Phone to same port ? or you connect only phone ?

multi-auth I check is default in some SW, so only NO dot1x host-mode multi-host will return port to default