topic Re: Cisco Catalyst 1300 and Dynamic VLAN in Network Access Control

Cisco Catalyst 1300 and Dynamic VLAN

Alexander Vasilev — Sun, 15 Jun 2025 18:38:41 GMT

Hello colleagues,

i'm trying to configure 802.1x authentication for Cisco IP Phone (79xx series) and computer connected on its switch port and this together connected to Cisco Catalyst 1300 switch (the new name of the SG-series SMB). Unfortunately i don't have luck. If the phone or the PC is connected alone on the port (single-host mode on the port) - everything is ok. The phone is not in a voice VLAN.

Port config:

bg08swacc21#sh run int gi1/0/25
interface GigabitEthernet1/0/25
dot1x host-mode multi-sessions
dot1x reauthentication
dot1x authentication 802.1x mac
dot1x radius-attributes vlan
dot1x port-control auto
description IPPhone_802.1x_Test_port
spanning-tree portfast
spanning-tree bpduguard enable

Authentication for both is successful:

14-Jun-2025 22:56:05 :%SEC-I-SUPPLICANTAUTHORIZED: MAC 30:37:a6:17:e6:70 is authorized on port gi1/0/25
14-Jun-2025 22:56:05 :%SEC-I-SUPPLICANTAUTHORIZED: username host/somename with MAC 24:6a:0e:9f:f6:ba is authorized on port gi1/0/25
14-Jun-2025 22:56:04 :%LINK-I-Up: gi1/0/25
14-Jun-2025 22:56:04 :%STP-W-PORTSTATUS: gi1/0/25 of vlan 1: STP status Forwarding
14-Jun-2025 22:55:59 :%LINK-W-Down: gi1/0/25

Each session received correct VLAN from the RADIUS server:

bg08swacc21#sho dot1x users

MAC Auth Auth Session VLAN
Port Username Address Method Server Time
-------- ---------------- ----------------- ------ ------ -------------- ----
gi1/0/25 host/somename 24:6a:0e:9f:f6:ba 802.1X Remote 00:00:14 1065
gi1/0/25 30-37-A6-17-E5-7 30:37:a6:17:e6:70 MAC Remote 00:08:21 1068
0

But MAC table doesn't show the VLANs and MACs:

bg08swacc21#sh mac address-table interface gi1/0/25
Flags: I - Internal usage VLAN
Aging time is 300 sec

Vlan Mac Address Port Type
------------ --------------------- ---------- ----------
1 30:37:a6:17:e6:70 gi1/0/25 dynamic

Can someone help with understanding how exactly multi-session should be implemented?

Thank you!

Re: Cisco Catalyst 1300 and Dynamic VLAN

Jens Albrecht — Sun, 15 Jun 2025 19:30:04 GMT

Hello @Alexander Vasilev,

if I understand your post correctly, then you want to authenticate a PC and a Phone on the same port but in different Vlans, right?

However, while multi-session enforces that each client connected to this port must be authenticated, it requires that all clients connected to this port must be in the same Vlan.

The Catalyst 1300/1200 series lacks a couple of enterprise-class features and the lack of the 'multi-domain' option is one of them. On the enterprise-class Catalyst switches you can use 'multi-domain' to authenticate PCs and Phones in 2 different Vlans but this is simply not possible on the 1300 series.

There appear to be 2 known workarounds for this issue:

You can enable the voice VLAN feature on the port, so that the switch uses a static MAC OUI table to detect phones and place them into the configured voice vlan.
However, this is not controlled by RADIUS or 802.1X authentication but only controlled by the static MAC OUI table of the switch.
You can ab-use the guest vlan to redirect traffic for the phone to a second vlan on the port.
This trick allows the PCs and a phone to be in different Vlans on the same port.

You can find more details about these 2 options including each configuration when you check out the following discussion:

https://community.cisco.com/t5/network-access-control/cisco-c1300-voice-vlan-via-radius-like-an-ios-switch-possible-or/td-p/5274600

HTH!

Re: Cisco Catalyst 1300 and Dynamic VLAN

Alexander Vasilev — Sun, 15 Jun 2025 20:15:33 GMT

Thank you, Jens!

Yes,exactly this is my idea. Phone and PC on same port, but different VLANs. For the multi-domain i got it there is no support, but neither of the VLANs is voice, i.e I don't have multi-domain situation.

As for the multi-session, my understanding is/was that multi-host dictates everyone to be on the same VLAN, but not the multi-session?

Guest VLAN is not something that i consider, because i also found this -https://community.cisco.com/t5/cisco-bug-discussions/cscvs35681-sg350-dhcp-relay-unauthenticated-users-on-guest-vlan/td-p/4086829

Regards,

Alexander

Re: Cisco Catalyst 1300 and Dynamic VLAN

Jens Albrecht — Sun, 15 Jun 2025 20:57:07 GMT

Hi Alexander,

regarding the Guest Vlan the post you mention is quite old. Based on the pretty recent discussion I mentioned it might work now, even though I still consider it to be a dirty trick and the only way to authenticate pc and phone in different vlans. Just try and check whether it works or not.

Multi-session and multi-host both only allow authentication of all hosts in the same Vlan.
The difference is that multi-session enforces that every single host on this port must be authenticated - for the same Vlan.
With multi-host on the other hand, only one host must authenticate and then all other connected clients on this port can join the same Vlan without any authentication. As stated in the documentation: "the port is authorized after at least one host is authorized" meaning all other hosts do not need to authenticate. This is an old legacy option that was used e.g. to open a port for a bunch of printers that are not dot1x-capable so that a single PC did the authentication for all of them. Definitely not recommended and hence multi-host should never be used.

The only other option would be the use of the voice Vlan but again without any authentication as these switches only check the MAC address based on the preconfigured OUI table to detect the phone.

Regards, Jens

Re: Cisco Catalyst 1300 and Dynamic VLAN

Alexander Vasilev — Tue, 17 Jun 2025 12:41:55 GMT

Hey Jens,

unfortunately i cannot make it work stable. With this configuration:

interface GigabitEthernet1/0/25
dot1x host-mode multi-sessions
dot1x guest-vlan enable
dot1x reauthentication
dot1x authentication 802.1x mac
dot1x radius-attributes vlan
dot1x max-hosts 3
dot1x port-control auto
description IPPhone_802.1x_Test_port
spanning-tree portfast
spanning-tree bpduguard enable

I see:

bg08swacc21#show dot1x users

MAC Auth Auth Session VLAN
Port Username Address Method Server Time
-------- ---------------- ----------------- ------ ------ -------------- ----
gi1/0/25 someuser/fromcert 24:6a:0e:9f:f6:ba 802.1X Remote 00:12:30 1065

But on the port from MAC table perspective:

bg08swacc21#show mac address-table int gi1/0/25
Flags: I - Internal usage VLAN
Aging time is 300 sec

Vlan Mac Address Port Type
------------ --------------------- ---------- ----------
1068 30:37:a6:17:e6:70 gi1/0/25 dynamic

I.e the phone fails authentication and it is in guest VLAN, but the PCs, marked as successfuly authenticated and it is missing in the MAC table.

And btw, the authentication fails for the phone constantly:

bg08swacc21#17-Jun-2025 15:30:10 %SEC-W-SUPPLICANTUNAUTHORIZED: MAC 30:37:a6:17:e6:70 was rejected on port gi1/0/25 due to wrong user name or password in Radius server
17-Jun-2025 15:32:10 %SEC-W-SUPPLICANTUNAUTHORIZED: MAC 30:37:a6:17:e6:70 was rejected on port gi1/0/25 due to wrong user name or password in Radius server
17-Jun-2025 15:33:10 %SEC-W-SUPPLICANTUNAUTHORIZED: MAC 30:37:a6:17:e6:70 was rejected on port gi1/0/25 due to wrong user name or password in Radius server
17-Jun-2025 15:34:10 %SEC-W-SUPPLICANTUNAUTHORIZED: MAC 30:37:a6:17:e6:70 was rejected on port gi1/0/25 due to wrong user name or password in Radius server

For multi-host the understanding is the same,at least one successful authentication,same VLAN for everyone. But for multi-session it should be possible different VLANs? Can you share reference that theymust be in same VLAN? From the documentation about the guest VLAN functionality, the phone in my case must be not authorized - "After linkup, if the software doesn’t detect the 802.1X supplicant, or the authentication has failed, the port is added to the guest VLAN, only after the Guest VLAN timeout period has expired."

From tests what you've said for multi-session is correct 🙂

Regards,

Aleksandar

Re: Cisco Catalyst 1300 and Dynamic VLAN

MHM Cisco World — Thu, 19 Jun 2025 09:32:15 GMT

dot1x host-mode multi-domain <<- did you try multi domain?

Can I see

Show authentication session interface x/x

Show mac-address interface x/x

MHM

Re: Cisco Catalyst 1300 and Dynamic VLAN

Alexander Vasilev — Thu, 19 Jun 2025 19:52:35 GMT

Hello,

since this is switch family only called Catalyst, but nothing close to Catalyst as operating system - there is no multi-domain, neither show authentication session interface x/x. In my previous posts i've shared the information.

One update, i have some progress with the help of Cisco TAC.

After enabling Voice VLAN and defining which exactly is the Voice VLAN, phone successfully authenticated and in proper VLAN.

Since Voice VLAN is tagged on the port on which is the phone and also i have PC behind the phone - changing the port to trunk mode was also a thing that helped. Now if i look in the VLAN table:

Voice VLAN on the port is tagged, Data VLAN is untagged.

Now i'm wrestling with VLAN before/after failed authentication, this should be possible with the guest VLAN function.

Re: Cisco Catalyst 1300 and Dynamic VLAN

Jens Albrecht — Thu, 19 Jun 2025 20:10:31 GMT

Hi Alexander,

so you are now back to the 2 workarounds initially mentioned and it's good to hear that they appear to work.

I do not have such devices at hand to test anything myself but Cisco TAC should be able to make it work as needed.

Regards, Jens

Re: Cisco Catalyst 1300 and Dynamic VLAN

MHM Cisco World — Thu, 19 Jun 2025 20:17:55 GMT

Regarding points

1- Authc failed of 802.1x the SW will shift to MAB.

2- multi-session I will check this mode it not use in catalyst

MHM

Re: Cisco Catalyst 1300 and Dynamic VLAN

Alexander Vasilev — Sat, 25 Oct 2025 19:29:43 GMT

Hello,

just to update the topic and eventually help someone. After a long struggle with the TAC and having still opened ticket, my achievement is just using either 802.1x either MAB on the interface. Don't mix it in multimode, don't think you'll achieve any intelligence for failovering between them. During the work with the TAC two main issues were mapped and even with latest software versions they are not ok:

• CSCwq10393: C1300 - Issue with multiple authentication methods on the interface

• CSCwo47792: C1300-24T-4G - Dynamic VLAN Allocation not working in PVST mode

Keep it simple, if anything more complex is needed - go to IOS-XE platform. Here this is not a focus, obviously.

Regards,

Alexander