authentication host-mode multi-auth or multi-host

[getaway51]

Hi,

Shld it be "authentication host-mode multi-auth" or "multi-host"?

I am connecting a IP phone and PC via the same port. Voice and data traffic same port. 

[jj27]

With a single IP phone and a single device behind the IP phone,  you are looking for

authentication host-mode multi-domain

Multi-auth would allow one client to connect to the voice VLAN and multiple to the data VLAN configured.

Multi-host would authenticate the first host it sees on the port then subsequently allow every other device connected behind the port to access the network without authentication.

[getaway51]

authentication host-mode multi-domain or multi-auth?

 With a single IP phone and a single device behind the IP phone

Which one will work? multi-domain or multi-auth?

[jj27]

Both will work, but multi-domain would be the best solution for your setup and ensure that only on device on each domain (voice, data) is allowed.

[Colby LeMaire]

Either one will work.  Which one you go with depends on whether or not you expect more than one data device to ever show up on a port.  I personally like multi-auth because sometimes some devices present multiple MAC addresses and multi-auth still ensures that each MAC address is authenticated before allowing access.  Multi-domain is a little restrictive with only allowing one data MAC address.  Multi-host should not be used since it isn't secure at all.  It only authenticates the first MAC address and then allows all others to communicate without authentication.  The only situation that I think of for multi-host is a workstation running VMware and you want to authenticate the host but allow all guest OS's to gain access.