cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
223
Views
0
Helpful
2
Replies
Beginner

Cisco IP Phone 7942-G EAP-TLS Issue

Hi,

 

I was trying to troubleshoot 802.1x issues with 7942-G IP Phones (sccp version 9.4.2ES22) . What happened was the ip phone will suddenly go to "Configuring IP". This IP Phone was previously authenticated through 802.1x using EAP-TLS. When I did the packet capture on the port, I noticed that the phone is not replying to EAP-Request and eventually will timed out with EAP Failure Code 4. Our NAC server shows (Request time out, client did not complete eap transaction).

 

It will only normalize after I bounced the switchport or do a hard reset on the phone. But the issue will keep occurring randomly. There is no specific time interval as well, so its kind of hard to pinpoint the issue. I have attached the wireshark packet capture for reference.

 

Below is the summary of events based from the packet capture file. So between 16:23.16 and 16:26:56.62 no EAP packets found. I bounced the switch port at16:27:10.19, then phone will start the authentication process.

 

16:23:16 - The phone is "Configuring IP" and Sends DHCP Discover
16:26:56.62 - EAP Failure (CPPM Logs: Request time out, client did not complete eap transaction)
16:27:10.15 - Cisco Sends LLDP Untagged Packets
16:27:10.19 - EAPOL START from Cisco IP Phone (After port bounced)
16:27:10.23 - Alcatel send EAP Request; Type: Identity
16:27:10.29 - Cisco Send EAP Response; Type: Identity
16:27:10.47 - Alcatel send EAP Request; Type: EAP-TLS
16:27:10.54 - Cisco Send TLS Client Hello
16:27:10.63 - Alcatel Send Server Hello, Cert, Cert Req
16:27:11.29 - Alcatel send EAP-TLS
16:27:14.02 - Cisco Send Cert Client Key Exchange
16:27:14.11 - Alcaltel Send Change Cipher Spec
16:27:14.12 - Cisco Send Response EAP-TLS
16:27:14.33 - Alcatel Send EAP Auth Success
16:27:24.97 - Cisco DHCP Discover
16:27:29.96 - DHCP Offer
16:27:30.086 - DHCP Request
16:27:30.087 - DHCP ACK
16:27:30.59 - Cisco sends LLDP Tagged Packet Voice Vlan 354

 

The phone is connected to a non-cisco switch (Alcatel 6860E) and non-cisco NAC server (Aruba Clearpass Policy Manager). I post this issue here because may be I could find similar issues integrating the Cisco IP Phones to non-cisco switch and NAC server.

 

Thank you in advanced for your support.

2 REPLIES 2
Cisco Employee

Re: Cisco IP Phone 7942-G EAP-TLS Issue

Can you take a console log from the phone during the event ? The pcaps start at when you have Configuring IP. The phone should not drop registration in the first place.
Also, have you tested this with a Cisco switch ?

Nipun Singh Raghav
"We cannot solve our problems with the same thinking we used when we created them"
Beginner

Re: Cisco IP Phone 7942-G EAP-TLS Issue

Hi,

 I will get the console logs and get back to you. Unfortunately, they
don't have Cisco Switch.

Thanks,
John
CreatePlease to create content
Content for Community-Ad
August's Community Spotlight Awards