Phones bouncing between voice and data IP after reboot

[VijayHarripersad]

I have Avaya 1140e phones with my Cisco 9k series switch, configured with voice and data vlan. NO ISSUES

switchport access vlan X
switchport mode access
switchport nonegotiate
switchport voice vlan XX
device-tracking attach-policy IPDT_POLICY
access-session control-direction in
access-session closed
access-session port-control auto
mab
dot1x pae authenticator
spanning-tree portfast
service-policy type control subscriber xxxxxxxx

I am replacing with Avaya J179 phones. Phone gets Voice IP, after reboot gets data ip, after reboot gets voice ip, after reboot gets data ip and it keeps bouncing like this. However the issue is not present with these basic configs below, so I know that my DHCP configs and options are properly configured, plus it works fine with the Avaya 1140e phones.

switchport access vlan X
switchport mode access
switchport nonegotiate
switchport voice vlan XX

If I were to restore the full port configs like below, issue with J179 occurs, but not with Avaya 1140e phones.

switchport access vlan X
switchport mode access
switchport nonegotiate
switchport voice vlan XX
device-tracking attach-policy IPDT_POLICY
access-session control-direction in
access-session closed
access-session port-control auto
mab
dot1x pae authenticator
spanning-tree portfast
service-policy type control subscriber xxxxxxxx

Any recommendations?

[MHM Cisco World]

It clear issue of dot1x 

Check this guide 

https://www.cisco.com/c/en/us/support/docs/switches/catalyst-3750-x-series-switches/207193-Configure-IBNS-2-0-for-Single-Host-and-M.html

Since you use IBNS. 2 

MHM

[Nithin Eluvathingal]

The only difference I see between the working and non-working setups is that the non-working one has dot 1X configured as @MHM Cisco World mentioned. That could be causing the problem with the J179. From my experience, some non-Cisco phones work with Cisco switches using trunk configurations rather than access port configurations.

[Stefan Mihajlov]

@VijayHarripersad 

We hit this with Avaya J179s on Cat9k: in “closed” mode with 802.1X/MAB + IP Device Tracking, the port kept flipping authorization states, so the phone booted on the access VLAN, then learned the voice VLAN via LLDP-MED after MAB, then IPDT/DHCP-snooping nudged a reauth and it fell back to data—repeat. The quick fix was to stop using access-session closed and run “low-impact” instead, set authentication order mab dot1x (and priority MAB first), enable authentication host-mode multi-domain, and make sure LLDP is on so the phone can learn the voice VLAN pre/post-auth. If your IPDT policy is aggressive, either detach it on phone ports or use a lighter policy so glean/probe events don’t trigger reauth flaps. After those tweaks the J179s stayed on the voice VLAN consistently, while the 1140e kept working too.

Best regards,
Stefan Mihajlov

Mark this post as Helpful if it helped you, and Accept as Solution if it resolved your question.

[VijayHarripersad]

Hello, thanks so much for this, I have some unfamiliarity with your recommendation, can you provide a sample of commands I may need to run at global config and then the interface? I will test it in my environment and provide feedback on the resullts.

[pieterh]

suggestion
check when authentication switches between voice and data , then maybe it also switches between dor1x and mab ?

[VijayHarripersad · Accepted solution]

Hello,

This issue was resolved. On our data DHCP scope, we had to add OPTION 242 with the string value L2Q=1,L2QVLAN=#### for the J179 phones to consistently obtain VOICE VLAN IP address