802.1x Authentication and Phones

[BigK]

Hello,

trying to figure out what next to do on ISE so when I apply the command "sho authentication sessions" I should see the Method - as MAB - Domain as Voice and Status as Authoz success 

SW-lab#sho authentication sessions
Interface MAC Address Method Domain Status Fg Session ID
--------------------------------------------------------------------------------------------
Gi1/0/3 c4b9.cdb5.325e N/A UNKNOWN Unauth 0A16640A0000001B874935A0

Thanks

[gilesc]

Couple of questions to help you
1 what does the ise console say
2 what is the port config set to and the radius auth commands.

As you say if it is authenticating then it should show up but there isn’t much to go on here.

[Mohammed al Baqari]

You need to make sure that your ip phones aren't having dot1x enabled. Then
in your authorization profile enable voice domain tech box.

Other than that I am assuming that you have default authorization profiles
which should match cisco ip phones and non-cisco iphones and will allow them

[ldanny · Accepted solution]

You havent left enough information to work on except that the device is unauthenticated.

I recommend you take a look at this design guide for IP Telephony with 802.1x as well as MAB

Really good article which also shares the flow explanation.

https://www.cisco.com/c/en/us/td/docs/solutions/Enterprise/Security/TrustSec_1-99/IP_Tele/IP_Telephony_DIG.html