A question regarding to 802.1X Multidomain Authentication

[rezaalikhani]

Hi all;

the following statement is from Cisco document:

MDA does not enforce the order-of-device authentication. However, for best results, we recommend that a
voice device is authenticated before a data device on an MDA-enabled port.

Now my question is how can I enforce this situation?

Thanks

[Flavio Miranda · Accepted solution]

Hi

 It is not possible. But if you think that through, this is what actually happen  as the PC is connected to the phone. Which means, first you connect the phone to the cable and then you plug the PC to the phone, at this time, phone already went to the authentication process.

 But, dont use MDA. Use Multi-Auth Mode instead. If you use MDA and your PC eventually run a Virtual Machine, you end up having problem due more than one mac address coming fro the Data connection. With Multi-Auth mode, you can use one phone at a time but you can have multiples data device. Of course, each new mac address must be authenticated.

Multi-Domain Authentication (MDA)	1 Voice and 1 Data device	access-session host-mode multi-domain
Multi-Host Mode	1 Voice and Unlimited Data (At least one MAC address must authenticate successfully)	access-session host-mode multi-host
Multi-Auth Mode	1 Voice and Unlimited Data (Each MAC address must authenticate)	access-session host-mode multi-auth

https://community.cisco.com/t5/security-knowledge-base/ise-secure-wired-access-prescriptive-deployment-guide/ta-p/3641515 

[Arne Bier · Accepted solution]

My 2c worth on the Cisco quote about getting voice devices up first, probably stems from the fact that if the port is configured as Multi-domain, then problems can occur (and will occur) when the phone boots WHILE there is an active PC attached to the phone. Since Multi-domain only allows 1 MAC address in the DATA domain, and since the PC is occupying that MAC address in the DATA domain, if the phone boots up and sends a single Ethernet frame BEFORE the phone has learnt its Voice VLAN (via LLDP/CDP), then the switch port will err-disable. This happens all the time and those users on the PC get disconnected. I have given up on trying to get multi-domain to work - it's too tricky. Multi-auth does the job and it's safer for all concerned.