Avaya E129 and closed authentication mode

[dgaikwad]

Hi Experts
I have a model E129 from Avaya, the phone settings are set to default for DHCP and 802.1x
When the phone is connected to a dot1x enabled port, the IP phone is not able to get any IP address, and the port stays in unauthorized state.
Where as ISE is able to push the right authz policies. I have tried a few permutations and combinations, but to no avail.
The interface config is as follows:
interface GigabitEthernet1/0/16
switchport access vlan 112
switchport mode access
switchport voice vlan 122
power inline never
authentication event server dead action reinitialize vlan 112
authentication event server alive action reinitialize
authentication host-mode multi-domain
authentication order mab dot1x
authentication priority dot1x mab
authentication port-control auto
authentication periodic
authentication timer reauthenticate server
authentication timer inactivity server
mab
dot1x pae authenticator
no cdp enable
spanning-tree portfast
spanning-tree bpduguard enable
end

WHen the phone is connected, I get this output from show authentication session:

show auth se int gi1/0/16 de
Interface: GigabitEthernet1/0/16
MAC Address: 000b.827c.6e86
IPv6 Address: Unknown
IPv4 Address: Unknown
User-Name: 00-0B-82-7C-6E-86
Status: Authorized
Domain: VOICE
Oper host mode: multi-domain
Oper control dir: both
Session timeout: N/A
Restart timeout: N/A
Periodic Acct timeout: 172800s (local), Remaining: 172663s
Session Uptime: 139s
Common Session ID: C0A8FE1D000012E5F1F8F328
Acct Session ID: 0x000064B2
Handle: 0x0D000353
Current Policy: POLICY_Gi1/0/16

Local Policies:
Service Template: DEFAULT_LINKSEC_POLICY_SHOULD_SECURE (priority 150)

Server Policies:

Method status list:
Method State

mab Authc Success

Is there something that is missing?
Could anyone direct me to troubleshoot this further as well?

[Arne Bier]

One thing that's tripped me up before is the VLAN definition on the switch. IOS allows you to mention a VLAN in an interface config - but if that VLAN has not been defined on the switch, then nothing works. But no error message. Check that both VLAN 112 and VLAN 122 exist on that box. And then of course, is there a trunk to another switch where the SVI lives, and is the ip helper configured on the SVI etc.

Have you tried an interface config without 802.1X (if the phone allows you to turn off 802.1X)?

[dgaikwad · Accepted solution]

While going through the flow I found that the, sh ip device tracking <interface> was showing a different mac address and IP address, different than the one that is already connected to the interface.
Cleared the entries from the device tracking and after that the phone started working as expected.