ISE Dynamic Voice Vlan Assignment using MAB

[alex.fana1]

Hello Everyone,

I've just configured the ISE and the switch to do the authentication for my voice vlan telephones and users. The issue that I'm having is assigning a dynamic Voice vlan for my VTC units

The authentication and authorization is working good with ISE and I'm able to assign the users vlan, but I'm having issues with the voice vlan.

Any help would be appreciated!

Thanks!

[Jagdeep Gambhir]

Do not push device class=voice attribute for this authorization rule. Only vlan id is needed.

Regards,

~JG

[alex.fana1]

Hi Jag,

 I tried and the voice vlan is not changing.

====Config=====

!
interface GigabitEthernet0/16
 switchport access vlan 153
 switchport mode access
 switchport voice vlan 210
 srr-queue bandwidth share 1 30 35 5
 priority-queue out
 authentication event fail action authorize vlan 225
 authentication event server dead action authorize
 authentication event no-response action authorize vlan 225
 authentication event server alive action reinitialize
 authentication port-control auto
 mab
 mls qos trust device cisco-phone
 mls qos trust cos
 macro description doj-dot1x | doj-dot1x
 dot1x pae authenticator
 dot1x timeout quiet-period 3
 dot1x timeout tx-period 15
 auto qos voip cisco-phone
 spanning-tree portfast
 spanning-tree bpduguard enable
 service-policy input AUTOQOS-SRND4-CISCOPHONE-POLICY
end

==========

[Jagdeep Gambhir · Accepted solution]

Alex,

We cannot setup more then one voice vlan. Is that what you are trying to achieve?

Do not push any vlan id in the authorization rule. Pushing class=voice attribute will assign vlan 210 (voice vlan) .

Only data vlan should be assigned dynamically.

Hope that helps

Regards,

~JG

Do rate helpful posts