ISE integration with IP Phone over VPN

[mronan]

Is there any design documentation on how an IP Phone using VPN and connected to Communications Manager will interact (authentication, posture, profile) with ISE?

[kthiruve · Accepted solution]

IP phone usually is configured for 802.1x multidomain or MAC filtering using Macauthbypass. This is specific to wired connection using 802.1x. Some of the Cisco IP phones also as supplicants that faciliates that.

The idea is to provide access to voice independent of the data. Also to provide access from IP phone to the Voice management software prior to getting authenticated so that phone connection does not go down during authentication.

Usually IP phones do not have VPN agents to connect to a VPN server such as ASA. So initiating a VPN connection is a problem here. For access, you need to provide connection from the IP phone to the Voice management software prior to authentication to provide seamless access to IP phones before and after authentication.

Posture needs Anyconnect posture module, hostscan that is supported for various OS, not phones. ISE profiling uses different probes and gathers information from typically inside a corporate network.

Hope it helps.

Thanks

Krishnan

[gbekmezi-DD]

I haven’t tried it, but I expect you should be able to do authorization with ISE just fine which would allow you to push an appropriate policy for the phones.

George