ISE, MAB and Shoretel Phones

[deyster94]

I am working on setting up ISE for a client that uses Shoretel Phones.  I created a profile for the devices so we can use MAB.  However, even though the switches and ISE show the phone passing authentication and authorization, the phone does not get an IP address.  I know the phone does work since when I take the commands off the switch port, the phone connects fine to the network.  

I am not sure if this is an ISE issue or Shoretel.  

TIA,

Dan

[deyster94]

Well, I figured it out.  I had to enabled LLDP on the switch to tell the phone what vlan to reside in.  The client told me that when the phone is connected, it first connects to the data vlan and from there, gets the information on the phone vlan, ftp server, etc.  From there, it reloads and connects to the phone vlan and downloads it's config.  They have all their ports in trunk ports (cringe), but with lldp, I have them in access ports.  

On the AuthZ profile, I tried using a dACL, which the phone didn't like.  Not a big deal since it was permit ip any any.  I was able to use the voice domain permission option as well.

Hopefully this will help someone in the future.

Dan

[Rafael Ertel]

Hey Dan,

We are trying to get our shoretel phones to use 802.1x/cisco2960(15.0(2)SE6)/NPS (with registry hack for MD5)

interface GigabitEthernet1/0/30

switchport mode access

switchport voice vlan 20

authentication host-mode multi-domain

authentication port-control auto

dot1x pae authenticator

no cdp enable

spanning-tree portfast

lldp has been enabled.  and according to shoretels scant docs when using lldp the phone should only reboot once.  the config of the port reflects our desire to have the phone send its voice traffic over the voice vlan and piggy back a pc through said phone.  The PC will be on vlan 10 and the voice vlan is 20.  Right now we have the NPS server handing out vlan 10 when the phone authenticates thus putting the port in the right vlan for the piggy backed PC but the phone never recognizes the Voice Vlan (20) and just loops.  shoretel has been zero help, any recommendations?

thanks,

rif

[sasni]

Hello, I'm from the future. 

So grateful to have found your post, but I'm struggling to understand on lldp setup that you mentioned. I have it configured globally "lldp run" and that's about it. Not sure if I need to add more lldp configs, do you mind sharing?

Regards, Sasni