Hello all,
My customer has what may be a unique situation for endpoints that are used by guests. We provide housing units for out of town family members of our patients. In these units, we provide both wireless and wired Internet access. We also have Mitel IP phones so they can dial any internal extension as well as make external calls. Our requirement is to allow the DATA domain, which could be any wired device, to go through the hotspot guest flow where they only accept the AUP before getting access to the Internet. The IP phone should not follow this flow but get full network access upon authenticating. However, my phone gets the authz profile I set up for the policy but my PC is failing MAB authentication per the log message on the switch. However, I am grabbing an IP address from DHCP and can ping it from another network based on the firewall rules I have set up but not getting redirected to the hotspot URL. In addition, if I remove the IP phone from the port and just set it up for a single host, I get the redirect URL and can proceed as normal. The issue occurs when I test with an IP phone on the same port. Below is the info I felt would be a good start in pointing me in the right direction:
MAB log:
Apr 26 14:53:10.267: %MAB-5-FAIL: Authentication failed for client (a01d.48b1.0735) on Interface Gi0/2 AuditSessionID 0A6401220000006B1381FB20
Port Config (used for testing the policy):
interface GigabitEthernet0/2
description *** LT22970 ***
switchport access vlan 60
switchport mode access
switchport nonegotiate
switchport voice vlan 30
ip device tracking probe count 1
ip device tracking probe interval 30
ip device tracking maximum 2
authentication host-mode multi-domain
authentication open
authentication order mab
authentication priority mab
authentication port-control auto
mab
spanning-tree portfast edge
spanning-tree bpduguard enable
end
IP Phone & Wired Guest Policy:
I'm not sure if it's my port config, the way I have the policies/rules set up in ISE, or a combination of both. Any assistance would be greatly appreciated from the community.
Thanks,
Terence
