Hello,
I'm trying to setup an open dot1x environment on C3750, with ACS 5.3 as RADIUS and Avaya as IP-phones.
When configuring on the interface
authentication port-control auto
authentication open
authentication host-mode multi-auth
the phone and PC can connect to their respective VLANs, obtain DHCP address and operate as expected. (Please note the switchport shows up as authenticated/authorized if the device has a dot1x supplicant on board, with valid credentials, but shows up as unauthorized if wrong credentials, or if no dot1x supplicant at all; however, I think this is normal behavior of the switchport).
Now, if the ACS is unreachable, the PC can still connnect to its VLAN and proceed, but the phone stays stuck in dot1x authentication.
My question : is this a misbehavior of the phone? I expect the phone to start with an EAPOL START, maybe switch and phone will subsequently exchange an 'identity request/response' but as the switch has no ACS in its backend, the process stops there, in other words, the phone will never be challenged for its credentials. I would expect the phone from then on to consider itself as authenticated and proceed 'just like it would proceed if authenticated, i.e. DHCP etc.
Nevertheless the phone seems to 'stay stuck' in its dot1x authentication procedure.
I don't expect that coding an authentication event server-dead action authorize ;... will unblock the phone's supplicant in this case of an already open dot1x port configuration.
Thanks for any clarification.
##### important update #####
From dot1x debug on the switch, it appears the phone sends each minute an EAPOL-start, triggering a EAPOL_Request_Identity (sw to phone) and EAPOL_Resp_Identity (phone to sw) and finally an EAPOL_FAIL code 4 (sw to phone). This last message does cause the phone to quick its dot1x process, it simply iterates on this sequence by reissuing EAPOL-start. Unlike the PC behind, which proceeds after the FAIL, considering itself as being authorized to the port (and the switch accepting, as we are in Open dot1x).
When now adding to the switchport
auth event server dead action authorize voice
auth ............................................................ vlan <native vlan>
the switch replies with an EAPOL code 4 - (auth) FAIL immediately. Again, the PC quits dot1x procedure and proceeds considering itself as authorized. And the phone continues sticking to dot1x EAPOL-start.
May we suspect here a 'bug' in the Phone, and should it stop further dot1x attempts (EAPOL-start) as soon as an EAPOL-Fail is received?
