802.1X MDA VLAN Tagging

[bdowney]

When a phone is on the voice vlan packet destined for it should have a 802.1q tag with a VLAN ID of the voice vlan.

Does the EAP packet (for the phone) have an 802.1q vlan header when using 802.1X MDA? What about re-authentication packets?

The Standard says VLAN tagging is not supported but it was not written with MDA in mind.

[stephan.l.martin1]

If my understanding of dot1x/eap authentication is correct- the dot1q header isn't applicable as the switch will simply take the information provided in regards to the EAP and forward it on to the authentication server prior to authorizing the device onto the network. Pre-authorization results in no traffic flowing through- all the authenticator cares about is forwarding the information to the authentication server and identifying what VLAN it needs to go into. The same should happen for any devices behind the phone.