Hi again, mistery solved... the auditor has a little missunderstanding, is NOT possible to capture voice traffic in a port in the data vlan without do any thing more, today i'm trying to sniff traffic in a switchport on a data vlan and voice, witch only data, with a phone connected to the port and always fail, no RTP captured.   The only way to capture voice data is: 1 (Easy way) - Doing a CAM attack to do the switch acts as a HUB, with this attack i successfully capture a voice conversation. 2- Vlan hopping, using CDP discovery protocol you can find out the voice VLAN, advertise a fake CDP packet and obtain an ip address in the voice VLAN, then with a MitM you can sniff traffic of other phones in the network.   Attack mitigation: Disable cdp in data ports that have not ip phone Configure a maximun number of MAC address that a port can be learn, and disable the port if this number is reached Of course, encrypt RTP using SRTP Use access control from data VLAN to VOICE, is a common mistake that people think that because both VLAN's are internal in the organizations this are safe and all traffic it's permitted.   What do you think about my investigation? i'm wrong?   Thanks   ... View more

All certificate chain was uploaded to all ISE nodes. Finally I opened a TAC case and the solution was to go back to version ISE 2.3.     ... View more