802.1x and MS IAS and Nortel IP phone

hi,
i have setup 802.1x MS IAS. All seems to work fine when i am using a plain pc connection to switch but the moment IP phone is involved i start facing issues.
I am using cisco 3750 switch with version 12.2(25)SEB4
dhcp server is on windows which is on a different network i.e. 10.50.1.9
dhcp relay agent is defined on firewall subinterces
All works when phone is not involved. BTW i am using Nortel IP phone
when the phone is plugged and cable is throug the phone, i provide the user name and credentials and also when i say show vlan on switch i can see i am aprt of corrent vlan but i do not get an ip address.
This is the error i get on switch when is said debug radius:
pls find two attachments of debug dot1x events and radius.
pls help
Regards
AI

Hi Adil,
I'm testing with a Catalyst 3560 running IOS version 12.2(44)SE2.
I have a Nortel-LG IP phone which does not have 802.1x supplicant.
I tried configuring MDA on the switchport and use MAB to authenticate the phone.
My questions:
1. In the ACS, I created a group for the IP phone and specify "device-traffic-class=voice" as the cisco-av-pair. Is this what I should be doing for a non-Cisco phone?
2. I know the phone's MAC address is 00-40-5A-17-C6-30. I created a user 00405a17c630 (password is also 00405a17c630) and assign it to the IP phone group I created above. Is this correct?
My testing wasn't successful. I got the following output:
Switch#sh dot1x int f0/48 de
Dot1x Info for FastEthernet0/48
PAE = AUTHENTICATOR
PortControl = AUTO
ControlDirection = Both
HostMode = MULTI_DOMAIN
Violation Mode = PROTECT
ReAuthentication = Disabled
QuietPeriod = 60
ServerTimeout = 30
SuppTimeout = 30
ReAuthPeriod = 3600 (Locally configured)
ReAuthMax = 2
MaxReq = 2
TxPeriod = 30
RateLimitPeriod = 0
Mac-Auth-Bypass = Enabled
Inactivity Timeout = None
Guest-Vlan = 999
Dot1x Authenticator Client List
Domain = UNKNOWN
Supplicant = 0040.5a17.c630
Auth SM State = AUTHENTICATING
Auth BEND SM State = REQUEST
Port Status = UNAUTHORIZED
Authentication Method = Dot1x
Domain = UNKNOWN
Port Status = UNAUTHORIZED
My switch config is as follows:
aaa new-model
aaa authentication dot1x default group radius
dot1x system-auth-control
radius-server host 1.1.1.1 auth-port 1645 acct-port 1646 key cisco123
radius-server source-ports 1645-1646
radius-server vsa send authentication
interface FastEthernet0/48
description *** 802.1x Test Port ***
switchport access vlan 70
switchport mode access
switchport voice vlan 71
no snmp trap link-status
dot1x mac-auth-bypass
dot1x pae authenticator
dot1x port-control auto
dot1x host-mode multi-domain
dot1x violation-mode protect
dot1x guest-vlan 999
spanning-tree portfast
In the ACS' Failed Attempts logs, I saw entries for:
User-Name = 00405a17c630
Group-Name = IP_Phone_Test_Group
Caller-ID = 00-40-5A-17-C6-30
Authen-Failure-Code = Internal error
ACS version is 4.1.
what am I missing? Please advise.
Thank you.
B.Rgds,
Lim TS

Similar Messages

MAB/802.1x and Alkatel IP Phones

Hi All
We have a distributed deployment where Alkatel ip-touch phones are authentictaed via MAB. Alkatel ip touch phones has 802.1x enabled by default and the phone tries eapol first and then switch authenticates via MAB which is fine. Once authenticated its working as expected. The issue is the phone keeps on periodic retry after x amount of minutes for 802.1x again which triggers the phone to reboot again and goes via the whole process. This interupts the voice. We could disable 802.1x but its per phone basis. Has anyone came across this issue and found a way to diable globally via the call manager etcc. or any workarounf from ISE/switch side?
Thanks
G

Hi Tarik,
Thanks for the reply, please find below the switch port config lines, its a 370x switch, IPbase and universalon 15.2-1.E1 image
Note- Since the 8021x is enabled by default the phone initially tries 802.1x and after failing , the switch goes to the next auth method which is MAB which is successful. The issue is the phone again initiales a 802.1x packet after some time and the whole process starts again and because 8021x is failed the phone reboots again. I think this is the way this type of phone work and we cannot do much unless disable 802.1x or install the Alkatel CA certs in the ISE cert store?
Interface gi x/y
switchport access vlan xx
switchport mode access
switchport voice vlan yy
ip access-group ACL_ALLOW in
authentication event fail action next-method
authentication event server dead action reinitialize vlan xx
authentication event server dead action authorize voice
authentication host-mode multi-auth
authentication open
authentication order mab dot1x
authentication priority dot1x mab
authentication port-control auto
authentication timer reauthenticate server
authentication violation restrict
mab
snmp trap mac-notification change added
snmp trap mac-notification change removed
dot1x pae authenticator
dot1x timeout tx-period 10
spanning-tree portfast

802.1x trouble: Can't get Nortel IP Phone to authenticate to NPS server through HP ProCurve switch

I've been working on getting 802.1x set up. I've so far gotten WinXP clients to authenticate through our HP ProCurve switch to the NPS server using PEAP/EAP-MSCHAPv2, and to put different authorized users on different VLANs based on AD Groups, as well
as unauthorized users onto a separate VLAN. Also, the switch is using the NPS server for securing management logons.
However, when I configure and plug in a Nortel phone, I can see the EAP packets going to the switch, which then send the Access-Request message to the NPS server. On the NPS server, I can see that the NIC receives the Access-Request packet, but it
never responds to it. When I compare the packet to an Access-Request packet from a WinXP client, the only differences I can see are User-Name (1), Port (5), Port-ID (87), Calling-Station-ID (31) and the EAP-Message (79), which to me are the fields that
*should* be different. I can also see that the packet is coming in on the correct port (1812). Nothing gets logged in Event Viewer, nor in the NPS log (c:\windows\system32\logfiles\inDDMMYY.log).
It's my understanding that at least, I should be getting an IAS_NO_POLICY_MATCH in the log, as I haven't set up a policy for it yet. Also, if I set up a dummy policy to accept all requests on all days and times, using any authentication method, I still
get nothing.
The phone is set to use PEAP, but if I understand correctly, even if that was set wrong, I should at least see an Access-Challenge response packet from the server; PEAP doesn't factor in quite that early. Or do I misunderstand?
Any help would be appreciated.

Thanks for the reply.
> At the command prompt, type the following command, and then press ENTER:
> auditpol /set /subcategory:"Network Policy Server" /success:enable /failure:enable
I had read about that previously. I had checked whether it was enabled or not, and it only had failure enabled. So following the recomendation on that
page, I disabled both, then enabled both. So yes, it's currently enabled. And after this, I tried both the PC and phone again, and while I saw the PC's authentication succeed in the Event Log, I still see nothing for the phone.
> PEAP does not specify an authentication method, but provides additional security for other EAP authentication protocols, such as Extensible
Authentication Protocol-Microsoft Challenge Handshake Authentication Protocol version 2 (EAP-MS-CHAP v2), that can operate through the TLS encrypted channel provided by PEAP.
Yeah, but
if I understand correctly (and I'm going to read your link right after I post this), after the switch sends the initial Access-Request message in the clear, the RADIUS server should then respond with an Access-Challenge to begin securing the connection beween
itself and the phone, regardless of what the phone has set for it's security type. If the phone can't talk in a way that the server is set to accept, then it won't respond to the Access-Challenge packet, but the server should be sending that Access-Challenge
in the first place. Or is there something I've missed in the Access-Request packet that specifies what security type(s) it can handle? I thought that happened after the Access-Challenge?
> Please also provide us the type of your Nortel IP Phone, because some types of Nortel IP Phone may only support EAP-MS-CHAP v1 which is not supported by Windows
2008. We also suggest that you might post your issue on Nortel forums to ask for some more help.
I'm
using a Nortel 1120e phone for testing; we also have 1140e phones that will be used with this when it's working, but they should be the same as far as this setup is concerned. I read somewhere that perhaps the Nortel phones only support PEAP-MD5, which
doesn't seem to be an option in NPS without a reghack. I'm also following up with our Nortel support locally, as the phone itself and the manual for the phone only says "PEAP" without specifying what it's using inside, but right now I'm trying to determine
whether the problem lies with the phone or the server or both. So I thought I'd ask the experts here.
FWIW,
I've been testing using a HP ProCurve 3400cl with the lastest firmware. I've managed to get the same setup on a Cisco Catalyst 3550 switch, also on it's latest firmware, and I get the same results. The PCs can authenticate, the phone can't; NPS
still isn't responding.

802.1x and Cisco IP phones

I have 802.1x configured on a Cisco 2950 switch. On ports where I have PCs plugged into the data port on the IP phones users sometimes get placed in the guest vlan. If they shut down their attached PC and then unplug the network cable (the one between the switch and the phone), then re-plug in the cable and boot their PC it seems to authenticate them again.... sometimes. The config for the ports with phones configured is as below:
interface FastEthernet0/4
switchport access vlan 4
switchport mode access
switchport voice vlan 200
switchport port-security
switchport port-security maximum 2
no ip address
dot1x port-control auto
dot1x host-mode multi-host
dot1x guest-vlan 3
spanning-tree portfast
Does anyone have a possible fix or work around?
Thanks in advance,
Peter

You can configure the MSFT supplicant to send an EAPOL-Logoff:
Software\Microsoft\EAPOL\Parameters\General\Global\AuthMode -- REG_DWORD
0: Machine authentication mode in Windows XP Client RTM. When a user logs in, if the connection has already been authenticated with Machine credentials, the users credentials are not used for authentication.
1: Machine authentication with re-authentication functionality. Whenever a user logs in, 802.1X authentication is performed using the users-credentials.
2: Machine authentication only Whenever a user logs in, it has no effect on the connection. 802.1X authentication is performed using machine credentials only.
In the wired-Ethernet case you should set (SupplicantMode = 3) AND (AuthMode = 0) AND (disable Machine-Authentication OR ensure that there are no machine credentials on the client). This will ensure that when a user logs off, an EAPOL-Logoff will be sent out. So, AFAIK, this is the bad news .. you lose machine-auth.
Actually, stay tuned for the ability for our IP Phones to be able to do this on behalf of a PC very soon. What will happen is when an IP Phone senses EAPOL through it, it will know who the supplicant is, and what port they're on (the phone's PC port). Assuming 2 conditions above, if link to phone's PC port goes down, IP Phone will transmit EAPOL-Logoff to PC immediately (on PCs behalf).
Hope this helps.

Cisco Systems vs "CSIRO" 802.11a and 802.11g infringed upon the '069 patent

Hi,
any news about Cisco Systems and the "CSIRO" 802.11a and 802.11g infringed upon the '069 patent ?
http://www.buffalotech.com/products/wireless/
Dear Customer
As you may be aware, Commonwealth Scientific and Industrial Research Organisation ("CSIRO") sued Buffalo, Inc. and Buffalo Technology (USA), Inc. ("Buffalo"), for alleged infringement of United States Patent No. 5,487,069 ("the '069 patent"). Subsequently, CSIRO also asserted its patent against the entire wireless LAN industry, including, Microsoft, Intel, Accton, SMC and Netgear.
In it's lawsuit against Buffalo, CSIRO claimed certain Buffalo wireless networking products compliant with IEEE standards 802.11a and 802.11g infringed upon the '069 patent. Buffalo believed at that time and continues to believe that there are no grounds for CSIRO's allegations of infringement. The United States district court, however, found Buffalo to infringe the '069 patent and enjoined the importation and sale of Buffalo's IEEE 802.11a and 802.11g compliant products.
CSIRO's lawsuits are against the entire wireless LAN industry and could affect the supply of wireless LAN products by any manufacturer, not just Buffalo. The entire industry is resisting CSIRO's attempts to enjoin the sale of wireless LAN products. Recently, Microsoft, 3COM Corporation, SMC Networks, Accton Technology Corporation, Intel, Atheros Communications, Belkin International, Dell, Hewlett-Packard, Nortel Networks, Nvidia Corporation, Oracle Corporation, SAP AG, Yahoo, Nokia, and the Consumer Electronics Association filed briefs in support of Buffalo's position that injunctive relief is inappropriate in this case.
During the period of time that the injunction is in effect (10/1/2007), Buffalo cannot offer for sale, sell, import, or use its IEEE 802.11a and 802.11g compliant products in the United States. A list of the products covered by the injunction is attached here . The injunction does not prohibit sales of pre-existing inventories of products by Buffalo's customers. In addition, Buffalo has secured CSIRO's agreement to permit the replacement of defective products under warranty. None of Buffalo's other products are currently affected by this injunction.
While Buffalo believes that it will be successful in reversing the district court's decision and will obtain a stay of the injunction pending a decision on the merits, the Court of Appeals has not yet issued a decision. Should the Court of Appeals issue a decision staying the injunction, you will be promptly notified. After the stay is issued or a favorable decision on the merits is obtained, Buffalo will be able to resume the supply of IEEE 802.11a and 802.11g products
Please rest assured that Buffalo continues to stand behind their products and will continue to support all of our loyal customers as it relates to product warranties, technical support and the like without interruption.

I suspect after reading the patent and the litigation that you mentioned above, that the US District Court decision will be reversed as the patent appears to be very vague in its contsruction and verbage. Furthermore, the intent to hold the IEEE hostage on the ratification of 802.11n will not bode well in the court's eyes. If in fact the case is reversed, I believe that the members of CSIRO will be in danger of lost profits litigation from Buffalo. Stay tuned to this bat channel.

Macintosh OSX, 802.1x and PEAP

I'm preparing to implement 802.1x port authentication for both wired and wireless connections. The authentication server is Windows 2003 IAS. In the test environment, Windows XP clients can connect fine, but I'm not sure how to configure this for Mac OSX workstations (10.4.6). Has anyone successfully done this? If so could you please explain the proceedure, or direct me to documentation that explains the process?

Assuming you're using NAC fraework then it's bad news, 802.1x won't work on a Mac. If you use 802.1x and L2IP in combination then wired Macs will work but wireless Macs will not. The reason is that the Cisco CTA for the Mac communicates with using EAP over UDP and this transport is not available when using 802.1x alone or over a wireless link with 802.1x or L2IP. The only way of catering for all client types at once (Windows wired and wireless, Mac wired and wireless) is L3IP.
The NAC Appliance "will" support wireless Macs in a future release but (I believe) doesn't at the moment.

Potential Security Hole with 802.1x and Voice VLANs?

I have been looking at 802.1x and Voice VLANs and I can see what I think is a bit of a security hole.
If a user has no authentication details to gain access via 802.1x - i.e. they have not been given a User ID or the PC doesn't have a certificate etc. If they attach a PC to a switchport that is configured with a Voice VLAN (or disconnect an IP Phone and plug the PC direct into the switchport) they can easily see via packet sniffing the CDP packets that will contain the Voice VLAN ID. They can then easily create a Tagged Virtual NIC (via the NIC utilities or driver etc) with the Voice VLAN 802.1q Tag. Assuming DHCP is enabled for the Voice VLAN they will get assigned an IP address and have access to the IP network. I appreciate the VLAN can be locked down at the Layer-3 level with ACL's so any 'non-voice related' traffic is blocked but in this scenario the user has sucessfully bypassed 802.1x authentication and gain access to the network?
Has anyone done any research into this potential security hole?
Thanks
Andy

Thanks for the reply. To be honest we would normally deploy some or all of the measures you list but these don't around the issue of being able to easily bypass having to authenticate via 802.1x.
As I said I think this is a hole but don't see any solutions at the moment except 802.1x on the IP Phone, although at the moment you can't do this with Voice VLANs?
Andy

MAB, 802.1x and ACS 4.2

Hi all,
Currently i'm using an ACS4.2 as radius server, some switch 2960-s ios 12.2.(55)se5, ipphone Alcatel iptouch 4018 and i would like to assign dinamic vlan to some specific users/laptop Daisy-chained to ip phone.
Logic connection is: users laptop---->ipphone---->switch---->radius
What i need is:
if I connect MY laptop to the ipphone port, i receive a specific vlan ( vlan 58 )
if SOMEONE else ( i.e. a consultant ) connect his laptop to the SAME ipphone port (if available) he has to receive a different vlan ( vlan 1).
I've been able to reach the goal using MACRO but it tooks too much time to authenticate ( approx 1 min ) so i give up and tried a different faster way ( 802.1x and MAB ).
i've been able to authenticate the ip-phone using 802.1x auth and to receive the correct vlan when i connect MY laptop (MAB auth) but i was not able to provide the VLAN 1 to the Consultant when he connect his laptop even if the "authentication event fail action authorize vlan 1" is configured.
I used the dot1x auth-fail vlan because i'm not able to use MAB or 802.1x auth on external laptop. I also tried with guest vlan with no luck.
In both case the "consultant" remain in "auth failed"
Here my current configuration
dot1x system-auth-control
dot1x guest-vlan supplicant
identity profile default
interface GigabitEthernet1/0/1
switchport mode access
switchport voice vlan 30
authentication host-mode multi-auth
authentication event fail action authorize vlan 1
authentication order mab dot1x
authentication port-control auto
mab
dot1x pae authenticator
dot1x timeout tx-period 2
dot1x max-reauth-req 1
storm-control broadcast level 2.00
storm-control multicast level 2.00
spanning-tree portfast
On ACS side i have 2 groups
first Group authenticate the iphone and supply the voice vlan ( vlan 30)
Second Group authenticate using MAB and supply the vlan 58
is there a different way to accomplish this task?
Thank you in advance

hi,
any ideas?
thx

802.1x and IP Phone

Is it possible to enable dot1x and voice on the same interface? If so which switches and IOS support this feature ?
Any references to documents ?
Commands that cannot be configured together :-
switch voice vlan xxx
dot1x port-control auto

It is possible to enable 802.1X and voice on the same port. If the phone does CDP, it is allowed through, regardless of the 802.1X state of the port with this config. Here's the following switches that support this, with the minimum required releases:
CatOS (6500) - 7.6(1)
IOS (4500) - 12.1(20)EWA
IOS (3750) - 12.2(25)SEA
IOS (3560) - 12.2(25)SEA
IOS (3550) - 12.1(12c)EA1
IOS (2960) - 12.2(25)FX
IOS (2950) - 12.1(12c)EA1
IOS (2940) - 12.1(13)AY
Hope this helps,

802.1X and CAT Express 500

Hi guys,
I want to know if the Cat Express 500 support dynamic vlan assigment through 802.1X.

Hi,
You can do the vlan arrisgnment using 802.1x on CE500. The configuration for 802.1X and Radius authentication server can be done with the help of Cisco Network Assistant (CNA). In the menu Network Security Settings you have to put the
security level on high. There is the possibility to configure the IP address of the RADIUS server and the RADIUS key.
In case you don?t have the CNA, you can download it for free from:
http://www.cisco.com/cgi-bin/tablebuild.pl/NetworkAssistant
HTH, Please rate if it does.
-amit singh

802.1x and Voice VLAN

I had read articles on cco, and I believed for the same switch port we can have 802.1x configure and the voice vlan configure. It mean the IP phone is connect to the switch port with 802.1x configured, but the phone will not autheticate, only the workstation connect to phone data port will get authenticate.
I had configured 802.1x and test with notebook logon and able to access the network. Now I would like to test the notebook attached to IP phone data port, and the phone connect to switch port configure with 802.1x. But I failed to add voice vlan commmand. Why ?
interface GigabitEthernet9/48
description temporary port
switchport
switchport access vlan 12
switchport mode access
no ip address
dot1x port-control auto
spanning-tree portfast
CIG01-ENT-SW1(config-if)#switchport voice vlan 14
Command rejected: Gi9/48 is Dot1x enabled port.

Using IEEE 802.1x Authentication with Voice VLAN Ports
A voice VLAN port is a special access port associated with two VLAN identifiers:
?VVID to carry voice traffic to and from the IP phone. The VVID is used to configure the IP phone connected to the port.
?PVID to carry the data traffic to and from the workstation connected to the switch through the IP phone. The PVID is the native VLAN of the port.
In single-host mode, only the IP phone is allowed on the voice VLAN. In multiple-hosts mode, additional clients can send traffic on the voice VLAN after a supplicant is authenticated on the PVID. When multiple-hosts mode is enabled, the supplicant authentication affects both the PVID and the VVID.
A voice VLAN port becomes active when there is a link, and the device MAC address appears after the first CDP message from the IP phone. Cisco IP phones do not relay CDP messages from other devices. As a result, if several Cisco IP phones are connected in series, the switch recognizes only the one directly connected to it. When IEEE 802.1x authentication is enabled on a voice VLAN port, the switch drops packets from unrecognized Cisco IP phones more than one hop away.
When IEEE 802.1x authentication is enabled on a port, you cannot configure a port VLAN that is equal to a voice VLAN.
Waht kind of switch do you have? In 3550 I can configure the port for both vvid and pvid:
interface FastEthernet0/1
switchport access vlan 3
switchport mode access
switchport voice vlan 2
no ip address
dot1x port-control auto
spanning-tree portfast
end
Nevertheless, as the statement above indicates, the port will need to be configured for multi-host in order the PC behind the phone get autehntication:
under the interface configure "dot1x host-mode multi-host"
Nevermind, I just realized that you might have a 5600 running native, checking the configuration guide and realese notes it does not looks like dot1x and vvlan can play together in that platform.

Compatibility 802.1X and mac-filter from ACS

If the clients identities and mac address are stored in the same ACS server.
In WLC,could a wlan be configured layer2 security with both 802.1x and mac-filtering?
this is really a critical problem for me!
Thanks~

Hi,
I am assuming you are asking if you configure a x mac of wlan client in MAC filer and the same as user naem in 802.1x ACS database as user name , could you configure it ? what is the effect?
If my understading of your queston is correct the answer is
Any wlan client will not be allowed to associate to the network unless a match is seen in mac filter in wlc.
But once that is done it will not able to access network resources unless 802.1x authentication is completed by ACS against the wlan clients user name which is again a mac address of client.
i dont see a value for doing this. except that you will block unnecessary authentication request getting to ACS by filtering it in the 1st instance.
another scenario is if you are using mac filtering also on ACS , it should be preceeded by mac filtering and then ACS authentication , as above as far as ssequence goes hence the same logic applies here.
Thanks

IEEE 802.3u and IEEE 802.3z Compatibility

Hello everyone!
Does anyone know if these 2 fiber optic SFPs are compatible with each other?
We have and old HP J4853A transceiver which is 802.3u and Cisco SFP LX Module which is 802.3z
Thank you!

Hello
For your reference, when talking about fiber transceiver you want to check the following details:
- There exists two modes: Single mode, and multi-mode, you want to make sure both use the same mode.
- Wavelenght, there are 850nm, 950nm, 1310nm.... You need to make sure it matches.
- No all switches/routers support all types of modules, so check the following compatibility matrix to make sure hardware and tranceiver are compatible.
http://www.cisco.com/en/US/docs/interfaces_modules/transceiver_modules/compatibility/matrix/OL_6981.html
Regards.
Wilson B.

Using 802.1x and vpn on t-mobile hotspot

hi all,
how do i configure 802.1x and vpn to enhance security on t-mobile hotspot?
thanx for your help.

Multi-Host is not the right option for you. In this Multi-Host only one device has to successfully authenticate to authenticate all device on that port.
You need to set host-mode to "multi-auth"

802.1x and the iPhone

So I don't think this is possible right now to connect to an 802.1x network from the iPhone. I am posting for 2 reasons.
1. Anybody figure out a way to do this?
or if not...
2. Apple, we really need this in a software update...

802.1X [upper case X] is a network access mechanism or authentication protocol used with 802.11x [lower case x] wireless networking standards, such as…
• 802.11a
• 802.11b
• 802.11g
• 802.11n
…and so on. It has been natively supportive in Mac OS X for Macintosh desktop and portable platforms since the release of OS X 10.3, but is not visible typically unless you launch the Internet Connect application to add and configure it.
A general discussion of 802.1X can be found in this Wikipedia article.
The oft confused 802.11x is nothing more than a generic representation of the group of wireless networking standards listed above.
This really is a very substantial issue for many academic and business users, as access to their networks is typically controlled by an upstream Radius server and without support for configuring an 802.1X interface, they cannot connect their networks as recognized, authorized users.

802.1x and MS IAS and Nortel IP phone

Similar Messages

Maybe you are looking for