3560G and 802.1X with Cisco IP Phone

Question

Hi,
We have been doing some test on our 3560G switch with 802.1X. The switch port has a Cisco IP Phone 7940 connected and at the back of the IP Phone is the PC (802.1X client).
The PC authenticates with the computer name or the username properly without any problems. However problem is that the port stays opened/authorized even after disconnecting the Laptop from the phone. Only disconnecting the phone from the switch disables the port and enforces authentication.
This totally defeats the purpose for us.
IOS: 12.2(20)SE3
aaa new-model
aaa authentication dot1x default group radius
aaa authorization network default group radius
dot1x system-auth-control
interface GigabitEthernet0/40
switchport access vlan 4
switchport mode access
switchport voice vlan 15
dot1x port-control auto
dot1x timeout quiet-period 15
dot1x timeout reauth-period 30
dot1x max-req 1
dot1x reauthentication
spanning-tree portfast
spanning-tree link-type point-to-point
Any ideas will be appreciated.
Thanks,
Cheers
Kartik

Answer 1

I believe the problem should be solved with the new phone firmware:
Ref Cisco Document:
http://www.cisco.com/en/US/products/hw/phones/ps379/prod_release_note09186a0080461f84.html
"Firmware release 7.2(2) provides support for the Cisco IP Phone models 7960G and 7940G to monitor IEEE 802.1X messages between an authenticating switch and a connected PC (supplicant).
When a PC is disconnected from the Cisco IP Phone, the phone issues an EAPOL-Logoff message on behalf of the PC to the authenticating switch.
Hope This Helps
Jarle Steffensen