802.1x / Avaya IP phone

Would like to know this kind of setup it is possible. Avaya IP phone connect to Catalyst 4500 switch and the switch port is configure with 802.1x authentication , the PC is attached to Avaya IP phone. Does it cause IP phone force to authenticate ?
Regards

If they are Cisco IP Phones (or IP Phones that support Voice VLAN discovery via CDP - I know the Mitel ones do) or you manually hard-code the Voice VLAN Tag on the IP Phone.
If the Avaya IP Phones discover the Voice VLAN Tag by DHCP Vendor Options obtained initially from leasing an IP address in the Access VLAN then you might struggle.
It may be possible to use the 802.1x Guest VLAN function and secure the Guest VLAN so you can only access DHCP (and possibly a boot server to obtain configuration information).
HTH
Andy

Similar Messages

L2 Roaming issue with Avaya wireless phone on WISM -V6.0.196.0

Hello Friends,
I am facing Layer2 roaming issue with Avaya Wirless phone 3620 which are configured WPA / Pre-shared key auth with a SSID1 and face a cut or delay in the voice.
But when i use Cisco Wireless phones and try to roam between one LWAP to other i dont face a cut or delay in the vocie which are
Configured with 802.1x +CCKM auth .
Then i configured new SSID 3 with 802.1x+CCKM settings for the new Avaya wireless module 3631 , but still face cut and delay while doing Layer 2 roaming.
While i was using these AP in WDS mode i never faced this Layer 2 roaming issue with Avaya wireless phones.
In current WISM all the LWAPs are supporting properly to the Cisco phone and Wirelss laptop clients.
I request you to please let me know how do i proceed further to solve the issue and please let me know if anybugs or incompatibilty for WISM with Avaya wireless phones.
Appreciate your response.
Regards,
KA.

Hello ,
Can any body please respond to my above Query.
Thanks,
KA.

Site to Site VPN between Cisco ASA 5520 and Avaya VPN Phone

Hi,
I am wondering if anyone can assist me on configuring Cisco ASA 5520 site to site vpn with Avaya VPN Phone? According to Avaya, the Avaya 9630 phone acts as a VPN client so a VPN router or firewall is not needed.
The scanario:
Avaya System ------ ASA 5520 ------ INTERNET ----- Avaya 9630 VPN Phone
Any help or advice is much appreciated.
Thanks.

Hello Bernard,
What you are looking for is a Remote Ipsec VPN mode not a L2L.
Here is the link you should use to make this happen:)
https://devconnect.avaya.com/public/download/interop/vpnphon_asa.pdf
Regards,
Julio

AVAYA IP Phones unable to get an IP address from DHCP server.

I installed new SRW208P switch and I mada an uplink connection with SRW 2024 switch (using GE port).
when I am trying to connect AVAYA IP Phone to the SRW208P port, the set trying to get an IP address from the DHCP server and failed to get it.
some times after 10 minutes, it get the IP address, but all the machines (PCs) connected to the same switch (SRW208P) hange.
Note: the PCs an IP Phones are connected with separate UTP cables to the access switch.
Is there any suggestions to solve this issue, please.
Regards,

The issue is that your machine is not being assigned an IP address / was unable to reach the DHCP server to receive one. The 169.254.x.x IP your machine is showing isn't assigned from DHCP, it's assigned by the local machine and is referred to as an APIPA
address.
So something is preventing your machine from reaching your DHCP server, which could one of a number of things. In the first instance I'd suggest having a look at
http://epan36.blogspot.co.uk/2012/09/eventid-1001-dhcp-your-computer-was-not.html which lists several of things that could cause this error and things you can try in order to resolve it.
If none of those work, can you confirm whether you have any other machines connecting via the same method on the network, which might indicate whether this is an issue at the machine end or somewhere between the machine and DHCP server?

802.1x with alcatel phone with cisco acs 5.0

Hi All, can any one has done the implementation of 802.1x with alcatel phone where pc will be behind the phone and cisco switch ports are configured as trunk. Trunk native vlan is data vlan for pc and trunk carrying voice vlan.
when trunk mode is enabled I can not configure 802.1x on trunk interface. does any one help me to get rid of this situation..
Thanks

Hi,
Did you find any solution?. Did you tried with the command switchport voice vlan?.
Regards,
Mauricio

Avaya IP phone has an issue then downloading calendar from Exchange 2010

Hi all,
I'm having an issue, please give me an advice! When my IP phone (IP) works with Exchange 2010, it can not download calendar. I captured and saw that after client sends hello, server sends hello, server sends certificate, then client sends back bad
certificate and TCP Reset messages. I installed Exchange and AD on the same server. I also installed CA on this server to issue certificate to Exchange. I configured phone download root cert of CA and certificate of Exchange. If you require any information,
please let me know.
I don't know what mechanism that phone used to connect to Exchange to download calendar. And don't have any document configuration. If you have any experience, please share with me.
Hoang Vu,
Thanks

Hi,
You mentioned the client sent back bad certificate, please check if the certificate was configured correctly.
For this issue, I recommend you contact the Avaya IP Phone support to get better help. Thanks for your understanding.
Best regards,
Belinda
Belinda Ma
TechNet Community Support

Ipsec tunnel across Avaya 4620 phone terminating to cisco vpn concentrator

I have been asked to test out an avaya 4620 phone with the vpn remote client installed on it for our home users.
Here is my problem. The phone connects fine to my concentrator and I have a successful ipsec tunnel built, however, the phone cannot route back to the corportate network. When I look at the tunnel stats, I see bytes received and none transferred. Also, for the ip address of the remote end, I see the ip address that was assigned to it from my local dsl router. My concentrator is supposed to forward dhcp requests on to my internal dhcp server, but this is not occurring. Has anyone seen this before or know where I should start here? any input will be greatly appreciated, thank you all for your time.

Hello Andrew, I know this thread is a bit old, but I am in the process of trying to setup some 9630's to VPN into my Corp. HQ. which is behind a 5510. the problem I am having is with IKE Phase 2, I keep getting an IKE Phase 2 no Response on the phone and this is what Im getting in the ASA log.
4|Feb 18 2010|09:05:04|113019|||||Group = test, Username = user, IP = 71.161.x.x, Session disconnected. Session Type: IKE, Duration: 0h:00m:01s, Bytes xmt: 0, Bytes rcv: 0, Reason: Phase 2 Mismatch
3|Feb 18 2010|09:05:04|713902|||||Group = test, Username = user, IP = 71.161.x.x, Removing peer from correlator table failed, no match!
3|Feb 18 2010|09:05:04|713902|||||Group = test, Username = user, IP = 71.161.x.x, QM FSM error (P2 struct &0xcc259568, mess id 0x8b0aed6d)!
5|Feb 18 2010|09:05:04|713904|||||Group = test, Username = user, IP = 71.161.x.x, All IPSec SA proposals found unacceptable!
5|Feb 18 2010|09:05:04|713119|||||Group = test, Username = user, IP = 71.161.x.x, PHASE 1 COMPLETED
6|Feb 18 2010|09:05:03|713228|||||Group = test, Username = user, IP = 71.161.x.x, Assigned private IP address 5.5.5.1 to remote user
6|Feb 18 2010|09:05:03|713184|||||Group = test, Username = user, IP = 71.161.x.x, Client Type:   Client Application Version:
5|Feb 18 2010|09:05:03|713130|||||Group = test, Username = user, IP = 71.161.x.x, Received unsupported transaction mode attribute: 6
5|Feb 18 2010|09:05:03|713130|||||Group = test, Username = user, IP = 71.161x.x, Received unsupported transaction mode attribute: 5
6|Feb 18 2010|09:05:03|734001|||||DAP: User user, Addr 71.161.x.x, Connection IPSec: The following DAP records were selected for this connection: DfltAccessPolicy
and this is what I get when I debug cyrpto isakmp
RESERVED != 0, PACKET MAY BE CORRUPTFeb 18 11:51:10 [IKEv1]: Group = test, Username = user, IP = 71.161.x.x, QM FSM error (P2 struct &0xcc4d4748, mess id 0x519ff252)!
Feb 18 11:51:10 [IKEv1 DEBUG]: Group = test, Username = user, IP = 71.161.212.49, IKE QM Responder FSM error history (struct &0xcc4d4748) , : QM_DONE, EV_ERROR-->QM_BLD_MSG2, EV_NEGO_SA-->QM_BLD_MSG2, EV_IS_REKEY-->QM_BLD_MSG2, EV_CONFIRM_SA-->QM_BLD_MSG2, EV_PROC_MSG-->QM_BLD_MSG2, EV_HASH_OK-->QM_BLD_MSG2, NullEvent-->QM_BLD_MSG2, EV_COMP_HASH
Feb 18 11:51:10 [IKEv1 DEBUG]: Group = test, Username = user, IP = 71.161.x.x, sending delete/delete with reason message
Feb 18 11:51:10 [IKEv1]: Group = test, Username = user, IP = 71.161.x.x, Removing peer from correlator table failed, no match!
Feb 18 11:51:10 [IKEv1 DEBUG]: Group = test, Username = user, IP = 71.161.x.x, IKE SA AM:18543029 rcv'd Terminate: state AM_ACTIVE flags 0x00418041, refcnt 1, tuncnt 0
Feb 18 11:51:10 [IKEv1 DEBUG]: Group = test, Username = user, IP = 71.161.x.x, IKE SA AM:18543029 terminating: flags 0x01418001, refcnt 0, tuncnt 0
Feb 18 11:51:10 [IKEv1 DEBUG]: Group = test, Username = user, IP = 71.161.x.x, sending delete/delete with reason message
Feb 18 11:51:10 [IKEv1 DEBUG]: Group = test, Username = user, IP = 71.161.x.x, constructing blank hash payload
Feb 18 11:51:10 [IKEv1 DEBUG]: Group = test, Username = user, IP = 71.161.x.x, constructing IKE delete payload
Feb 18 11:51:10 [IKEv1 DEBUG]: Group = test, Username = user, IP = 71.161.x.x, constructing qm hash payload
Feb 18 11:51:10 [IKEv1]: IP = 71.161.x.x, IKE_DECODE SENDING Message (msgid=2b900ae) with payloads : HDR + HASH (8) + DELETE (12) + NONE (0) total length : 80
BEFORE ENCRYPTION
ISAKMP Header
Initiator COOKIE: 68 fb e0 7a 90 5c d7 10
Responder COOKIE: 29 30 54 18 84 da aa d2
Next Payload: Hash
Version: 1.0
Exchange Type: Informational
Flags: (none)
MessageID: AE00B902
Length: 469762048
Payload Hash
    Next Payload: Delete
    Reserved: 00
    Payload Length: 24
    Data:
      08 4b dc 3d 7c 2b 1b 99 c9 6d 6d 36 14 b9 d1 27
      47 e1 0d d6
Payload Delete
    Next Payload: None
    Reserved: 00
    Payload Length: 28
    DOI: IPsec
    Protocol-ID: PROTO_ISAKMP
    Spi Size: 16
    # of SPIs: 1
    SPI (Hex dump):
      68 fb e0 7a 90 5c d7 10 29 30 54 18 84 da aa d2
ISAKMP Header
Initiator COOKIE: 68 fb e0 7a 90 5c d7 10
Responder COOKIE: 29 30 54 18 84 da aa d2
Next Payload: Hash
Version: 1.0
Exchange Type: Informational
Flags: (Encryption)
MessageID: 02B900AE
Length: 84
RESERVED != 0, PACKET MAY BE CORRUPTFeb 18 11:51:10 [IKEv1]: Ignoring msg to mark SA with dsID 1380352 dead because SA deleted
if you could provide any help it would be greatly appreciated as I have been battling this for a few days now.
thanks,
Paul

802.1X with IP Phone is posible with Nortel??

Hello,
My Scenary is that I have configured 802.1X in Cisco Swithches C3750/C3560/C2960, I configured 802.1x in the all Switches, but i have 100 IP Phone Nortel with 2 ports one port connected to Switch and the other port connected to PC. I know that IP Phone Cisco work in the enviroment 802.1X, this feature i can configurate enable Radius (Cisco IOS/PIX 6.0) and in the group i have setup in the tab "[009\001] cisco-av-pairbut" put "device-traffic-class=voice" and in the tab IP Assignment i put "Assigned from AAA Client pool" in the case of Nortel how i do? is similar?? i have to setup in the "[009\001] cisco-av-pairbut" the same way??? and i've seen a configuration with cisco in the link:
http://www.cisco.com/en/US/tech/tk389/tk814/technologies_configuration_example09186a00808abf2d.shtml#MDA
and the other configuration with Avaya and Radius non cisco.
Please help me with this issue.
Best Regards
Alvaro

From the backend perspective, you can treat Nortel and cisco phones identically in this regard.
The doc reference from before should work for any type of phone.
Hope this helps,

802.1x and IP Phone

Is it possible to enable dot1x and voice on the same interface? If so which switches and IOS support this feature ?
Any references to documents ?
Commands that cannot be configured together :-
switch voice vlan xxx
dot1x port-control auto

It is possible to enable 802.1X and voice on the same port. If the phone does CDP, it is allowed through, regardless of the 802.1X state of the port with this config. Here's the following switches that support this, with the minimum required releases:
CatOS (6500) - 7.6(1)
IOS (4500) - 12.1(20)EWA
IOS (3750) - 12.2(25)SEA
IOS (3560) - 12.2(25)SEA
IOS (3550) - 12.1(12c)EA1
IOS (2960) - 12.2(25)FX
IOS (2950) - 12.1(12c)EA1
IOS (2940) - 12.1(13)AY
Hope this helps,

Setup DHCP on OES2 Linux for Avaya 5610 phones

I'm trying to setup DHCP on a OES2 Linux server and can't seem to get the phones working. PC on the network will get addresses but the phones will freeze/lock up on DHCP.
My network is as follows:
10.10.1.x(vlan=101) = data
10.10.2.x(vlan=102) = voice
10.1.10.x = servers
Novell servers running on SLES 10 SP2 x64 with OES2 SP 3 x64
I've created a dhcp service (dhcpsrvs) and 2 subnets (10.10.1.0 and 10.10.2.0) and a pool in each subnet (datapool and voicepool). In the global options I created a string option called SSON176. In the options for subnet 10.10.1.0 I've added option 176 with params L2Q=1,L2QVLAN=102. In the options for subnet 10.10.2.0 I've added 176 with params L2Q=1,L2QVLAN=102,MCIPADD=10.10.2.1,MCPORT=1719.
I've been able to get it working on a Win2k3 server but that server was a temporary quick fix. I need to bring that server down soon and would like to get it working on my Novell server.
Can someone help me figure out what I've done wrong or left out?
dlb

danielb,
It appears that in the past few days you have not received a response to your
posting. That concerns us, and has triggered this automated reply.
Has your problem been resolved? If not, you might try one of the following options:
- Visit http://support.novell.com and search the knowledgebase and/or check all
the other self support options and support programs available.
- You could also try posting your message again. Make sure it is posted in the
correct newsgroup. (http://forums.novell.com)
Be sure to read the forum FAQ about what to expect in the way of responses:
http://forums.novell.com/faq.php
If this is a reply to a duplicate posting, please ignore and accept our apologies
and rest assured we will issue a stern reprimand to our posting bot.
Good luck!
Your Novell Product Support Forums Team
http://forums.novell.com/

Wireless VoIP roaming - getting an 802.11g phone to roam with CCX / CCKM

Hello,
Our group is facing a pretty difficult issue at the moment, we are trying to deploy a wireless Avaya VoIP phone at one of our sites in Australia.
The site in question is located in Western Australia, which is on the other side of the continent to where our 5508 WLC is (in Sydney), so there is a latency of abouy 60-80ms between the sites. When testing the phone at the Sydney location, we're able to authenticate the phone via a number of methods (802.11x, 802.11x FT) and the phone can roam fine. When testing at the WA location, the 802.11x authentication method drops the call when roaming, and the 802.11x FT authentication method has about 2 seconds of dead air during roaming / reassociation.
The avaya phone supports a few different methods of "fast handoff" - CCKM and OKC - and we've only got the OKC (802.11 version of fast transition) method to work, not CCKM. The phone reports error messages when trying to connect to the network with CCKM enabled - specifically "No CCKM AP's" and "No CCX AP's".
So I have some questions...
1) Is a 60ms latency between sites a dealbreaker for wireless voice usually?
2) The voice engineer is convinced that CCX is disabled on the WLAN. My understanding of CCX (according to online Cisco docco) is that it can't be switched off. Is this the case? I know CCKM can be disabled (in the Layer 2 Authentication options) but can CCX or CCKM be enabled / disabled anywhere else?
3) The voice engineer has a point on one front - if we do a command "show ap ccx rm [APName] status", the command outputs "Beacon Request ..... Disabled." This seems to be related to CCX Location awareness - but even after switching this on in the WLC (both globally and for the WLAN), I cannot get this to enable.
3) We have had some minimal success getting the phone to connect with only CCKM Authentication enabled. The phone could not roam. When we did this, I looked at the Client information in the WLC of this device and the CCX Version read "Not Supported." Does this perhaps mean some kind of CCX compatibility problem?
4) Is there much of a difference between OKC (Fast Transition) and CCKM in terms of roaming time? I.e. are we better off trying to install a WLC at the location rather than getting this work remotely.
We're a bit lost on this. Anyone that's had experience in getting Wireless VoIP phones to roam on a wireless campus before, particularly where the WLC is remote, I'd love to hear from you.
Thanks,
Dave

Hi, thanks Steve. Aironet IE is enabled.
The encryption is news to me. We intially tried WPA2/AES & WPA/TKIP together but had no success at all. We then moved to WPA/TKIP, and we were able to get the phone to connect to the WLAN using the CCKM settings, but it doesn't roam at all & the WLC reported the Clients CCX version was "Not Supported".
I think the phone has CCX version 4. Are you certain that the phone will only support WPA & WPA2 with CCX v5? Just that this sounds a little strange, the phone's documentation claims to support CCKM, but if you're right then there's no way we can secure our phone conversations? In previous testing, we did actually temporarily drop all authentication / encryption and the roaming worked perfectly.
Thanks for your help...

Catalyst Express 500 802.1q with non-Cisco Phones

This weekend we spent hours trying to get 802.1q tagging to work on a VLAN with ShoreTel phones. The user interface on this switch seems to only allow "Cisco-Voice" VLAN, without any specifics. This didn't work. The specs on this switch say that the .1q is supported, but we couldn't figure it out. The more expensive switches were easier to configure for Voip QoS.
Can anyone advise me on the tricks to getting this to work with the lower end Catalyst Express 500? Or does this switch only support 802.1q with Cisco phones?

Cisco IP Phone uses CDP to let the ip phone know what vlan it's suppose to be (via voice-vlan). shore tel would definitely not use CDP since CDP is cisco proprietory, so it's voice vlan must be defined on it, I rememer Avaya being the same way. So, having said that, just make sure that the Shore tel Ip phone are in the right vlan. what does not work anyway? shore Tel IP Phone will not come up? Will not get it's configuration from it's software PBX? Use the smartport configuration on CE500.
Please rate all posts.

802.1x problem with non-Cisco IP Phone, VVID enabled.

I am testing with a 3750 PoE switch running 12.2(25)SEE1 and trying to configure 802.1x to work with Mitel IP phones.
I have voice and data vlans configured on each port. Turning on 802.1x causes the phone to hang and timeout in DHCP Discovery. The port status from the switch is "Unauthorized".
interface FastEthernet1/0/2
switchport access vlan 1
switchport mode access
switchport voice vlan 2
dot1x pae authenticator
dot1x port-control auto
no mdix auto
spanning-tree portfast
end
Should anything be configured besides the Voice VLAN to let phones onto the network? There is no computer behind the phone right now. The only information I can find says I need a VVID, and any clients behind it will cross the PVID.
Thanks.

Yes it does.
Apparently the Mitel phones (testing a 5215 dual-mode) we have support EAP-MD5, but we have a primarily PEAP/EAP-TTLS environment. Apparently the phones need to use a username/password entered on each phone before they will send that to a Radius server doing EAP-MD5. Our PEAP clients authenticate to a Microsoft Radius server, and our EAP-TTLS to a Funk box. Hopefully the Microsoft can support both EAP-MD5 phones and PEAP on the laptops, I'll have to find out.
I was hoping this was a quick and easy Cisco configuration error... oh well.

Cisco IP Phone 802.1x authentication with NPS

Hi All,
I would like to configure 802.1x authentication on both my Cisco ip phones and windows clients using NPS. So far i have tested the clients and it works however I am not finding any information on if NPS supports 802.1x on ip phones. Has anyone done a similar
deployment using NPS. So far I am only seeing cisco ACS server being used as the policy server.

Hi,
Based on my research, it seems that you may enounter issues related to username(Basically Mircosoft only allows a 20 character user name, while the user name of the phone exceeds the 20 character limit and causes it to fail.) and certificate schema when
configuring 802.1x authentication for Cisco IP phones.
Best regards,
Susie
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact [email protected]

MAB and 802.1x issues with IP-phone

I'm trying to use 802.1x to authenticate clients on my network with dynamic VLAN assignment from RADIUS. We have IP-Phones(powered by PoE) that only supports EAP-MD5, and we would rather use MAB(it also uses LLDP-MED for some settings) to authenticate the phones using the MAC-range from the phones vendor. The following scenario works perfect:
Connect the phone and let it boot up(takes a while) and authenticate with MAB.
Connect a computer in the phones data-port and let it authenticate with 802.1x(or fail and reach guest-vlan)
However, the following scenario doesn't work:
The computer is already connected to the phone
The phone is then connected to the switch
What happends now is that the computer is authenticated using 802.1x before the phone boots up and get's authenticated with MAB. When the phone is ready, it's authenticated with MAB and everything works. However, after a short period(let's say a minute), using `debug authentication all`, we see a "NEW LL MAC: phones mac" message(which is weird since the mac has already been MAB-authenticated), and then we are unable to contact the phone using ping. When I check `show mac address-table` it has now moved the mac from `Port Gi 0/12` to `Port Drop`. However, if I check `show mab interface Gi 0/12` or `show authentication sessions` it lists the phones-mac as `mab auth sucess `.
Can anyone explain why the first scenario works, and not the second?
The switch is a 3560E PoE 24p with IOS 12.2.58SE2. Sample of the switch-config:
network-policy profile 1
voice vlan 90
interface GigabitEthernet0/12
switchport mode access
network-policy 1
authentication control-direction in
authentication event fail retry 1 action authorize vlan 60
authentication event server dead action authorize vlan 60
authentication event no-response action authorize vlan 60
authentication event server alive action reinitialize
authentication host-mode multi-domain
authentication order mab dot1x
authentication priority mab dot1x
authentication port-control auto
authentication periodic
authentication violation replace
mab
dot1x pae authenticator
dot1x timeout tx-period 5
dot1x max-reauth-req 1
spanning-tree portfast
Btw, when we tried authenticating the phones using 802.1x too (EAP-MD5), there are NO problems in any of the scenarios. However, we want to use MAB instead of 802.1x to avoid the requirement of configuring the phones with a username and password. The RADIUS response was the same when using 802.1x as it is with MAB for the phones (including device-traffic-class=voice AV-pair).

Hey. Yes, as specified in the last sentence in my post, the phone is placed in the Voice Domain, and both RADIUS and LLDP-MED (network policy profile 1) specifies voice vlan as 90.
The weird thing is that everything works fine if both use 802.1x, and that there is only a problem when phone(using MAB) already has the computer connected to it, when the phone is turned on(connected to PoE-switch). It must be because the computer boots up and authenticates first I think.
The phones are Snom 821.

802.1x / Avaya IP phone

Similar Messages

Maybe you are looking for