802.1x, voice vlan and IP phone

Hi, I reviewed many posts here, and I still need the clarification how 802.1x on the switch works with non-Cisco IP phone (not supporting CDP) and PC connected to the PC port. If I configure 802.1x on a switch port, along with access and voice vlan, next I configure the static voice vlan on the non-Cisco phone, will it be possible to authenticate the user on the PC and bypass authentication for IP phone? Is CDP required in such scenario - (non-Cisco IP phone doesn't support it)?
Regards,
Krzysztof

You need CDP for touchless interop. CDP can of course be spoofed though, so proceed with caustion anyway.
You need multi-domain authentication to appropriately deal with non-Cisco phones and port-based access-control. See here to get started:
<http://www.cisco.com/en/US/products/ps7077/products_configuration_guide_chapter09186a008077a284.html#wp1231964>
Hope this helps,

Similar Messages

802.1x / dot1x Authentication, including Voice-Vlan and Guest-Vlan

Hello,
i have tried to configure a dot1x based Authentication.
With an single host including guest-vlan, everything works fine.
But i want to use an IP-Phone (wich is every times authenticated) and behind the Phone an Client.
Is there a possible solution? And unfortunately IP-Phones are Avaya-Phones.
i have just tried so...
interface GigabitEthernet0/4
switchport access vlan 121
switchport mode access
switchport voice vlan 200
authentication event fail action authorize vlan 99
authentication event server dead action authorize vlan 121
authentication event server alive action reinitialize
authentication host-mode multi-host
authentication order dot1x
authentication port-control auto
authentication periodic
authentication violation restrict
dot1x pae authenticator
dot1x timeout quiet-period 10
dot1x timeout tx-period 1
spanning-tree portfast
Thanks, for any possible solution!

unfortunately because they are Avaya phones, the easy answer CDP-Bypass fails in this instance. When you plug in the phone, the switch will assume it's the 'single host' for this port, and restrict the port due to the authentication for the phone failing. Maybe you can just hard-code the voice-vlans on each phone, but that could get tedious depending on the amount of phones.
I believe there is a DHCP option you can pass back that indicates the phone should be running on vlan 200, but for this to work you'd also need to set up a pre-auth ACL that would allow DHCP to work in the unauthorized state. I think it's 147 off the top of my head.
Another solution (which isn't what you originally wanted, but it would work) is to just use multi-domain instead of single-host, and authenticate both the phone and the PC. The raduis server should be able to distinguish between what is configured as a phone and what is a host, and will send back the appropriate vlan if configured correctly.
What are using for a radius server?

Inter-VLAN routing, Auto-Voice VLAN and IP Address-Helper

Hope that somebody can help me with the setup in the screenshot.
Planning to use Auto-Voice VLAN and Smartports to configure VOIP
LLDP-MED will be enabled on the switch to detect the IP phones so they will be moved to the Voice VLAN (If not the first 6 signs will be added to the OID table). The Voice VLAN ID will be 2 >> Voice VLAN will be automatically enabled once a device is recognized as a IP phone right?
Workstations will be connected to the Cisco switch, VLAN data will be untagged and will remain on the native VLAN.
Smartports will be used to configure the ports (Macro's) >> Should configure the ports as trunks as assigns the correct VLANs right?
But how do i configure the IP Helper-Address? Do i have to create the Voice VLAN on both switches and then run the command "IP Helper Address" to specify a DHCP server? From what i've been reading it's required, when using Inter-VLAN routing, to configure the VLAN interface with an IP address. But it's going to give problems when both switches are connected to eachother and both have the same VLAN configured including the same IP address assigned to their VLAN interface?
Normal data should pass the ASA firewall, VOIP traffic should go through the Vigor modem to a hosted VOIP provider. The best way, i assume, is to configure 2 separate scopes on the DHCP server?
Still confused on how to set it up, hope that someone can point me in the right direction

If you're sending voice to only the Vigor modem then there is no need for a trunk between the SF-300 and the Vigor modem. You can just set that to an untag packet for the VLAN 2 between that switch and the Vigor modem.
On the 'edge' SF300 where the IP phone/PC is it is obviously going to interoute there and of course the phone port is tagged and PC port is untagged.
For the IP helper, it uses UDP-RELAY and it should be enabled on the port itself and enabled on the global configuration. You may also need option 82. Also keep in mind, depending how your DHCP server works, it may need option 82 configured as well or at least a route to understand the subnets in the layer 3 environment to get traffic across the VLANS.

Voice Vlan and Native Vlan

Dear all,
I am now reading some information regarding the setup of Voip Phone. It mentioned that the Phone is actually a 3-ports switch:
Port 1: Connect to upstream switch
Port 2: Transfer Phone traffic
Port 3: Connect to a PC
Actually, what should i configure on the upstream switch port? Should it be a trunk port containing both the voice traffic vlan and pc data vlan?
Or something else?
Also, there is a term called 'Voice Vlan', is there any different between 'Voice vlan' and ordinary Vlan ?
Is there any special usage of 'Native' Vlan in implementing Voip?
Thanks.
Br,
aslnet

Thanks.
How about if the PC data should be tagged as another vlan (e.g., Vlan 10)? Then I should change the native vlan to vlan 10?
But from my understanding, Native Vlan should be the same in the whole network, then I need to change the whole network native vlan? If there are different vlans should be assigned to different PCs that behind different VoIP-phone, then how to do it?
From my guessing, is it i can assign individual native vlan (vlan10) on that port (connect to voip-phone), and then keep the switch's uplink port as original native vlan (vlan1).
Therefore, PC data traffic would be untagged when entering from voip to the switch, and then tagged as vlan10 when leaving the switch to other uplink switch, right?
Thanks.

Help with Multiple VLANS and IP Phone Setup.

Although i have a 3com, I have a cisco IP Phone. I have the IP Phone connected to the 3com swithport using a hybrid port. It's a tagged member of vlan3 (voice net) and an untagged member of vlan1(native data)
The ip phone gets the right DHCP address for vlan3 ( 10.x.x.x ) but the laptop connected to the ip phone gets the IP for vlan 3 as well.
I want the laptop to get the IP of the native vlan ( 192.168.x.x)
what would the port setup need to be ? does it need to be a trunk ? i have the PVID of the port set to vlan3, this allows the IP phone to get its vlan3 DHCP address.
any help would be greatly appreciated.
The 3com OS is very similar to the latest of CISCO IOS'.
so explain wtih syntax and i'm sure the 3com can relate.

Based on your description of a 'Hybrid Port' this sounds like Cisco's 'Multi-VLAN Port' that was a feature of the 2900XL/3500XL series switches. This feature has however long since gone......
With a Cisco switch an access port supporting an Access VLAN & a Voice VLAN is effectively a Trunk with only one Tagged VLAN and the Native VLAN:
interface FastEthernet0/1
switchport mode access
switchport access vlan 10
switchport voice vlan 100
This results in the same configuration as:
interface FastEthernet0/1
switchport mode trunk
switchport trunk encapsulation dot1q
switchport trunk native vlan 10
switchport trunk allowed vlan 100
With the exception of CDP packets being sent advertising the Voice VLAN.
With regards to other IP Phone vendors and DHCP Vendor Options - the answer is it depends....
Nortel use Vendor Option 144 to inform the IP Phone of the Voice VLAN and Option 128 for the Server (PBX) to use. Ericsson uses Vendor Option 43 that can be configured to tell the IP Phone the VLAN and the Web server to read the config file from.
I don't think you will get this working automatically with your 3Com switches, you can however manually configure the VLAN on the Cisco IP Phones.
HTH
Andy

Cat 3750 with Voice VLAN and Dynamic VLANs

Morning,
Has anyone had any success with configuring a Catalyst 3750 with a Voice VLAN (Cisco phones) and 802.1x dynamic VLANs?
Is a RADIUS server able to provide values to change the native vlan?
Is there a decent tech note knocking about for configuring 'dynamic VLAN assignment through MAC addresses'?
Thanks,

Voice VLAN's don't require trunk ports to be configured (unless you are talkling about 2900XL/3500XL switches). Cisco added the ability to trunk a single 802.1q VLAN down an access port in addition to the access vlan - so in 2950 or above the only config you need is:
interface FastEthernet0/1
switchport
switchport mode access
switchport access vlan 10
switchport voice vlan 100
This is effectively the same as:
interface FastEthernet0/1
switchport
switchport trunk encapsulation dot1q
switchport mode trunk
switchport trunk native vlan 10
switchport trunk allowed vlan 10,100
The only difference is the CDP message with the first config will advertise the Voice VLAN capability and the tag.
With the older 2900XL/3500XL switches you had to configure the interfaces like the second example (plus adding the command switchport voice vlan xx for CDP to inform the IP Phone of the voice vlan).
QoS is not detailed anywhere here and that obviously plays an important role with voice.
In your scenario I am not sure ACS can do what you describe as this will require 802.1x supplicants on the client PC's (I may be wrong here and I do remember someone talking about switches being able to do an 802.1x 'proxy' using the MAC address on behalf of non 802.1x capable devices). This seems to me more of a VMPS application.
Personally I would reconfigure the network each time and charge the occupants a small fee for network setup.....
HTH
Andy

Video conferencing, voice, VLAN and Catalyst 2950, 3500 and 6500 switches

We have a Cat6500 with MSFC in the COre/Distribution, mix of 2950 and 3524XL in the closets in the HQ. Every closet will be on one VLAN. There are 5 remote sites on a Frame with 768 CIR. There will be one Polycom VC station in the HQ per closet, one Polycom per remote site. Additionally, every PC everywhere will be using desktop NetMeeting for VC. CallManager and IP Phones will be everywhere. My questions are:
1. should I put the Polycom on the same VLAN as the PC's with COS set to 4 at layer 2 and IP Precedence set to 4 at layer3? IP Phones are already on a seperate voice VLAN .
2. Should I put Polycom on it's own VLAN and seperate from the PC VLANs? If I do it this way should I set COS and IP precedence for the PC's with NetMeeting?
3. any sample config. for the Catalyst switches?
Thanks!
Chris

Chris,
Check out this IP telephony design guide. Hope it is of some help to you:
http://www.cisco.com/univercd/cc/td/doc/product/voice/ip_tele/network/

802.1x Guest Vlan and Routed access layer design

Hi!
For many reasons, I have to re-design my campus network in a more ISP like way. The plan is to move to a routed access layer in the next two years. I have 802.1x with guest vlan on my access ports(3750). I was reading on the subject and I found that the guest vlan feature was not availeble with internal vlan(routed port).
Is this limitation realy there, is there a way I can get around it without complicating my design even more. Do cisco have plan to lift this???

You cannot use/configure 802.1X on a routed port today. Typically, 802.1X is to be used for LAN edge ports.
The Guest-VLAN should work with a routed access design though. If your Guest-VLAN is chosen to be separate from say otherwise statically configured access VLANs, you would need to configure it via separate SVI with corresponding IP info (in a routed access model).
Hope this helps,

802.1x with Vlan assignment and IP phone and PC

I have a Catalyst 4510R and I want to im plement 802.1x with dynamic VLAN assignment via Radius server. I am going to plug to switch ports Cisco IP phones and PCs (PCs are plugged in the IP phone).
For this implementation I need to configure the switch port in mode trunk because I have voice vlan corresponding IP phone and data vlan corresponding to PC.
However I have read that I can not enable 802.1x on a trunk port.
How could I configure this?
I need that when the PC is authenticated correctly is assigned to his cooresponding data vlan and the IP phone is in the voice vlan.
Thanks

You should configure the port as an access port with an aux-vlan. Here's an example:
interface GigabitEthernet2/2
switchport access vlan 701
switchport mode access
switchport voice vlan 702
load-interval 30
qos trust device cisco-phone
qos trust cos
auto qos voip cisco-phone
dot1x pae authenticator
dot1x port-control auto
tx-queue 3
bandwidth percent 33
priority high
shape percent 33
spanning-tree portfast
spanning-tree bpduguard enable
service-policy output autoqos-voip-policy
Hope this helps,

Potential Security Hole with 802.1x and Voice VLANs?

I have been looking at 802.1x and Voice VLANs and I can see what I think is a bit of a security hole.
If a user has no authentication details to gain access via 802.1x - i.e. they have not been given a User ID or the PC doesn't have a certificate etc. If they attach a PC to a switchport that is configured with a Voice VLAN (or disconnect an IP Phone and plug the PC direct into the switchport) they can easily see via packet sniffing the CDP packets that will contain the Voice VLAN ID. They can then easily create a Tagged Virtual NIC (via the NIC utilities or driver etc) with the Voice VLAN 802.1q Tag. Assuming DHCP is enabled for the Voice VLAN they will get assigned an IP address and have access to the IP network. I appreciate the VLAN can be locked down at the Layer-3 level with ACL's so any 'non-voice related' traffic is blocked but in this scenario the user has sucessfully bypassed 802.1x authentication and gain access to the network?
Has anyone done any research into this potential security hole?
Thanks
Andy

Thanks for the reply. To be honest we would normally deploy some or all of the measures you list but these don't around the issue of being able to easily bypass having to authenticate via 802.1x.
As I said I think this is a hole but don't see any solutions at the moment except 802.1x on the IP Phone, although at the moment you can't do this with Voice VLANs?
Andy

Voice and Data Vlan Routing for CUPC and IP Phones ?

The IP Phones are in 10.1.1.0/24 network (Voice Vlan 10) , Desktop Computers are installed with CUPC 8.5 and they are in 11.2.2.0/24 network (DATA VLAN 20) , Unfied Communication Applications like CUCM , Cisco Unified Presence Server, Contact Center Express are in 172.16.10.0/24 network(Vlan 30). When using Clients like Cisco Unified Personal Communicator, How the Communication between CUPC(DATA Vlan)and IP Phones(VOICE Vlan) is possible?.How network should be configured or designed ? If i make intervlan routing it creates Security problems.what is the best practiced network Configs for these kind of Scenario ? Even if i prefer to configure Intervlan routing, Which all TCP/UDP ports are to be allowed / blocked between VLANS ??

Hi Mohammed,
Hosts on separate vlans communicate with each other through routing, as they are not in the same broadcast domain. Some of the systems you mention use a wide range of ports and, depending on system and installed version, documentation is generally available.
e.g
http://www.cisco.com/en/US/docs/voice_ip_comm/cucm/port/8_5_1/portlist851.html
or
http://www.cisco.com/en/US/docs/voice_ip_comm/cupc/8_5/english/release/notes/cupc85.html#wp39407
Be also aware that RTP communication uses extended ranges of ephemeral ports.

Voice and IP Phone response delay

All,
We are experiencing an issue with voice delay and even phone response delay during the beginning of a call. When a user picks up the phone there is a noticeable delay before any audio is actually heard (2-5 seconds). Users also complain that they are unable to answer the call, meaning they hit the speaker phone button on the phone but it doesn't repond for a few seconds.
There is an ASA (version 8.4(3)) that is in between the call managers and the remote locations with the IP phones.
I have already checked QoS from the CUCM all the way to the remote end. It is good. I have also not found any packet loss over my network or the carrier network. I do not have access to the data center or the ASA. I currently have the people responsbile trying to prove out their side but I need some ideas on possible problems? Also, has anyone else experienced this and if so what was the problem and the fix?
CUCM Version: 8.6
Phone Load: SCCP42.9-2-3S
Thank you!
Message was edited by: Preston Hartley
Update: The problem does not present itself on every call, when it does happen I see multiple packet retransmissions in wireshark.

The next step I would reocmmend is to run a Wireshark at both the phone and the CUCM node to which the phone is registered. This would let you see what happens: is the packet lost, arriving too late, corrupted, fragmented, etc.
https://supportforums.cisco.com/docs/DOC-11599
The ASA code is capable of doing Layer 7 inspection/manipulation of the SCCP traffic. It could have a bug where it doesn't understand the newer SCCP version or it could be rate limiting the connections to each CUCM server.
Another possibility is that there is traffic shaping somewhere which is delaying delivery of the packets. Again, seeing both sides is probably your best next bet.
Please remember to rate helpful responses and identify helpful or correct answers.

VLANs and VoIP on the same port

Hello, we want to move our VoIP system on its own vlan. We currently have everything on one big broadcast domain. I have been doing some reading and have head about Voice Vlans and switchport modes. All of our computers are connected to our ip phones so they are on the same physical line. The phones are Aastra 480i and they run on a sphericall phone system. The phones can tag the phone data with 802.1p/q. If im using static port based vlans how would i configure the ports to accepts these 2 diffrent vlans?

Hi Friends,
I have tried many a times with Avaya Ip phones and Cisco swiches and it works fine.
Actually what I think CDP is used for inline power negotation so if you dont have Cisco switches you have to use external power supply. Also now a days switches are coming which internal power supply which supoprt IEEE standard so if we have those switches we can use other vendors ip phones without external power supply.
Anoher thing I will always recommend not to configure trunk especially cause tht may result in pc getting DHCP ip adress later. I have experienced many a times this situation. When you configure switchport voice vlan command on the switch it automatically forms an internal trunk which is not displayed on the switch but internally it works.
Right now I was not able to find one cisoc doc which especially says no need for trunk if you configure switchport voice vlan command on switch.
So just 2 commands
switchport voice vlan
switchport access vlan
Works perfectly fine.
HTH
Ankur

What is the idea behind specifying the voice VLAN under the interface

Hi,
What is the idea behind specifying the voice VLAN under the interface? (Is it needed for both 802.1P and 802.1Q?)
Regards
M

The voice vlan command is what tells the IP phone what VLAN it should use...
The idea is that setting the native vlan on the port controls what VLAN the attached PC goes into, and the voice vlan tells the phone which VLAN it should go into.
It doesn't have any direct relation to QoS, as the port could be configured to ignore or take action on QoS markings with or without the voice vlan command.
Aaron

Setting Up VLAN and QoS for VOIP on SG200-18

We recently purchased the SG200-18 smart switch to replace a Netgear unmanaged switch. We're moving our phone service to VOIP through our local ISP as well.
I've currently got the VOIP phone plugged into Port 17 on the SG200-18 (it's a Grandstream cordless VOIP phone).
I want to put the VOIP phone on a separate VLAN from the rest of the network and optimize the QoS settings so that the VOIP phone has exceptional audio quality even during intense network traffic.
Here's my questions:
1. Do I need to adjust anything on the type of port for Port 17 (since it looks like some form of Combo port)?
2. How do I go about isolating the VOIP phone on it's own VLAN (I'm seeing VLAN and Voice VLAN settings, not sure which one to use; I tried setting a VLAN and broke Internet connectivity to the phone until I went in and removed it)?
3. Do I need to adjust any QoS settings on the switch to better optimize the VOIP phone?
A couple of additional questions about the GS200-18 in general:
1. Do I need to adjust any of the System Time Settings on the switch? I'm in Central Time.
2. Do I need to adjust any of the Green Ethernet/Energy Saving settings or should I stick with the defaults?
Also, a couple of "getting started" side questions to Cisco:
1. I've registered a My Cisco account. What do I need to do to register my switch with Cisco and associate it with my My Cisco account?
2. What are the benefits of taking out a Cisco Small Business Support Contract, and about how much would it cost on the SG200-18 (I ordered it from Provantage)? I'm curious to see if it's worth the money.
Here's my "specs":
Switch: SG200-18
VOIP phone: Grandstream DP715 and 710 expandable handsets
Plugged into: Port 17 on the SG200-18
ISP: Local ISP (Direclynx)
Connection type: 3M down/500k up DSL, moving to a wireless connection coming up which will give us faster speeds
VOIP backend provider: VOIP Innovations
Router: Apple Airport Extreme AC model (I run all Macs and iOS devices and OS X Server on the network, so using the Apple router makes setup easier, since it doesn't QoS, trying to QoS and VLAN at the switch level)
Thanks everyone!

Hello,
Lots of different questions here so I'll try to make sure I don't miss anything.
1. Do I need to adjust anything on the type of port for Port 17 (since it looks like some form of Combo port)?
The way the combo ports work is you can either use the SFP slot for a fiber connection or the copper ethernet port, but not both at the same time. Other then that they just function as normal network ports.
2. How do I go about isolating the VOIP phone on it's own VLAN (I'm seeing VLAN and Voice VLAN settings, not sure which one to use; I tried setting a VLAN and broke Internet connectivity to the phone until I went in and removed it)?
It sounds like you created the VLAN correctly and assigned the phone, however there wasn't anything doing any routing for that VLAN. You would need to have a VLAN capable router or a layer 3 switch so that something would act as the default gateway for the voice VLAN and route the traffic for you. Since there was nothing like this your phone lost it's connectivity to the internet when you placed it in the new VLAN. I don't think the Airport is VLAN capable, but we will come back to that.
3. Do I need to adjust any QoS settings on the switch to better optimize the VOIP phone?
Once you have a seperate VLAN setup for the phone properly you only have to tell the switch what your Auto Voice VLAN is going to be and it will automatically apply recommended QoS settings for the Voice VLAN and prioritize the voice traffic. There are ways to do this manually and even with the phone in the same VLAN however the are considerably more complicated.
1. Do I need to adjust any of the System Time Settings on the switch? I'm in Central Time.
The system time isn't always very important. You can set the correct time zone, however you should know the switch does not have a battery in it to keep track of time, so if/when it reboots or loses power the clock will reset. If you would like the switch to maintain accurate time you should setup an NTP server so the time is automatically updated from the internet. The switch will keep your timezone settings once you save them. Time is mostly important for logging and things like that, so you can configure it if you like but it is not necessary.
2. Do I need to adjust any of the Green Ethernet/Energy Saving settings or should I stick with the defaults?
Green ethernet simply reduces the power usage of the switch slightly, so unless you are having odd issues where ports are disconnecting, I would just leave them at the defaults.
1. I've registered a My Cisco account. What do I need to do to register my switch with Cisco and associate it with my My Cisco account?
There isn't really a way to associate your Small Business devices with your Cisco account. If you ever call in for technical support we will use your Cisco account and your serial number to create a support case, but even then they aren't linked together. If you decide to buy a support contract, that will be linked to your switch's S/N and your Cisco ID, so in a way that would associate them together. Devices being associated with Cisco accounts is something more common with Enterprise equipment, and mainly has to do with technical support cases.
2. What are the benefits of taking out a Cisco Small Business Support Contract, and about how much would it cost on the SG200-18 (I ordered it from Provantage)? I'm curious to see if it's worth the money.
There are a few advantages to a Support Contact. Your switch comes with a Limited Lifetime warranty that includes 1 year of technical support and return to factory hardware. With a service contract you get 3 years of technical support and next business day Advanced Replacement of the switch if it need to be replaced. I just did a quick google search, and it looks like a contract (part #CON-SBS-SVC2) costs about $50.
So there are a few other things to consider however.
As a frame of reference the average VOIP call uses about 64 - 128 kbps max.
Since you don't have a VLAN capable router or a layer 3 switch, a separate voice VLAN may not be an option. You also mention that the Apple Airport does not do QoS, meaning we will only be prioritizing the voice traffic while it is on the switch. When it is passed off to the Airport to be routed out to the internet all of the QoS settings will be lost, and normal network traffic will get the same priority as voice, since that is all up to the Airport.
With one phone the hassle of getting more equipment and setting up advanced QoS isn't really worth it, especially if the link to the internet isn't going to be participating in QoS.
One last thing I wanted to mention is you are switching to a wireless internet connection. I would ask them how their latency and jitter is, as these two network statistics greatly effect voice quality, and usually wireless performs worse when it comes to voice traffic.
I hope this information helps, if you have any more questions just let me know.
Thank you for choosing Cisco,
Christopher Ebert - Network Support Engineer
Cisco Small Business Support Center

802.1x, voice vlan and IP phone

Similar Messages

Maybe you are looking for