MAB/802.1x and Alkatel IP Phones

Hi All
We have a distributed deployment where Alkatel ip-touch phones are authentictaed via MAB. Alkatel ip touch phones has 802.1x enabled by default and the phone tries eapol first and then switch authenticates via MAB which is fine. Once authenticated its working as expected. The issue is the phone keeps on periodic retry after x amount of minutes for 802.1x again which triggers the phone to reboot again and goes via the whole process. This interupts the voice. We could disable 802.1x but its per phone basis. Has anyone came across this issue and found a way to diable globally via the call manager etcc. or any workarounf from ISE/switch side?
Thanks
G

Hi Tarik,
Thanks for the reply, please find below the switch port config lines, its a 370x switch, IPbase and universalon 15.2-1.E1 image
Note- Since the 8021x is enabled by default the phone initially tries 802.1x and after failing , the switch goes to the next auth method which is MAB which is successful. The issue is the phone again initiales a 802.1x packet after some time and the whole process starts again and because 8021x is failed the phone reboots again. I think this is the way this type of phone work and we cannot do much unless disable 802.1x or install the Alkatel CA certs in the ISE cert store?
Interface gi x/y
switchport access vlan xx
switchport mode access
switchport voice vlan yy
ip access-group ACL_ALLOW in
authentication event fail action next-method
authentication event server dead action reinitialize vlan xx
authentication event server dead action authorize voice
authentication host-mode multi-auth
authentication open
authentication order mab dot1x
authentication priority dot1x mab
authentication port-control auto
authentication timer reauthenticate server
authentication violation restrict
mab
snmp trap mac-notification change added
snmp trap mac-notification change removed
dot1x pae authenticator
dot1x timeout tx-period 10
spanning-tree portfast

Similar Messages

MAB, 802.1x and ACS 4.2

Hi all,
Currently i'm using an ACS4.2 as radius server, some switch 2960-s ios 12.2.(55)se5, ipphone Alcatel iptouch 4018 and i would like to assign dinamic vlan to some specific users/laptop Daisy-chained to ip phone.
Logic connection is: users laptop---->ipphone---->switch---->radius
What i need is:
if I connect MY laptop to the ipphone port, i receive a specific vlan ( vlan 58 )
if SOMEONE else ( i.e. a consultant ) connect his laptop to the SAME ipphone port (if available) he has to receive a different vlan ( vlan 1).
I've been able to reach the goal using MACRO but it tooks too much time to authenticate ( approx 1 min ) so i give up and tried a different faster way ( 802.1x and MAB ).
i've been able to authenticate the ip-phone using 802.1x auth and to receive the correct vlan when i connect MY laptop (MAB auth) but i was not able to provide the VLAN 1 to the Consultant when he connect his laptop even if the "authentication event fail action authorize vlan 1" is configured.
I used the dot1x auth-fail vlan because i'm not able to use MAB or 802.1x auth on external laptop. I also tried with guest vlan with no luck.
In both case the "consultant" remain in "auth failed"
Here my current configuration
dot1x system-auth-control
dot1x guest-vlan supplicant
identity profile default
interface GigabitEthernet1/0/1
switchport mode access
switchport voice vlan 30
authentication host-mode multi-auth
authentication event fail action authorize vlan 1
authentication order mab dot1x
authentication port-control auto
mab
dot1x pae authenticator
dot1x timeout tx-period 2
dot1x max-reauth-req 1
storm-control broadcast level 2.00
storm-control multicast level 2.00
spanning-tree portfast
On ACS side i have 2 groups
first Group authenticate the iphone and supply the voice vlan ( vlan 30)
Second Group authenticate using MAB and supply the vlan 58
is there a different way to accomplish this task?
Thank you in advance

hi,
any ideas?
thx

802.1x and Cisco IP phones

I have 802.1x configured on a Cisco 2950 switch. On ports where I have PCs plugged into the data port on the IP phones users sometimes get placed in the guest vlan. If they shut down their attached PC and then unplug the network cable (the one between the switch and the phone), then re-plug in the cable and boot their PC it seems to authenticate them again.... sometimes. The config for the ports with phones configured is as below:
interface FastEthernet0/4
switchport access vlan 4
switchport mode access
switchport voice vlan 200
switchport port-security
switchport port-security maximum 2
no ip address
dot1x port-control auto
dot1x host-mode multi-host
dot1x guest-vlan 3
spanning-tree portfast
Does anyone have a possible fix or work around?
Thanks in advance,
Peter

You can configure the MSFT supplicant to send an EAPOL-Logoff:
Software\Microsoft\EAPOL\Parameters\General\Global\AuthMode -- REG_DWORD
0: Machine authentication mode in Windows XP Client RTM. When a user logs in, if the connection has already been authenticated with Machine credentials, the users credentials are not used for authentication.
1: Machine authentication with re-authentication functionality. Whenever a user logs in, 802.1X authentication is performed using the users-credentials.
2: Machine authentication only Whenever a user logs in, it has no effect on the connection. 802.1X authentication is performed using machine credentials only.
In the wired-Ethernet case you should set (SupplicantMode = 3) AND (AuthMode = 0) AND (disable Machine-Authentication OR ensure that there are no machine credentials on the client). This will ensure that when a user logs off, an EAPOL-Logoff will be sent out. So, AFAIK, this is the bad news .. you lose machine-auth.
Actually, stay tuned for the ability for our IP Phones to be able to do this on behalf of a PC very soon. What will happen is when an IP Phone senses EAPOL through it, it will know who the supplicant is, and what port they're on (the phone's PC port). Assuming 2 conditions above, if link to phone's PC port goes down, IP Phone will transmit EAPOL-Logoff to PC immediately (on PCs behalf).
Hope this helps.

MAB and 802.1x issues with IP-phone

I'm trying to use 802.1x to authenticate clients on my network with dynamic VLAN assignment from RADIUS. We have IP-Phones(powered by PoE) that only supports EAP-MD5, and we would rather use MAB(it also uses LLDP-MED for some settings) to authenticate the phones using the MAC-range from the phones vendor. The following scenario works perfect:
Connect the phone and let it boot up(takes a while) and authenticate with MAB.
Connect a computer in the phones data-port and let it authenticate with 802.1x(or fail and reach guest-vlan)
However, the following scenario doesn't work:
The computer is already connected to the phone
The phone is then connected to the switch
What happends now is that the computer is authenticated using 802.1x before the phone boots up and get's authenticated with MAB. When the phone is ready, it's authenticated with MAB and everything works. However, after a short period(let's say a minute), using `debug authentication all`, we see a "NEW LL MAC: phones mac" message(which is weird since the mac has already been MAB-authenticated), and then we are unable to contact the phone using ping. When I check `show mac address-table` it has now moved the mac from `Port Gi 0/12` to `Port Drop`. However, if I check `show mab interface Gi 0/12` or `show authentication sessions` it lists the phones-mac as `mab auth sucess `.
Can anyone explain why the first scenario works, and not the second?
The switch is a 3560E PoE 24p with IOS 12.2.58SE2. Sample of the switch-config:
network-policy profile 1
voice vlan 90
interface GigabitEthernet0/12
switchport mode access
network-policy 1
authentication control-direction in
authentication event fail retry 1 action authorize vlan 60
authentication event server dead action authorize vlan 60
authentication event no-response action authorize vlan 60
authentication event server alive action reinitialize
authentication host-mode multi-domain
authentication order mab dot1x
authentication priority mab dot1x
authentication port-control auto
authentication periodic
authentication violation replace
mab
dot1x pae authenticator
dot1x timeout tx-period 5
dot1x max-reauth-req 1
spanning-tree portfast
Btw, when we tried authenticating the phones using 802.1x too (EAP-MD5), there are NO problems in any of the scenarios. However, we want to use MAB instead of 802.1x to avoid the requirement of configuring the phones with a username and password. The RADIUS response was the same when using 802.1x as it is with MAB for the phones (including device-traffic-class=voice AV-pair).

Hey. Yes, as specified in the last sentence in my post, the phone is placed in the Voice Domain, and both RADIUS and LLDP-MED (network policy profile 1) specifies voice vlan as 90.
The weird thing is that everything works fine if both use 802.1x, and that there is only a problem when phone(using MAB) already has the computer connected to it, when the phone is turned on(connected to PoE-switch). It must be because the computer boots up and authenticates first I think.
The phones are Snom 821.

Using 802.1X and non-Cisco IP Phones

Hi there,
Having some questions about an 802.1x/non-Cisco ip phone setup and was hoping to find some answers/user-experience with this setup.
Main questions i'm facing:
1) When using non-Cisco ip phones (eg Nortel or Siemens) and a previous authorized client connected behind this ip phone gets disconnected. What will this action do with the authorized state of 802.1X on the switch port? WIll it stay authorized until the reauth timer expires or does it reject communication from any other device?
2) What about EAPOL-Logoff messages from the ip phone to the switch. Are these only used by Cisco phones when they experience a link-status change on data ports?
Thanks for sharing your thoughts

Overall, you need to try and deal with the fact that a machine can disappear from the network and the network may not know about it directly (i.e. Link doesn't go down).
I have no idea what other phones do, but Cisco phones send an EAPOL-Logoff when something is unplugged. This lets the switch know directly, and 1X session start is torn down immediately, closing what would be a security hole.
Fundamentally, re-auth is a workaround only, and this is not the reason to enable re-auth to begin with.
If your phone doesn't send an EAPOL-Logoff in this case, the switch might be left thinking an attack is underway when someone else tries to plug in (with presumably a different MAC). You do NOT want this to occur.
Hope this helps,

802.1x and IP Phone

Is it possible to enable dot1x and voice on the same interface? If so which switches and IOS support this feature ?
Any references to documents ?
Commands that cannot be configured together :-
switch voice vlan xxx
dot1x port-control auto

It is possible to enable 802.1X and voice on the same port. If the phone does CDP, it is allowed through, regardless of the 802.1X state of the port with this config. Here's the following switches that support this, with the minimum required releases:
CatOS (6500) - 7.6(1)
IOS (4500) - 12.1(20)EWA
IOS (3750) - 12.2(25)SEA
IOS (3560) - 12.2(25)SEA
IOS (3550) - 12.1(12c)EA1
IOS (2960) - 12.2(25)FX
IOS (2950) - 12.1(12c)EA1
IOS (2940) - 12.1(13)AY
Hope this helps,

CUVA and SPA525G IP Phone in VPN Mode

Will i be able to co-locate my laptop off of a SPA525G IP phone that is in VPN mode (connected to the internet via Cat5/6 of course, NOT 802.11g) and run CUVA? it is my understanding that CUVA will work on the SPA525G phone when it is on the internal network and has a pc co-located through the phone's switch port. I had a cusomter ask this and i wasn't sure. Thanks in advance for all the help!

The phone PMs may correct me, but I am thinking that SPA5xx phones do not support point to point video in the current revision.
Steve
SE

Dot1x, .1X and Cisco IP Phones

Hi,
We are busy performing dot1x tests on IP Phones. We chose the LSC approach and have generated CAPF CSRs which we have signed by our PKI infrastructure.
Once all certificates and trust have been uploaded and when we update the CUCM CTL with the Cisco CTL client tool, we received the following error message
“Could not get CAPF certificate(s).CAPF seems to be running on the CUCM Publisher but the certificate file(s) do not exist in the Certifiicate trust path on Server”
We searched Neptro with an explanation on this and found that article:
https://supportforums.cisco.com/thread/2067102
In our setup we one issuing CA in the certification path has n key of 4096 bits. This is imposed by our Security Policy and can’t be workaround from a security policy point of view.
We then had the CAPF CSR regenerated and had a test CA with an encryption key of only 2048 bit sign our certificate and Dot1x authentication. This worked just fine and test Ip Phones can now authenticate..
My question is, is that a known limitation of Cisco Callmanager which is unable to handle certificates signed by a PKI in which one of the CA has a key of more that 2048 bits. Or is this a bug related to our 8.6.2.23900-10 CUCM version.
Is there a way to bypass that limitation or a precise version of callmanager correcting it?
THanks,
Antoine

You can configure the MSFT supplicant to send an EAPOL-Logoff:
Software\Microsoft\EAPOL\Parameters\General\Global\AuthMode -- REG_DWORD
0: Machine authentication mode in Windows XP Client RTM. When a user logs in, if the connection has already been authenticated with Machine credentials, the users credentials are not used for authentication.
1: Machine authentication with re-authentication functionality. Whenever a user logs in, 802.1X authentication is performed using the users-credentials.
2: Machine authentication only Whenever a user logs in, it has no effect on the connection. 802.1X authentication is performed using machine credentials only.
In the wired-Ethernet case you should set (SupplicantMode = 3) AND (AuthMode = 0) AND (disable Machine-Authentication OR ensure that there are no machine credentials on the client). This will ensure that when a user logs off, an EAPOL-Logoff will be sent out. So, AFAIK, this is the bad news .. you lose machine-auth.
Actually, stay tuned for the ability for our IP Phones to be able to do this on behalf of a PC very soon. What will happen is when an IP Phone senses EAPOL through it, it will know who the supplicant is, and what port they're on (the phone's PC port). Assuming 2 conditions above, if link to phone's PC port goes down, IP Phone will transmit EAPOL-Logoff to PC immediately (on PCs behalf).
Hope this helps.

Potential Security Hole with 802.1x and Voice VLANs?

I have been looking at 802.1x and Voice VLANs and I can see what I think is a bit of a security hole.
If a user has no authentication details to gain access via 802.1x - i.e. they have not been given a User ID or the PC doesn't have a certificate etc. If they attach a PC to a switchport that is configured with a Voice VLAN (or disconnect an IP Phone and plug the PC direct into the switchport) they can easily see via packet sniffing the CDP packets that will contain the Voice VLAN ID. They can then easily create a Tagged Virtual NIC (via the NIC utilities or driver etc) with the Voice VLAN 802.1q Tag. Assuming DHCP is enabled for the Voice VLAN they will get assigned an IP address and have access to the IP network. I appreciate the VLAN can be locked down at the Layer-3 level with ACL's so any 'non-voice related' traffic is blocked but in this scenario the user has sucessfully bypassed 802.1x authentication and gain access to the network?
Has anyone done any research into this potential security hole?
Thanks
Andy

Thanks for the reply. To be honest we would normally deploy some or all of the measures you list but these don't around the issue of being able to easily bypass having to authenticate via 802.1x.
As I said I think this is a hole but don't see any solutions at the moment except 802.1x on the IP Phone, although at the moment you can't do this with Voice VLANs?
Andy

802.1x and Voice VLAN

I had read articles on cco, and I believed for the same switch port we can have 802.1x configure and the voice vlan configure. It mean the IP phone is connect to the switch port with 802.1x configured, but the phone will not autheticate, only the workstation connect to phone data port will get authenticate.
I had configured 802.1x and test with notebook logon and able to access the network. Now I would like to test the notebook attached to IP phone data port, and the phone connect to switch port configure with 802.1x. But I failed to add voice vlan commmand. Why ?
interface GigabitEthernet9/48
description temporary port
switchport
switchport access vlan 12
switchport mode access
no ip address
dot1x port-control auto
spanning-tree portfast
CIG01-ENT-SW1(config-if)#switchport voice vlan 14
Command rejected: Gi9/48 is Dot1x enabled port.

Using IEEE 802.1x Authentication with Voice VLAN Ports
A voice VLAN port is a special access port associated with two VLAN identifiers:
?VVID to carry voice traffic to and from the IP phone. The VVID is used to configure the IP phone connected to the port.
?PVID to carry the data traffic to and from the workstation connected to the switch through the IP phone. The PVID is the native VLAN of the port.
In single-host mode, only the IP phone is allowed on the voice VLAN. In multiple-hosts mode, additional clients can send traffic on the voice VLAN after a supplicant is authenticated on the PVID. When multiple-hosts mode is enabled, the supplicant authentication affects both the PVID and the VVID.
A voice VLAN port becomes active when there is a link, and the device MAC address appears after the first CDP message from the IP phone. Cisco IP phones do not relay CDP messages from other devices. As a result, if several Cisco IP phones are connected in series, the switch recognizes only the one directly connected to it. When IEEE 802.1x authentication is enabled on a voice VLAN port, the switch drops packets from unrecognized Cisco IP phones more than one hop away.
When IEEE 802.1x authentication is enabled on a port, you cannot configure a port VLAN that is equal to a voice VLAN.
Waht kind of switch do you have? In 3550 I can configure the port for both vvid and pvid:
interface FastEthernet0/1
switchport access vlan 3
switchport mode access
switchport voice vlan 2
no ip address
dot1x port-control auto
spanning-tree portfast
end
Nevertheless, as the statement above indicates, the port will need to be configured for multi-host in order the PC behind the phone get autehntication:
under the interface configure "dot1x host-mode multi-host"
Nevermind, I just realized that you might have a 5600 running native, checking the configuration guide and realese notes it does not looks like dot1x and vvlan can play together in that platform.

802.11n and Airport Express iTunes Base station Help me ?

I'll try to keep this simple :
In my Office I have a 24" iMac Intel and the
802.11n resides also in my Office
About 40ft away is my Den which resides:
My MacBook Pro 17" Intel and a Airport Express iTunes
Base Station
Going Back to the 802.11n I have a 2.0 USB AC Powered
Hub connected to the USB port on the back of the 802.11n
of which  said is OK to do
Connected to the USB on the back of the 802.11n:
is a Epson R200 USB InkJet Printer and also on that
Hub is a Lacie Porche 500gb External USB Hard Drive
Again  says is Ok to do
The problem I'm having is that the Cable Modem is
in my Office and is connected via Ethernet to the 802.11n
and I can get a strong connection to the internet
on my iMac 24" Intel in my Office but the MBP 17"
in my Den is having issues getting onto the Internet
now about a week ago I spent 8hrs on the phone W/Apple
about such issues so we erased all the information in
the Disk Utility and started over with the information
in the 802.11n and the iTunes Base Station Express
this has helped until the recent FirmWare Update that
Apple Released a few days ago,
I've tried to actual bring my MBP 17" into the Office
and it gets a better Internet signal than in the Den,
but this wasn't the way it was before the FirmWare Update
Any Suggestions on what I can do to fix this situation
As all worked well with the Express iTunes in the Den
and the 802.11n in the Office and the Cable Modem has
always been in the Office ?
P.S> One problem I forgot to mention is I keep dropping
The Macbook Pro 17" and a Lacie 400gb Hard Drive which is
connected directly to the MBP 17" USB Port which keeps
dropping from my iMac 24" networking it will be working
fine and then I get a message stating that either or both
the MBP 17" and the Lacie Disk (400gb) is Disconnecting
from iMac 24" and then the same will happen on the
MBP 17" with the iMac 24" and any connected drives I'm
sharing from the iMac 24" ?
I'm having a connection problem and I can't get to the
bottom of it and I need some help please
Feel free to email me [email protected]

Updates fixed issue closed question

I was syncing my iPhone5 to iTunes and then my phone automatically locked and now it won't turn back on

I was syncing my phone to itunes and then my phone automatically locked and now it won't turn back on but when i plug it into a charger it makes the charging sound.

Hi lemmag17,
If your iPhone doesn't appear to be responding or turning on, you may find the following article helpful:
iOS: Not responding or does not turn on
http://support.apple.com/kb/ts3281
Regards,
- Brenden

Installed the update tonight and now my phone (Lumia 928) won't power up. I've tried a soft reset, but the screen goes from the Nokia logo to a red Verizon screen to a black screen. What's wrong and how do I fix it? Help!

Installed the update tonight and now my phone (Lumia 928) won't power up. I've tried a soft reset, but the screen goes from the Nokia logo to a red Verizon screen to a black screen. Tried it 10 times with the same result. What's wrong and how do I fix it? Help!

Oh no Mr.Ected!
I can see if we can get your phone back on! I understand how important it is to have a phone. Have you tried this to see if we can get it back on? http://vz.to/1DZhteH . If it is still goes to a red Verizon screen and then to black we might need to do a master reset. While the phone is off try this:http://vz.to/1DZhXkU Be mindful this is the last resort because it will erase everything on the phone. If you have done back up assistant in the past you will be able to get you contacts back. Please let me know if you need any more help.
AmberF_VZW
Follow us on Twitter @VZWSupport

Battery Purging and Over heating Phone!

WHAT?!! I have assumed that my LG Revolution spontaneously purging the entire battery charge at once then over heating and shutting down was a hardware issue! Now I find that it is the result of yet ANOTHER OS SOFTWARE upgrade issue?! OMG are you kidding me?!! I have been PLAGUED with problems since I was forced to upgrade my android OS to 2.3.6 through Verizon! I am ready to make ANY change I have to escape this plague!! I PAY WAY TOO MUCH MONEY for android smart phones and premium service through a so called 'premium' provider to have to put up with economy freakin performance Verizon!!!
I am especially disappointed in Verizon since I took the phone all the way to their coorporate store 5 months ago and all they did was scratch their heads! They tried to sell me a new battery which also immediately commenced to over heat; so of course the next course of action was to try and sell me a NEW PHONE!
I've been sitting here with a DEAD VERIZON phone all day AGAIN trying to rescucitate it!! ****, that **!

Thank you Verizon; you're right. Buying a new phone is the fix! I bought a brand new LG Spectrum at the Verrizon store yesterday and my old LG Revolution immediately began to work perfectly again. That was the fix. Of course....
You think this is messed up? It just gets weirder. Before going to bed last night I took my new LG Spectrum off a 4 hour charge because it was full. It slept all night. When I checked it in the morning it had one missed call and 6 emails; that's it. The battery charge however was completely on EMPTY! OMG!!?? What the....? Yesterday I was rather puzzled by how exceptionally warm/hot it felt while on charge. The charger plug also felt the same. It's on charge right now using the supplied charger but I changed it to a different outlet. It's still very warm/hot. I'm befungled!! I live in a 1/2 million $ condo packed with properly working electronics' so it's certainly not a source problem.
More weirdness: yesterday I was downloading and re-installing programs and updates to reload my new phone. A couple of hours later it went on an all out download splurge all on it's own, one after another it was a stream of unwanted downloads I couldn't stop. I turned off wi-fi, but eventually had to shut down the phone right in the middle of processes..... not a good. (UPDATE: solved this issue. I discovered that all the bloatware pre-installed on the phone further imposes itself by ALSO being set to 'auto update' itself. Oh! cool! and check this out: it won't let you uninstall any of that sh*t! Cool huh? Thanks LG or is it Verizon; I want to be sure to give due credit to whomever is responsible for that *** idea!)
My new not-so smartphone phone, less than 24 hours old, is already fouled.
UPDATE: 5 hours later. No phone call usage today. Emails, texts, a few downloads, and some new phone setup configuring today. Phone is dead after 5 hours of use. Took old phone off 1 hour charge and of course it was as cool as a cucumber, plugged in new phone and it became hot within minutes. I think that the solution is to just go back to using landlines....
Attached below is a photo showing the EKG of the entire life of my NEW phone. 1 day and 7 hours. Hmph? And I am already in the forums. Anyone know what the record is?

My weather channel app doesn't work and freezes my phone

My weather channel app doesn't work and freezes my phone. I've tried closing the app. Also tried deleting and readding it. All my other apps work.

Try this:
Make sure your iPhone is fully updated.
Restart your iPhone
Do NOT open the app, just delete it
Reset your iPhone (hold down sleep/wake and home buttons simultaneously until you see an apple logo, then release the buttons)
Readd the app
Open the app and test.
If that doesn't resolve the issue, then it may be an issue with the app itself and you might have to contact the app's developer.

MAB/802.1x and Alkatel IP Phones

Similar Messages

Maybe you are looking for