Valued Contributor

Question

IP Phone profiling Registration

20 replies
269 views

When i have a new ipphone connected to the network then fnac will move this ipphone to registration vlan before device profiling is running. After device profilling run then i can see the ipphone move to host role ‘IP Phone’ and registered’

But after the devices was profiled then how the vlan can be changed automatically to voice vlan? The only way the ip phone get the voice vlan after the ip phone registered by profiling is reboot the ip phone.

ebilcari

Staff

IP Phones are not handled as normal hosts by FNAC. You should try to enable this global option ‘provisionIPPhones=true’

as shown here: https://docs.fortinet.com/document/fortinac-f/7.6.0/ip-phone-integration/65140/appendix

Emirjon

HS08Author

Valued Contributor

hi @ebilcari

But that article say that for Proxy Radius, not Local Radius.

ebilcari

Staff

Same flag is used also for policy evaluation of the IP Phones.

Emirjon

AEK

SuperUser

In my experience I’ve never seen FNAC moving an IP phone to isolation, since it is not considered as normal host/device.

Except if you mean this IP phone is mobile (WiFi). In that case it will be considered as normal device and will be moved to isolation like others.

AEK

HS08Author

Valued Contributor

so when a new ip phone join to the network then how fnac will know this is ip phone? This can be done using device profiling right? And if the ip phone detected before the device profiling run then the ip phone will go to registration or isolation, am i right?

AEK

SuperUser

Is your IP phone WiFi or classic wired IP phone behind which we connect a PC?

If it is wired IP phone it is never isolated as far as I know, and the reason is “most probably” because FNAC detects it is connected to a trunk port having voice VLAN, not because it profiles it as IP phone.

AEK

HS08Author

Valued Contributor

My ip phone (using cisco ip phone 7800 series) connected to the access port, here my config

switchport access vlan 37

switchport mode access

switchport voice vlan 111

authentication host-mode multi-domain

authentication order dot1x mab

authentication port-control auto

authentication periodic

mab

snmp trap mac-notification change added

snmp trap mac-notification change removed

dot1x pae authenticator

spanning-tree portfast

And we can see the phone detected as rogue host

AEK

SuperUser

One thing strange in your port config is using both RADIUS and SNMP trap. This should be either trap or RADIUS but not both.

Note this may not be related to your issue.

AEK

HS08Author

Valued Contributor

idk now when i plug ipphone the the ip phone can get voice vlan without any action. Previously the new ip phone will enter to registration vlan and i must create dedicated policy for ip phone to connect to voice vlan.

AEK

SuperUser

so what did you change for that?

AEK

HS08Author

Valued Contributor

i’m not sure. Just want to know from expert here, what behaviour when we plug the ip phone? Is the ip phone can get voice vlan without any action such as make device profiling, make policy etc?

HS08Author

Valued Contributor

If the phone must be registered first then there are potential issue the phone will detected as rogue and move to isolation/registration vlan, right?

OhMaxx

Visitor III

Yes, if your phone isnt profiled by your device profiling rule he will stay in the registration vlan.

You can manualy import a csv list with all your IP Phone devices if you want to register them before but it’s not optimal.

ohMaxx

HS08Author

Valued Contributor

if we need to doing device profiling then there are time when the phone still in registration vlan when profiling not run. Also if the phone already profiled then we must re-plug so the port will get the voice vlan. Am i right?

Sign up

Login with SSO

Login to the community

Login with SSO