Port-Based 802.1x Security Policy and IP Phone Problem

[JDLiver]

Hello Everyone,

I'm looking for advice on a configuration problem with IP Phones, Port-Based 802.1x Security Policy, and LLDP.  Most users in my environment daisy-chain their dock-attached laptop and IP Phone to the switch port (Dock > Phone > Switch Port).  I have a port-based 802.1x security policy on the port and an LLDP policy.  The laptop authenticates well against RADIUS, and the phone receives its voice VLAN and connects to the internet.  It works very well.  If only the dock-attached laptop is connected to the switch port it authenticates well.  However, if only the IP Phone is attached the device seems to receive its VLAN assignment (observed in the phone's Device Status) but nothing else.  No IP addressing via DHCP for sure.

Is this the only behavior I can expect out of this setup?  I am currently migrating away from another network vendor stack, and we had good success with port-based 802.1x and LLDP allowing IP phones onto their VLAN whether an authenticated laptop was attached or not.

Is there anyway to bypass port-based 802.1x security for my IP Phones but enforce it for my laptops?  Would a dynamic policy be more appropriate to achieve the same overall behavior of my previous setup?

[rosatechnocrat]

Yes, MAC address authentication bypass (MAB) can be used to bypass dot1x for IP Phones. 

[JDLiver]

Appreciate your reply.  What I am trying to avoid is implementing phones as users in RADIUS/NPS.  Previously phones avoided authentication altogether and were placed on their own VLAN with internet access only.  They were truly exempt from authentication.  As I've done more research and testing today, this seems like it's not possible.

[rosatechnocrat]

As soon as you enable dot1x authentication, all the devices on the port has to be authenticated. The only way to exclude IP phone is by MAC bypass. But as you mentioned you don't even want to have the MAC address authentication or MAC in radius .. Then I don't see a way to exclude these. 

[mauromarme]

Hello @JDLiver 
Just to make sure, the issue is that Port-Based 801.1X Authentication is only working for phones when they are connected to the Dock station?
Have you verified the phones support the configuration you have?
Have you verified if there is any Authentication Issue when using only the IP Phone Connection?

Regards,

[JDLiver]

I have a static port configuration with 802.1x and LLDP policies applied.  Port-based 802.1x works with a laptop or a laptop and phone connected to the switch.  That same configuration with only a phone does not work.  The device gets a vlan assignment but no ip addressing.

The phones work well attached directly to the switch when the port has an LLDP policy and no 802.1x policy. 

The phones are not responding to requests because they do not have 802.1x enabled, and I am not using MAB, but I will check for auth issues in the logs anyway in case I am missing something.

The 802.1x behavior seems to allow all devices to connect if one authenticates.  And laptops that fail authentication or fail to authenticate at all move to guest VLANs or isolated VLANs.  It seems like devices that receive LLDP policies (like phones) and fail to authenticate are stuck in a failed state with no ip addressing.  Maybe my solution if I don't want to deal with MAB users or calling station id lists is to use one of the guest or failed auth vlans as a voice VLAN until I can find another solution (or time to deal with MAB).  I may find some issues with QoS, but maybe I can find a way around that.

[mauromarme]

I Agree.
MAB should fix this, as the Phones can authenticate,  but in the meantime using a guest VLAN would be a good workaround. 

[ebilcari]

The behavior changes based on Security mode:

port-based means that the first host that authenticates will dictate the VLAN and the access for other hosts that connect on the same port, that's explain your case that when a PC authenticates also the IP Phone gets access.

The voice VLAN gets communicated via LLDP but if the authentications fails the communication is not allowed by the switch. The recommended way is to use the MAC-based mode with MAC authentication bypass and configure the RADIUS server to successfully authenticate both dot1x (PC) and MAB (IP Phone) hosts.