802.1x for avaya IP phones

[yuvarajR_]

Hi,

I am trying to do dot1x on avaya ip phones using IC4500. Configured local mac auth server and mac realm which is mentioned on locations group. On my phone as a user ID it is taking its MAC id but for password i have to give a separate on rather than mac ID becuase i am not able to mentions the password in IC & also the mac realm.

Please give you info on this.

[Raveen_]

Hi,

While configuring IC for MAC-AUTHENTICATION, you would add only mac-address.

For successful authentication NAS should send User-Name and Password attribute with Mac-Address.

If the NAS is not sending mac-address as part of user-name and password attribute, then you must check with your NAS vendor.

Regards,

Raveen

[apaul_]

Just adding to Raveen's response, MAC auth in most cases are configured at the switch level.

Have you configured the switch to do MAC documentation with IC ?

Thanks

[yuvarajR_]

Hi,

Thanks for your response. I am using Juniper EX4200 as a NAS device can you tell me what should i configure in the switch.

regards,

Yuvaraj

[apaul_]

This should help

http://www.juniper.net/techpubs/en_US/junos11.1/topics/example/authentication-mac-radius-ex-series.h...

[milind.mistry_]

Does anyone having an idea which return attribute we need to use for Cisco 2960 for voice vlan feature ?

[Raveen_]

Hi

I believe this is the one!

Cisco-AVPAIR with value device-traffic-class=voice.

Regards,

Raveen

Note: If this answers your query, you could mark this as accepted solution, that way it might help other as well. Kudo would be a bonus!!

[milind.mistry_]

Cisco-AVPAIR device-traffic-class= voice - vlan id or vlan name should i put

i have got vlan-id 291 and name is voice-test..

[Raveen_]

You could use standard radius attributes for dynamic VLAN assignment.

Tunnel-Medium-Type(65): 802

Tunnel-Private-Group-Id(81): 291 (VLAN-Id)

Tunnel-Type(64): VLAN

Regards,

Raveen

[Stanislas P_]

Hi,

in a configuration with both IP Phone and PC are connected on the same switch port, the configuration is the folowing:

- Data VLAN is configured as Access VLAN

- Voice VLAN is tagged with 802.1Q

In 802.1X, RADIUS server can provide only VLAN number for Acces (without 802.1Q tagging)

for the Voice VLAN, you need to configure the voice VLAN on the switch port, and configure the RADIUS Server (the IC in your configuration) to send attribute : Cisco-AVPair == "device-traffic-class=voice" to use the VLAN configured as voice vlan.

http://www.avaya.com/master-usa/en-us/resource/assets/applicationnotes/802_1x_ciscomda.pdf

Stanislas