8

I've successfully configured a Cisco 3750G to perform the authenticator function of the 802.1x process. I have a test Win7 machine as a supplicant and a Windows 2008 server running NPS as the Authentication Server. The Win7 machine is able to successfully authenticate.

I've now hooked up a Cisco 7941 IP Phone in front of the Win7 machine, configured the switch with the swtichport voice vlan command, I plug it in and it is granted power, but the port quickly moves to a down state. After looking through the debug logs I believe the issue to be something with 802.1x trying to authentication on both the Access VLAN and the Voice VLAN. Is there a way to only perform 802.1x on the Access VLAN? and not the Voice?

Scenario:

{RADIUS}  <---->   {3750G} <-----> {Cisco 7941 Phone} <----->  {Win7 802.1x client}

I am currently testing on interface gi1/0/3, here is the interface config line:

interface GigabitEthernet1/0/3
  description TestPort
  switchport access vlan 100
  switchport voice vlan 110
  switchport mode access
  authentication port-control auto
  authentication periodic
  authentication timer reauthenticate server
  dot1x pae authenticator
  spanning-tree portfast
  auto qos voip cisco-phone

Some of the debugs from the 3750G

*Apr 21 13:44:04.045: %ILPOWER-7-DETECT: Interface Gi1/0/3: Power Device detected: IEEE PD
*Apr 21 13:44:04.322: %ILPOWER-5-POWER_GRANTED: Interface Gi1/0/3: Power granted
*Apr 21 13:44:07.811: dot1x-ev(Gi1/0/3): Interface state changed to UP
*Apr 21 13:44:07.811:     dot1x_auth Gi1/0/3: initial state auth_initialize has enter
*Apr 21 13:44:07.811: dot1x-sm(Gi1/0/3): 0x0000003B:auth_initialize_enter called
*Apr 21 13:44:07.811:     dot1x_auth Gi1/0/3: during state auth_initialize, got event 0(cfg_auto)
*Apr 21 13:44:07.811: @@@ dot1x_auth Gi1/0/3: auth_initialize -> auth_disconnected
*Apr 21 13:44:07.811: dot1x-sm(Gi1/0/3): 0x0000003B:auth_disconnected_enter called
*Apr 21 13:44:07.811:     dot1x_auth Gi1/0/3: idle during state auth_disconnected
*Apr 21 13:44:07.811: @@@ dot1x_auth Gi1/0/3: auth_disconnected -> auth_restart
*Apr 21 13:44:07.811: dot1x-sm(Gi1/0/3): 0x0000003B:auth_restart_enter called
*Apr 21 13:44:07.820: dot1x-ev(Gi1/0/3): Sending create new context event to EAP for 0x0000003B (0000.0000.0000)
*Apr 21 13:44:07.820:     dot1x_auth_bend Gi1/0/3: initial state auth_bend_initialize has enter
*Apr 21 13:44:07.820: dot1x-sm(Gi1/0/3): 0x0000003B:auth_bend_initialize_enter called
*Apr 21 13:44:07.820:     dot1x_auth_bend Gi1/0/3: initial state auth_bend_initialize has idle
*Apr 21 13:44:07.820:     dot1x_auth_bend Gi1/0/3: during state auth_bend_initialize, got event 16383(idle)
*Apr 21 13:44:07.820: @@@ dot1x_auth_bend Gi1/0/3: auth_bend_initialize -> auth_bend_idle
*Apr 21 13:44:07.820: dot1x-sm(Gi1/0/3): 0x0000003B:auth_bend_idle_enter called
*Apr 21 13:44:07.820: dot1x-ev(Gi1/0/3): Created a client entry (0x0000003B)
*Apr 21 13:44:07.820: dot1x-ev(Gi1/0/3): Dot1x authentication started for 0x0000003B (0000.0000.0000)
*Apr 21 13:44:07.820: dot1x-ev:DOT1X Supplicant not enabled on GigabitEthernet1/0/3
*Apr 21 13:44:07.820: dot1x-sm(Gi1/0/3): Posting !EAP_RESTART on Client 0x0000003B
*Apr 21 13:44:07.820:     dot1x_auth Gi1/0/3: during state auth_restart, got event 6(no_eapRestart)
*Apr 21 13:44:07.820: @@@ dot1x_auth Gi1/0/3: auth_restart -> auth_connecting
*Apr 21 13:44:07.820: dot1x-sm(Gi1/0/3): 0x0000003B:auth_connecting_enter called
*Apr 21 13:44:07.820: dot1x-sm(Gi1/0/3): 0x0000003B:auth_restart_connecting_action called
*Apr 21 13:44:07.820: dot1x-sm(Gi1/0/3): Posting RX_REQ on Client 0x0000003B
*Apr 21 13:44:07.820:     dot1x_auth Gi1/0/3: during state auth_connecting, got event 10(eapReq_no_reAuthMax)
*Apr 21 13:44:07.820: @@@ dot1x_auth Gi1/0/3: auth_connecting -> auth_authenticating
*Apr 21 13:44:07.820: dot1x-sm(Gi1/0/3): 0x0000003B:auth_authenticating_enter called
*Apr 21 13:44:07.820: dot1x-sm(Gi1/0/3): 0x0000003B:auth_connecting_authenticating_action called
*Apr 21 13:44:07.820: dot1x-sm(Gi1/0/3): Posting AUTH_START for 0x0000003B
*Apr 21 13:44:07.820:     dot1x_auth_bend Gi1/0/3: during state auth_bend_idle, got event 4(eapReq_authStart)
*Apr 21 13:44:07.820: @@@ dot1x_auth_bend Gi1/0/3: auth_bend_idle -> auth_bend_request
*Apr 21 13:44:07.820: dot1x-sm(Gi1/0/3): 0x0000003B:auth_bend_request_enter called
*Apr 21 13:44:07.820: dot1x-ev(Gi1/0/3): Sending EAPOL packet to group PAE address
*Apr 21 13:44:07.820: dot1x-ev(Gi1/0/3): Role determination not required
*Apr 21 13:44:07.820: dot1x-registry:registry:dot1x_ether_macaddr called
*Apr 21 13:44:07.820: dot1x-ev(Gi1/0/3): Sending out EAPOL packet
*Apr 21 13:44:07.820: EAPOL pak dump Tx
*Apr 21 13:44:07.820: EAPOL Version: 0x3  type: 0x0  length: 0x0005
*Apr 21 13:44:07.820: EAP code: 0x1  id: 0x1  length: 0x0005 type: 0x1
*Apr 21 13:44:07.820: dot1x-packet(Gi1/0/3): EAPOL packet sent to client 0x0000003B (0000.0000.0000)
*Apr 21 13:44:07.820: dot1x-sm(Gi1/0/3): 0x0000003B:auth_bend_idle_request_action called
*Apr 21 13:44:09.791: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/3, changed state to up
*Apr 21 13:44:10.798: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/0/3, changed state to up
*Apr 21 13:44:36.844: dot1x-ev(Gi1/0/3): Interface state changed to DOWN
*Apr 21 13:44:36.844: dot1x-ev(Gi1/0/3): Deleting client 0x0000003B (0000.0000.0000)
*Apr 21 13:44:36.844: dot1x-ev:dot1x_supp_port_down: No DOT1X subblock found on GigabitEthernet1/0/3
*Apr 21 13:44:36.844: dot1x-ev:Delete auth client (0x0000003B) message
*Apr 21 13:44:36.844: dot1x-ev:Auth client ctx destroyed
*Apr 21 13:44:37.842: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/0/3, changed state to down
*Apr 21 13:44:38.841: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/3, changed state to down

Latest Interface Config: interface GigabitEthernet1/0/3 switchport access vlan 105 switchport mode access switchport voice vlan 110 srr-queue bandwidth share 1 30 35 5 priority-queue out authentication control-direction in authentication event fail action next-method authentication host-mode multi-auth authentication open authentication order dot1x mab authentication priority mab dot1x mab mls qos trust device cisco-phone mls qos trust cos auto qos voip cisco-phone dot1x pae authenticator spanning-tree portfast service-policy input AUTOQOS-SRND4-CISCOPHONE-POLICY

Global configs dad

Debugs:

show version
Switch Ports Model              SW Version            SW Image
------ ----- -----              ----------            ----------
*    1 28    WS-C3750G-24PS     15.0(2)SE6            C3750-IPSERVICESK9-M

#show authentication sessions interface gi1/0/3
            Interface:  GigabitEthernet1/0/3
          MAC Address:  Unknown
           IP Address:  Unknown
               Status:  Authz Success
               Domain:  DATA
      Security Policy:  Should Secure
      Security Status:  Unsecure
       Oper host mode:  multi-auth
     Oper control dir:  in
        Authorized By:  Authentication Server
          Vlan Policy:  N/A
      Session timeout:  N/A
         Idle timeout:  N/A
    Common Session ID:  0A6363FE0000001900347F3C
      Acct Session ID:  0x00000020
               Handle:  0x7A00001A

Runnable methods list:
       Method   State
       dot1x    Authc Success
       mab      Not run

#show dot1x all details
Sysauthcontrol              Enabled
Dot1x Protocol Version            3

Dot1x Info for GigabitEthernet1/0/3
-----------------------------------
PAE                       = AUTHENTICATOR
QuietPeriod               = 60
ServerTimeout             = 0
SuppTimeout               = 30
ReAuthMax                 = 2
MaxReq                    = 2
TxPeriod                  = 30

Dot1x Authenticator Client List Empty

show run | in dot1x
aaa authentication dot1x default group RADIUS
dot1x system-auth-control

Console

Oct 15 20:16:41.392: dot1x-ev(Gi1/0/3): Interface state changed to DOWN
Oct 15 20:16:41.400: dot1x-ev(Gi1/0/3): Deleting client 0x74000003 (0000.0000.0000)
Oct 15 20:16:41.400: dot1x-ev:dot1x_supp_port_down: No DOT1X subblock found on GigabitEthernet1/0/3
Oct 15 20:16:41.400: dot1x-ev:Delete auth client (0x74000003) message
Oct 15 20:16:41.400: dot1x-ev:Auth client ctx destroyedshut
Oct 15 20:16:42.180: %SWITCH_QOS_TB-5-TRUST_DEVICE_LOST: cisco-phone no longer detected on port Gi1/0/3, operational port trust state is now untrusted
Oct 15 20:16:43.363: %LINK-5-CHANGED: Interface GigabitEthernet1/0/3, changed state to administratively down
Oct 15 20:16:44.370: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/0/3, changed state tno shut
SW1(config-if)#
Oct 15 20:16:47.801: %ILPOWER-7-DETECT: Interface Gi1/0/3: Power Device detected: IEEE PD
Oct 15 20:16:48.807: %ILPOWER-5-POWER_GRANTED: Interface Gi1/0/3: Power granted
Oct 15 20:16:48.916: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/3, changed state to down
Oct 15 20:16:50.124: dot1x-ev(Gi1/0/3): Interface state changed to UP
Oct 15 20:16:50.133:     dot1x_auth Gi1/0/3: initial state auth_initialize has enter
Oct 15 20:16:50.133: dot1x-sm(Gi1/0/3): 0xD8000004:auth_initialize_enter called
Oct 15 20:16:50.133:     dot1x_auth Gi1/0/3: during state auth_initialize, got event 1(cfg_force_auth)
Oct 15 20:16:50.133: @@@ dot1x_auth Gi1/0/3: auth_initialize -> auth_force_auth
Oct 15 20:16:50.133: dot1x-sm(Gi1/0/3): 0xD8000004:auth_force_auth_enter called
Oct 15 20:16:50.133: dot1x-ev(Gi1/0/3): Sending EAPOL packet to group PAE address
Oct 15 20:16:50.133: dot1x-ev(Gi1/0/3): Role determination not required
Oct 15 20:16:50.133: dot1x-registry:registry:dot1x_ether_macaddr called
Oct 15 20:16:50.133: dot1x-ev(Gi1/0/3): Sending out EAPOL packet
Oct 15 20:16:50.133: EAPOL pak dump Tx
Oct 15 20:16:50.133: EAPOL Version: 0x3  type: 0x0  length: 0x0004
Oct 15 20:16:50.133: EAP code: 0x3  id: 0x1  length: 0x0004
Oct 15 20:16:50.133: dot1x-packet(Gi1/0/3): dot1x_auth_txCannedStatus: EAPOL packet sent to client 0xD8000004 (0000.0000.0000)
Oct 15 20:16:50.133:     dot1x_auth_bend Gi1/0/3: initial state auth_bend_initialize has enter
Oct 15 20:16:50.133: dot1x-sm(Gi1/0/3): 0xD8000004:auth_bend_initialize_enter called
Oct 15 20:16:50.133:     dot1x_auth_bend Gi1/0/3: initial state auth_bend_initialize has idle
Oct 15 20:16:50.133:     dot1x_auth_bend Gi1/0/3: during state auth_bend_initialize, got event 16383(idle)
Oct 15 20:16:50.133: @@@ dot1x_auth_bend Gi1/0/3: auth_bend_initialize -> auth_bend_idle
Oct 15 20:16:50.133: dot1x-sm(Gi1/0/3): 0xD8000004:auth_bend_idle_enter called
Oct 15 20:16:50.133: dot1x-ev(Gi1/0/3): Created a client entry (0xD8000004)
Oct 15 20:16:50.133: dot1x-ev(Gi1/0/3): Dot1x authentication started for 0xD8000004 (0000.0000.0000)
Oct 15 20:16:50.133: dot1x-ev:DOT1X Supplicant not enabled on GigabitEthernet1/0/3
Oct 15 20:16:50.141: dot1x-ev(Gi1/0/3): Sending event (2) to Auth Mgr for 0000.0000.0000
Oct 15 20:16:50.141: dot1x-redundancy: State for client  0000.0000.0000 successfully retrieved
Oct 15 20:16:52.113: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/3, changed state to up
Oct 15 20:16:53.119: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/0/3, changed state to up
Oct 15 20:17:34.542: %SWITCH_QOS_TB-5-TRUST_DEVICE_DETECTED: cisco-phone detected on port Gi1/0/3, port's configured trust state is now operational.

Port still ends up in a shutdown state, but supplies power to Phone...

Improve this question
6
  • Add the following additional commands, this should take care of your issue. Make sure you have your phones MAC on your NPS - "authentication event fail action next-method" - "authentication open" - "authentication priority dot1x mab" - "authentication violation restrict" - "mab" - "dot1x timeout td-period 5"
    – Jaxxs
    Oct 15, 2014 at 0:34
  • Can you post your "sh ver"?
    – Jaxxs
    Oct 15, 2014 at 14:40
  • And can you post your config? Just want to see your global dot1x and AAA.
    – Jaxxs
    Oct 15, 2014 at 15:14
  • Added the latest debugs and the global configs.
    – Jim
    Oct 15, 2014 at 20:22
  • It appears the Cisco 7941 does indeed support dot1x. Need to configure this: Choose Settings > Security Configuration > 802.1X Authentication > Device Authentication. See also EAP-MD5 for the SS in the same menu.
    – Jaxxs
    Oct 16, 2014 at 2:29

4 Answers 4

Reset to default
4

You would need to configure MAB (Mac Auth Bypass) authentication for the ip phone in the multi-vlan interface. You also need multi-auth so the switch knows to look for more than one MAC address.

-authentication host-mode multi-auth

-authentication order mab dot1x

Improve this answer
3
  • mutli-domain or multi-auth? I read that multi-domain is needed if you use two different access and voice vlans?
    – Jim
    Oct 14, 2014 at 19:08
  • When multi-auth is configured, a single authenticated phone is allowed in the voice domain (VLAN), but an unlimited number of data devices can be authenticated in the data domain (VLAN)
    – Jaxxs
    Oct 14, 2014 at 19:19
  • Issuing a "mab" on the interface is all I have to do? Anyone have any good links on how to set this up on the Windows NPS side? Everything I find is for Cisco ACS.
    – Jim
    Oct 14, 2014 at 19:26
5

802.1x is port based. So, in simplest form, the port is either authorized or not; once authorized -- MAC limits aside -- traffic from anything will be allowed. Modern 802.1x systems are much smarter ("more complicated") and can independently police multiple hosts on a single port. This is where multi-auth and multi-domain come in. (consult Cisco here)

As Jaxxs points out, the only compromise is to allow the phone access without authentication (i.e. by MAC.) Because the 7941 won't do 802.1x itself, but will pass EAPOL through, and "fake" a logoff when the PC port is disconnected.

(Ignoring that it's in terms of NX-OS, this is how MAB works.)

Improve this answer
1

CDP should actually take care of the port authentication for an Cisco IP phone. There is a little-known feature called "CDP bypass" which allows a Cisco switch to detect a specific TLV in the CDP message which allows immediate authentication. Be aware however, that newer version of Cisco IOS no longer include this CDP bypass feature.

Improve this answer
1
  • 1
    On the surface cdp bypass sounds like a security vulnerability and a good thing to remove
    – Mike Pennington
    Jan 6, 2015 at 13:53
1

The phone must be able to do CDP. If the switch sees a phone as a CDP neighbor, it will do CDP bypass and will not attempt to authenticate.

Multi-auth is not necessary for a phone. That will allow multiple machines in the data vlan, which is disabled by default and will show "Security Violation" in the logs.

Multi-domain will allow a phone to authenticate.

You should configure authentication order dot1x mab to do attempt dot1x first.

Also add authentication port-control auto.

https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3750x_3560x/software/release/12-2_55_se/configuration/guide/3750xscg/sw8021x.html

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.