9

We are testing currently dot1x auth against FreeRADIUS/AD in the network. The vlans are dynamically assigned by FreeRADIUS on AD-group base. This works, but now the problem comes:

We wanted to add our ip-telephones which doesn't speak dot1x to the network so we created a voice-vlan on the interfaces. This still didn't solve our problems because our ip-telephone came in the guest-vlan.

the interface configuration is the following:

... 
!
interface ethernet 1/g7
 spanning-tree portfast
 switchport mode general
 switchport general allowed vlan add 22 tagged
 dot1x guest-vlan 55
 voice vlan 22
 voice vlan auth disable
...

dot1x mac-auth-bypass also doesn't work because we have a guest vlan configured.

So my question is the following: How do I configure it on a Dell powerconnect 6248p so that my ip telephones will be on the correct vlan and still have my dot1x auth for users and still having a working guest vlan?

Improve this question
3
  • If you disable the dot1x guest vlan does it work? I'm not suggesting a solution, but a troubleshooting step.
    – Avery Abbott
    Nov 12, 2013 at 22:51
  • @AveryAbbott I agree with this troubleshooting step. Ensure LLDP is functioning correctly with the phone and then take baby steps.
    – Ryan Foley
    Jan 12, 2014 at 11:42
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin ♦
    Jan 3, 2021 at 6:09

1 Answer 1

Reset to default
1

The first thing I'd verify is that the phone is actually tagging frames with that VLAN ID, perhaps with a network tap or port mirror (which might not quite work right on this switch)

If you manually had configured the phone to do that and you know it's working, this is probably a bug in the software.

If not, manually set it on the phone or configure LLDP-MED (Link Level Discovery Protocol) on the interface to do this automatically. Depending on the type of phone (this includes most Polycom, Avaya, and Cisco), it should listen for LLDP packets and learn what the voice VLAN tag is and start sending on that tag. 

my-dell-switch(config-if-1/g1)#lldp med
Improve this answer
1
  • And on top of that, I know that cisco switches running dot1x take incompatibilities into consideration and you can "whitelist" services on a dot1x port before the auth happens (with an acl of course) dell should support a similar feature that could help in this situation
    – John Kennedy
    Dec 13, 2013 at 0:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.