# 802.1X authentication not working on Client Machines if connected through Cisco IP phone

I trying to do 802.1x authentication with certificates. I am stuck with a problem client machine which fails to communicate with the RADIUS server (NPS) when I connect it through a Cisco IP phone.

The problem goes away if I directly connect the client to the switch port. The NPS server allows the connection to establish if it has a required certificate .

1. The NAP enabled Switch port connects to Cisco IP phone, and from there the connection goes to client machine (this is not working). The IP phone works, but not the LAN on client computer
2. Switch port directly connects to client computer (this is working as intended). The client computer talks to the NPS server.

The interesting thing here is that after establishing the connection once, the first setting which was not working does work until the computer is restarted .

Switch Configuration

aaa group server radius radius-dot1x-group
server-private 192.168.22.122 auth-port 1812 acct-port 1813 key 7 02090A5904071!
aaa authentication dot1x default group radius-dot1x-group
aaa authorization console
aaa authorization network default group radius-dot1x-group


Configuration on Port

interface FastEthernet0/21
switchport access vlan 20
switchport mode access
switchport voice vlan 40
speed 100
duplex full
authentication port-control auto
authentication periodic
authentication timer reauthenticate server
dot1x pae authenticator
spanning-tree portfast

• I do not intend to use certificates for the IP phones(200 plus IP phones). Just want to allow it with a data port. I have tried the setting with newer version of IP phone 7960 Series . It still does not work when i restart the computer but if i disable the network adapter on windows 7 client machine and enable it. It work perfectly fine. Again if i restart the client machine it will not work. – user21842 Jan 8 '16 at 8:06

Setting up 802.1x through a phone is a complicated mess.

See the "Device Behind Phone Authenticates" section of Cisco's guide:

If the data device is not ready to or not capable of performing IEEE 802.lX, the switch times out and continue to the next authentication method, such as MAB, and/or authorization type, such as Guest VLAN. If the device later becomes capable of performing 802.1X, perhaps because the operating system finished booting or a supplicant was manually enabled, the data device should send an EAPoL-Start message to explicitly tell the switch to begin authentication.

Perhaps your PC systems need to be configured to send EAPOL-Start messages explicitly. (most systems don't by default.)

(Note: that document is, of course, w.r.t. Cisco's switches.)

You don't say if the Cisco phone has a certificate on it as well. If it doesn't, you may have to try to enable IEEE 802.1X multiple authentication - this lets you designate a VoIP LAN and have hosts on that authenticate via MAC address, while the PC still authenticates via certificate. We had a similar problem with mini-switches plugged into 802.1x ports - if any device on the mini-switch couldn't authenticate (like, you know, a printer) the whole port would shut down. If the phone does have a cert, you still need multiple authentication turned on, it's just much easier to configure.

Cisco's docs on multiple authentication start at http://www.cisco.com/en/US/docs/ios-xml/ios/sec_usr_8021x/configuration/15-2mt/sec-ieee-802x-multi-auth.html#GUID-ECD4BDFA-0AA3-4474-BA56-35342811E9E6

The process work like that

When i start the PC and login in .

Unable to authenticate,from their i disabled the network card.

Now I enable the Network card

This time their will be no problem in NAP authentication it works fine

• Disabling, the re-enabling, a PC NIC to get connected is a real kludge, and end-users should net be expected to do this the get connected to the network. An end-user may not have that control over the PC due to policy restriction, and most probably don't have the knowledge on how to perform such actions. – Ron Maupin Jan 8 '16 at 16:05
• Yes true that is what i am trying to resolve. Now i will try to capture network through wire shark see if it could tell me any thing – user21842 Jan 11 '16 at 5:34
• The situation goes like that all the process working fine with the newer version of IP phones but for the older version it is still the same no resolution. – user21842 Jan 22 '16 at 8:26