802.1X authentication not working on Client Machines if connected through Cisco IP phone

Question

I trying to do 802.1x authentication with certificates. I am stuck with a problem client machine which fails to communicate with the RADIUS server (NPS) when I connect it through a Cisco IP phone.

The problem goes away if I directly connect the client to the switch port. The NPS server allows the connection to establish if it has a required certificate .

1. The NAP enabled Switch port connects to Cisco IP phone, and from there the connection goes to client machine (this is not working). The IP phone works, but not the LAN on client computer
2. Switch port directly connects to client computer (this is working as intended). The client computer talks to the NPS server.

The interesting thing here is that after establishing the connection once, the first setting which was not working does work until the computer is restarted .

Switch Configuration

aaa group server radius radius-dot1x-group
server-private 192.168.22.122 auth-port 1812 acct-port 1813 key 7 02090A5904071!
aaa authentication dot1x default group radius-dot1x-group
aaa authorization console
aaa authorization network default group radius-dot1x-group

Configuration on Port

interface FastEthernet0/21
switchport access vlan 20
switchport mode access
switchport voice vlan 40
speed 100
duplex full
authentication port-control auto
authentication periodic
authentication timer reauthenticate server
dot1x pae authenticator
spanning-tree portfast

Answer 1

Setting up 802.1x through a phone is a complicated mess.

See the "Device Behind Phone Authenticates" section of Cisco's guide:

If the data device is not ready to or not capable of performing IEEE 802.lX, the switch times out and continue to the next authentication method, such as MAB, and/or authorization type, such as Guest VLAN. If the device later becomes capable of performing 802.1X, perhaps because the operating system finished booting or a supplicant was manually enabled, the data device should send an EAPoL-Start message to explicitly tell the switch to begin authentication.

Perhaps your PC systems need to be configured to send EAPOL-Start messages explicitly. (most systems don't by default.)

(Note: that document is, of course, w.r.t. Cisco's switches.)

Answer 2

You don't say if the Cisco phone has a certificate on it as well. If it doesn't, you may have to try to enable IEEE 802.1X multiple authentication - this lets you designate a VoIP LAN and have hosts on that authenticate via MAC address, while the PC still authenticates via certificate. We had a similar problem with mini-switches plugged into 802.1x ports - if any device on the mini-switch couldn't authenticate (like, you know, a printer) the whole port would shut down. If the phone does have a cert, you still need multiple authentication turned on, it's just much easier to configure.

Cisco's docs on multiple authentication start at http://www.cisco.com/en/US/docs/ios-xml/ios/sec_usr_8021x/configuration/15-2mt/sec-ieee-802x-multi-auth.html#GUID-ECD4BDFA-0AA3-4474-BA56-35342811E9E6

Answer 3

The process work like that

When i start the PC and login in .

Unable to authenticate,from their i disabled the network card.

Now I enable the Network card

This time their will be no problem in NAP authentication it works fine