3

We have 50+ Juniper EX3300 switches with access points configured to work with dot1x and voice vlan.

We also have a variety of Yealink T23G, T42G, T26G and T48G phones that worked perfectly in our configuration when the switches were operating on JunOS version 12.3R6.6.

After upgrade to 15.1R6.7, the voice vlan function degraded. While the ports are still being served the correct tagged vlan, phones are no longer attempting to communicate over it and are not able to get a DHCP reply for the address.

We are in no luck so far in finding a solution to this problem, or even a fair diagnosis.

Configuration

interfaces {
    interface-range access-dot1x {
        member "ge-0/0/[0-47]";
        member "ge-1/0/[0-47]";
        member "ge-2/0/[0-47]";
        description access-dot1x;
        unit 0 {
            family ethernet-switching;
        }
    }
}
protocols {
    dot1x {
        authenticator {
            authentication-profile-name DOT1X-NPS;
            interface {
                access-dot1x {
                    supplicant multiple;
                    retries 2;
                    quiet-period 2;
                    transmit-period 2;
                    mac-radius;
                    reauthentication 32400;
                    supplicant-timeout 2;
                    server-timeout 10;
                    maximum-requests 2;
                    guest-vlan ZEROCONFIG;
                    server-reject-vlan ZEROCONFIG;
                    server-fail use-cache;
                }
            }
        }
    }
    lldp {
        interface all;
    }
    lldp-med {
        interface all;
    }
}
ethernet-switching-options {
    voip {
        interface access-dot1x {
            vlan DEV-VOIP;
            forwarding-class assured-forwarding;
        }
    }
}
ZEROCONFIG {
    vlan-id 2;
}
DEV-VOIP {
    vlan-id 14;
}

Diagnostics

After discovering the issue we have built an additional test environment to test two firmware versions with all kinds of Yealink phones. We have no phones from other vendors, but within this vendor, all phones were affected, including a variety of firmware versions.

Simmilarities:

Both versions return identical output on following commands:

> show ethernet-switching interface ge-0/0/6
Interface    State  VLAN members        Tag   Tagging  Blocking
ge-0/0/6.0   up     ADM-CSI             130   untagged unblocked
                    ZEROCONFIG          2     untagged unblocked
                    default                   untagged unblocked
                    DEV-VOIP            14    tagged   unblocked

Also with this command, but only regarding the interface list:

> show lldp detail
Interface      Parent Interface    Vlan-id     Vlan-name
ge-0/0/6.0     -                   130         ADM-CSI
ge-0/0/6.0     -                   14          DEV-VOIP
ge-0/0/6.0     -                   2           ZEROCONFIG

Differences:

A proper connection on 12.3R6.6 results in a following output:

> show ethernet-switching table interface ge-0/0/6
Ethernet-switching table: 3 unicast entries
  VLAN              MAC address       Type         Age Interfaces
  ADM-CSI           *                 Flood          - All-members
  ADM-CSI           98:5a:eb:xx:xx:4d Learn          0 ge-0/0/6.0   # computer connected via phone, dot1x assigned VLAN
  DEV-VOIP          *                 Flood          - All-members
  DEV-VOIP          00:15:65:yy:yy:0d Learn          0 ge-0/0/6.0   # phone after voice-vlan was assigned
  ZEROCONFIG        *                 Flood          - All-members
  ZEROCONFIG        00:15:65:yy:yy:0d Learn         50 ge-0/0/6.0   # phone before voice-vlan was assigned
  default           *                 Flood          - All-members


> show lldp neighbors
Local Interface    Parent Interface    Chassis Id          Port info          System Name
ge-0/0/6.0         -                   10.14.100.2         WAN PORT           SIP-T42G

A failed connection on 15.1R6.7 results in a following output:

> show ethernet-switching table interface ge-0/0/6
Ethernet-switching table: 3 unicast entries
  VLAN              MAC address       Type         Age Interfaces
  ADM-CSI           *                 Flood          - All-members
  ADM-CSI           98:5a:eb:xx:xx:4d Learn          0 ge-0/0/6.0   # computer connected via phone, dot1x assigned VLAN
  DEV-VOIP          *                 Flood          - All-members
  ZEROCONFIG        *                 Flood          - All-members
  ZEROCONFIG        00:15:65:yy:yy:0d Learn         50 ge-0/0/6.0   # phone before voice-vlan was assigned
  default           *                 Flood          - All-members

> show lldp neighbors
Local Interface    Parent Interface    Chassis Id          Port info          System Name
ge-0/0/6.0         -                   0.0.0.0             WAN PORT           SIP-T42G

There is however a difference in notification interval (lldp-configuration-notification-interval) value:

  • on 12.3R6.6 the value (default) is 0s, configurable in 0..3600 range,
  • on 15.1R6.7 the value (default) is 5s, configurable in 5..3600 range.

I was hoping this difference in notification interval will be the cause of our problem, yet setting the value to 5 on earlier switch did not cause it to degrade the functionality.

Yet another, and maybe the most significant difference appears in the LLDP and EAPOL packages exchanged by the party.

This begins with following differences in the first package send from device to phone:

Proper session (12.3R6.6):

14:13:50.002710 Out LLDP, length 266
    [...]
    System Description TLV (6), length 89
      Juniper Networks, Inc. ex3300-48t , version 12.3R6.6 Build date: 2014-03-13 07:02:54 UTC
    [...]
    Organization specific TLV (127), length 9: OUI IEEE 802.3 Private (0x00120f)
      MAC/PHY configuration/status Subtype (1)
        autonegotiation [supported, enabled] (0x03)
        # ==== HERE =====
        PMD autoneg capability [Sym PAUSE for fdx] (0x0400) 
        MAU type Unknown (0x0000)
    [...]
    Organization specific TLV (127), length 6: OUI Ethernet bridged (0x0080c2)
      Port Vlan-ID Subtype (1)
        # ==== HERE =====
        Vlan Id: 14
    [...]
    Organization specific TLV (127), length 15: OUI Ethernet bridged (0x0080c2)
      Vlan Name Subtype (3)
        Vlan Id: 14
        Vlan Name: DEV-VOIP
    Organization specific TLV (127), length 14: OUI Ethernet bridged (0x0080c2)
      Vlan Name Subtype (3)
        Vlan Id: 0
        Vlan Name: default
    Organization specific TLV (127), length 12: OUI Ethernet bridged (0x0080c2)
      Vlan Name Subtype (3)
        Vlan Id: 14
        Vlan Name: voice
    [...]
    Organization specific TLV (127), length 8: OUI ANSI/TIA (0x0012bb)
      Network policy Subtype (2)
        Application type [voice] (0x01), Flags [Tagged]
        Vlan id 14, L2 priority 0, DSCP value 0
    End TLV (0), length 0

Failed session (15.1R6.7):

14:04:52.612890 Out LLDP, length 333
    [...]
    System Description TLV (6), length 156
      Juniper Networks, Inc. ex3300-48t Ethernet Switch, kernel JUNOS 15.1R6.7, Build date: 2017-04-23 00:39:39 UTC Copyright (c) 1996-2017 Juniper Networks, Inc.
    [...]
    Organization specific TLV (127), length 9: OUI IEEE 802.3 Private (0x00120f)
      MAC/PHY configuration/status Subtype (1)
        autonegotiation [supported, enabled] (0x03)
        # ==== HERE =====
        PMD autoneg capability [1000BASE-T fdx] (0x0001)
        MAU type Unknown (0x0000)
    [...]   
    Organization specific TLV (127), length 6: OUI Ethernet bridged (0x0080c2)
      Port Vlan-ID Subtype (1)
        # ==== HERE =====
        Vlan Id: 0
    [...]
    Organization specific TLV (127), length 15: OUI Ethernet bridged (0x0080c2)
      Vlan Name Subtype (3)
        Vlan Id: 14 
        Vlan Name: DEV-VOIP
    Organization specific TLV (127), length 14: OUI Ethernet bridged (0x0080c2)
      Vlan Name Subtype (3)
        Vlan Id: 0
        Vlan Name: default
    Organization specific TLV (127), length 12: OUI Ethernet bridged (0x0080c2)
      Vlan Name Subtype (3)
        Vlan Id: 14
        Vlan Name: voice
    [...]
    Organization specific TLV (127), length 8: OUI ANSI/TIA (0x0012bb)
      Network policy Subtype (2)
        Application type [voice] (0x01), Flags [Tagged]
        Vlan id 14, L2 priority 0, DSCP value 0
    End TLV (0), length 0

Any ideas?

Improve this question
6
  • A couple questions, can you paste in your RADIUS and DHCP configuration? Can you paste the output of "show system processes extensive | match jdhcpd" as well as "show log messages | match jhdcpd". Also, how long has this device been up?
    – Jordan Head
    Oct 19, 2017 at 13:45
  • RADIUS and DHCP configuration is not exactly pastable, since it's Win2016. DHCP configuration is simple and does not use embedded voice-vlan option. RADIUS configuration is also simple and has no rule that could return DEV-VOIP vlan 14.
    – Michał Sacharewicz
    Oct 19, 2017 at 14:01
  • > show system processes extensive | match jdhcpd 1322 root 1 40 0 90348K 14860K select 32:02 0.00% jdhcpd
    – Michał Sacharewicz
    Oct 19, 2017 at 14:02
  • And the log does not exist.
    – Michał Sacharewicz
    Oct 19, 2017 at 14:04
  • Thanks for checking that, just wanted to rule out something I had seen before. Can you add your interface and vlan configuration to the question? There were pretty significant changes between 12 and 15 to how some things work, assuming you haven't already ruled those out.
    – Jordan Head
    Oct 20, 2017 at 13:33

1 Answer 1

Reset to default
1

Hinted by our reseller, I've found this article hidden quite deep in Juniper docs, which states that in versions above 14.1X53-D40 / 15.1R4, due to security considerations, switch behavior has changed.

  • With older firmware, switches would allow access to voice VLAN regardless of 802.1x authentication status on the port.
  • In new firmware, switches will block access to voice VLAN:
    • if the 802.1x authentication server fails (this behavior can be overriden with server-fail-voip statement in dot1x profile), or:
    • if the 802.1x authentication server rejects the authentication (this behavior cannot be overriden).

As of now, there seems to be no opt-out for the latter case, but I will update this answer if this ever changes.

There seems to be no feasible workaround for the problem, other than perhaps authenticating the unknown devices to guest VLAN instead of rejecting them. This might be done either by:

  • populating authentication database with phone MAC addresses (with mac-radius),
  • configuring phone credentials for 802.1x authentication, or
  • creating a tightly scoped finishing RADIUS rule that would accept all unmatched devices without authentication and assign them to GUEST VLAN.

Relevant fragment of Juniper article:

Server fail fallback is supported for voice traffic starting in Release 14.1X53-D40 and Release 15.1R4. To configure server fail fallback actions for VoIP clients sending voice traffic, use the server-fail-voip statement. For all data traffic, use the server-fail statement. The switch determines the fallback method to use based on the type of traffic sent by the client. Untagged data frames are subject to the action configured with server-fail, even if they are sent by a VoIP client. Tagged VoIP VLAN frames are subject to the action configured with server-fail-voip. If server-fail-voip is not configured, the voice traffic is dropped.

Note: Server reject fallback is not supported for VoIP VLAN tagged traffic. If a VoIP client starts authentication by sending untagged data traffic to a VLAN while server reject fallback is in effect, the VoIP client is allowed to access the fallback VLAN. If the same client subsequently sends tagged voice traffic, the voice traffic is dropped. If a VoIP client starts authentication by sending tagged voice traffic while server reject fallback is in effect, the VoIP client is denied access to the fallback VLAN.

Improve this answer
2
  • You should accept your answer so that the question doesn't keep popping up forever, looking for an answer.
    – Ron Maupin ♦
    Nov 3, 2017 at 15:32
  • I thought it was not eligible to accept it for two days upon self-answering. Fixed.
    – Michał Sacharewicz
    Nov 3, 2017 at 15:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.