IP Phone and 802.1x

markjiang · ‎10-27-2009

We have implemented 802.1x in our company.There is a problem about inputting the 802.1x code.

Because we don't want end users to get the 802.1x code,so we have to input 802.1x for every phone.And inputting 802.1x code is a hard work.

Is there any way of inputting 802.1x code without operating on every phone?

Jonathan Schulenberg · ‎10-27-2009

No; however, if you use certificates instead of manual credentials you can trust the MIC to get the phone bootstrapped (firmware downloaded, registered, CAPF enrolled) by having ACS put it in a limited access VLAN. Once it has generated it's LSC you can then have ACS move it to "normal" voice VLAN.

markjiang · ‎10-27-2009

Hi,j.schulenberg ,

Thanks for your reply.

Do you mean that We can not use BAT or any other method to config the 802.1x code for phones

Jonathan Schulenberg · ‎10-28-2009

No for at least two reasons:

1) There is no where on the device configuration to enter 802.1x credentials, only to enable/disable it.

2) How would the phone get this information from the TFTP server if it can't get on the network in the first place?

jleon22 · ‎05-13-2010

Hi Jason,

This is exactly what we are trying to do as well. Would you happen to know of any documents that goes through that procedure that you mentioned? Basically, we want to use ACS 5.x to authenticate phone certs to allow it onto the voice vlan.

regards,

johnny

greg.fuller · ‎07-21-2010

Anyone figure out how to do this? I'd like to use the MIC on each phone to validate agains the CommonName field of the certificate (which should be CP-{model #}-{MAC address}) via EAP-TLS. I'm using a 3rd party RADIUS server (radiator). I have it setup but keep getting certificate errors. Should RADIUS be sending back a certificate to the phone? I thought I could just validate the CommonName field of the MIC cert that the phone sends to RADIUS but it looks like I have to have a server side certificate installed (I do have the Cisco crca2048.crt and cmca.crt CA's installed in radiator).

--greg

jleon22 · ‎07-21-2010

Hi Greg,

In my research, I came across this document that explains in pretty good detail the requirements for enabling 802.1x for phones using ACS.

http://www.cisco.com/en/US/prod/collateral/iosswrel/ps6537/ps6586/ps6638/config_guide_c17-605524.html

regards,

johnny