Hello Rogelio

Can you check this on you configration:

1. Remove authentication open from port config

2. Add ACL (some general ACL with few entries) to port

3. Add ip device tracking to global config

4. After authentication check following: sh ip acccess-l and sh ip access-l int fax/x. If output from second command is empty try execute sh auth session int fax/x detail. Switch should correctly recognize ip address for ip phone and PC. If not this is a bug in IOS.

Regards,

Stas

Hello Stan, thank you very much for your advice.

I will check on this tomorrow when I test in the customer site, and let you know.

Best regards,

Hello Stas:

I tested as suggested, without success. Basically, I removed the "authentication open" command, added an ACL to the port (permit ip any any), and the "ip device tracking" command.

Now the switch failed to authorize BOTH ports (PC and Phone). Just in case of interest:

1. The output of the "show ip access-list interface Fa0/6" commands is empty

2. The output of the "show auth session int fa 0/6" command is the following

Switch# sh auth session int fa0/6
            Interface:  FastEthernet0/6
            MAC Address:  Unknown
            IP Address:  Unknown
            User-Name:  UNRESPONSIVE
               Status:  Authz Success
               Domain:  DATA
           Security Policy:  Should Secure
           Security Status:  Unsecure
           Oper host mode:  multi-host
           Oper control dir:  both
           Authorized By:  Guest Vlan
          Vlan Policy:  701
          Session timeout:  N/A
         Idle timeout:  N/A
    Common Session ID:  0A01460A0000009814F3D712
      Acct Session ID:  0x000000A2
               Handle:  0xAB000098

Runnable methods list:
       Method   State
       dot1x    Failed over

Switch#

Finally, I collecte a set of syslog messages, just in case someone would like to take a look. 001e.138c.5bf5 is the Phone`s MAC.

Thank you very much.

Regards, Rogelio

Hello Rogelio

Could you also remove from fa0/6 following strings:

authentication event fail action next-method
authentication event server dead action authorize vlan 704
authentication event no-response action authorize vlan 701

authentication periodic

Also if you can't use Downloadable ACL please remove ACL from fa0/6.

Next chek port settings. In output from sh auth sess int fa0/6 Oper host mode is multi-host. This is incorrect. It should be multi-domain.

Next in first message you wrote that you have phone and PC behind phone. How you phone authenticated? By dot1x or MAB? In multidomain mode ACS should provide for switch av-pair for voice vlan.

Example from 3750 with MAB for phone and open auth for PC

sh authentication sessions interface gigabitEthernet 3/0/1
          Interface:  GigabitEthernet3/0/1
          MAC Address:  0001.0001.0001
           IP Address:   x.x.x.x
            User-Name:  000100010001
               Status:  Authz Success
               Domain:  VOICE
      Security Policy:  Should Secure
      Security Status:  Unsecure
       Oper host mode:  multi-domain
     Oper control dir:  both
        Authorized By:  Authentication Server
      Session timeout:  N/A
         Idle timeout:  N/A
    Common Session ID:  AC112E6A000002B5DA302795
      Acct Session ID:  0x000007AE
               Handle:  0x590002B5

Runnable methods list:
       Method   State
       dot1x    Failed over
       mab      Authc Success

Regards,

Stas

Hello Stas:

I am also confused about the output of the switch, since the configuration of the port says "multidomain".I will start it over from zero and let you know the results.

With respect to the phone, I am authenticating it with 802.1X. This works OK. I am not using MAB for it.

I have never used Downloadable ACLs. Instead, I have been using Cisco avpairs ip:inacl#xx=permit ip . They work OK when not in multidomain.

I plan to visit the customer site in two or three days. I will let you know as soon as I get new output.

Thank you for your support.

Rogelio

HI,

I have experiensed the same problem and it has to be a BUG, I have a C4506 with gig access-ports, I have ACS5.1 and Cisco 7940 phones, if i run multi-host it works fine but then i have security issues, if i switch to multi-domain al looks fine (success in ACS loggs and debug output) but the phone and client are not able to communicate (ex can´t ping the default gw), the phone and client recieves an ip address.

I have logged a case at cisco TAC and are wating for an answer.

/Magnus

Did you ever get an answer for this?

Hello

Bug with Multi Domain Authentication was fixed in Catalyst IOS since 12.5.50SE5 (Oct, 2010). I think most IOS's released after Oct,2010 include fix, but for me problem in 3750-48PSS was gone after I updated to 12.2.50SE5

Stas