SG300 does not accept Cisco-Avpair device-traffic-class vor voice vlan and radius

Mar tin · ‎04-15-2014

Hello,

i am using a Cisco SG300MP router and want to authenticate a phone with MAB + use dynamic voice vlan. The phone should tag its packets in the correct voice lan that are received for this phone from the radius server via MAB. As radius server I used MS IAS and also Freeradius.

I can see in the wireshark trace that the correct attribute is sent in the "Access-Accept" Message.

AVP: l=34 t=Vendor-Specific(26) v=ciscoSystems(9)

VSA: l=28 t=Cisco-AVPair(1): device-traffic-class=voice

But Cisco does not set up a voice vlan (via lldp). Instead cisco writes in log:

%AAAEAP-W-RADIUSREPLY: Invalid attribute 26 ignored - vendor is is not Microsoft

and interprets the vlan attributes in radius as data vlan.

What I am doing wrong? The log messages makes no sense at all?

Regards Martin

Brandon Svec · ‎04-15-2014

Did you create your voice VLAN and turn it on?

i.e.

vlan database

vlan 100

exit

voice vlan id 100

besides that what type of phone are you using?

Did you look at show lldp neighbors output or maybe show cdp neighbors output?

It may be helpful to share your switch config too.

-- please remember to rate and mark answered helpful posts --

Mar tin · ‎04-16-2014

Hallo Brandon,

I attach the cisco config. Voice Vlan is 200 for default and I want to have 170 via dynamic vlan assignment.

I use a snom phone which correctly tags the default voice vlan 200 (before MAB). I expect now that the switch grants access via MAB and sends an LLDP with voice vlan 170. Instead he untags data 170.

In LLDP-Neighbours I see that the phone is recognized as Voice Device in Default Voice Vlan 200.

In the end I assume that maybe ths SG300 is not supported for dynamic voice vlan assignment via MAB? But why then this weird log message.

Regards Martin

Brandon Svec · ‎04-16-2014

I see. I don't think I know enough about MAB to help you further. I thought by dynamic VLAN assignment you were referring to how the phone gets its voice VLAN. I wanted to see if I could help ensure your phone was at least getting voice VLAN via lldp and it seems it is.

Don't give up though. I did a quick search and saw this: http://www.cisco.com/c/en/us/products/collateral/switches/small-business-smart-switches/data_sheet_c78-610061.html

In the product specs table there is stated support for: Dynamic VLAN assignment via Radius server along with 802.1x client authentication

-- please remember to rate and mark answered helpful posts --

Mar tin · ‎04-16-2014

Hi,

phone gets the default voice vlan but not the dynamic voice via radius or lets say he ignores that this dynamic vlan is for voice.

"Dynamic VLAN assignment via Radius server along with 802.1x client authentication"

--> as see above it works wor data

He just ignores CiscoAVPair Attribute...even when its a cisco one...

SG300 does not accept Cisco-Avpair device-traffic-class vor voice vlan and radius

Cisco Business Product Family

Cisco Switching Product Family