Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

802.1x with Vlan assignment and IP phone and PC

I have a Catalyst 4510R and I want to im plement 802.1x with dynamic VLAN assignment via Radius server. I am going to plug to switch ports Cisco IP phones and PCs (PCs are plugged in the IP phone).

For this implementation I need to configure the switch port in mode trunk because I have voice vlan corresponding IP phone and data vlan corresponding to PC.

However I have read that I can not enable 802.1x on a trunk port.

How could I configure this?

I need that when the PC is authenticated correctly is assigned to his cooresponding data vlan and the IP phone is in the voice vlan.


Cisco Employee

Re: 802.1x with Vlan assignment and IP phone and PC

You should configure the port as an access port with an aux-vlan. Here's an example:


interface GigabitEthernet2/2

switchport access vlan 701

switchport mode access

switchport voice vlan 702

load-interval 30

qos trust device cisco-phone

qos trust cos

auto qos voip cisco-phone

dot1x pae authenticator

dot1x port-control auto

tx-queue 3

bandwidth percent 33

priority high

shape percent 33

spanning-tree portfast

spanning-tree bpduguard enable

service-policy output autoqos-voip-policy

Hope this helps,

New Member

Re: 802.1x with Vlan assignment and IP phone and PC

Thanks for your help and for your example.

I have one question about this.

In the configuration example if you put "switchport access vlan 701" you are forcing the PC which is plugged to the Cisco IP Phone to be assigned to the data vlan 701 and I would like that this dynamic assignment was done for Microsoft IAS (Radius server) ,previously configured, according to the username and password set.

Cisco Employee

Re: 802.1x with Vlan assignment and IP phone and PC

It doesn't matter either way. If you put "switchport access vlan 701" on the port, that just means 701 is whats configured. You can configure a VLAN from RADIUS with this just fine. It can be the same VLAN, a different VLAN, etc.

If you didn't have "switchport access vlan 701" configured, then you might as well have "switchport access vlan 1" configured anyway (which is the default, and wouldn't be recommended from a security best-practice anyway).

Hoep this helps,