dot1x with PoE

[rdamaso]

Hi,

In my network I use 7940 IP Phone switchport to plug the computers. I have configured dot1x authentication ( with ACS ) into my 4503 to delivery vlan and ACLs to customers.

How can I enable dot1x on a interface with PoE??

When I do it, the Phone is shutdown.

Tks.

[gpulos]

you can use the 'dot1x' commands:

ie:

4503(config)# interface F2/1

4503(config-if)# dot1x initialize

4503(config-if)# dot1x default

this would 'initialize' the port, unauthorize it, and then setup the port for dot1x with default values.

please see the following link for more 4500 Dot1X configuration info:

http://www.cisco.com/en/US/products/hw/switches/ps4324/products_command_reference_chapter09186a00804fb266.html

(under the dot1x section of commands)

[rdamaso]

Greg,

I'm having problems enabling dot1x on the IP Phone interface, the IP Phone goes to shutdown. That way, I can't authenticate my machine with dot1x, because my computer is connected to the IP Phone wich is down.

The computer LAN is (also?) down.

See my interface config:

interface FastEthernet2/10

description Estacao Fernando Reis

switchport mode access

logging event link-status

dot1x port-control auto

dot1x timeout quiet-period 5

dot1x timeout tx-period 15

dot1x max-reauth-req 10

dot1x guest-vlan 6

spanning-tree portfast

I don't have any problems with the stations that are directly connected to switch.

tks

[gpulos]

it seems you may be missing a command.

try and add the 'dot1x multiple-hosts' command to the interface configuration shown above.

this will allow multiple hosts to be attached to a single dot1x enabled port.

(only one host needs to authenticate successfully for all hosts to be granted access to the network)

(if the port becomes unauthorized, all hosts connected to that port will be denied network access)

please see the following link for more info on the dot1x multiple-hosts command:

http://www.cisco.com/en/US/products/hw/switches/ps628/products_configuration_guide_chapter09186a008007e8c4.html#xtocid16

[htrinco]

You need a voice vlan.

create the voice vlan and put this line in the interface:

switchport voice vlan XX