802.1x / Avaya IP phone

[tckoon]

Would like to know this kind of setup it is possible. Avaya IP phone connect to Catalyst 4500 switch and the switch port is configure with 802.1x authentication , the PC is attached to Avaya IP phone. Does it cause IP phone force to authenticate ?

Regards

[gpulos]

ip phones are authorized to join the voice VLAN without 802.1x authentication.

please see this link for more info:

http://www.cisco.com/en/US/products/sw/voicesw/ps556/products_security_notice09186a008048e0d6.html

[kleo]

Also make sure you are running avaya phone firmware 2.3 or newer. Firmware 2.3 includes the ability of (EAPOL) packet forwarding from behind the phone for 802.1x pc connectivity.

[andrew.butterworth]

If they are Cisco IP Phones (or IP Phones that support Voice VLAN discovery via CDP - I know the Mitel ones do) or you manually hard-code the Voice VLAN Tag on the IP Phone.

If the Avaya IP Phones discover the Voice VLAN Tag by DHCP Vendor Options obtained initially from leasing an IP address in the Access VLAN then you might struggle.

It may be possible to use the 802.1x Guest VLAN function and secure the Guest VLAN so you can only access DHCP (and possibly a boot server to obtain configuration information).

HTH

Andy

[kleo]

good point andrew! I had to hard set my avaya phones with voice vlan for it to work in my 802.1x enviorments.

[tckoon]

Hi,

I had setup but it does not work, IP phone is able to work but 802.1x for pc is failed.

Appreciate you can share the config on the switch port and the setting of the Avaya phone about setting the voice vlan.

Thanks in advance.

[kleo]

IP phone must be 2.3 firmware or newer to allow 802.1x pass-thru for pc.

ftp://ftp.avaya.com/incoming/Up1cku9/tsoweb/ip_telephone/040706/46xxH323_040706.zip