Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
cancel

802.1x Help

I've got a unique setup I'm trying to get set up with regards to 802.1x and have ran into some issues.  I've got Avaya phones that I need to authenticate onto the voice vlan that they are getting via LLDP.  But I'm only using 802.1x to keep things off the voice VLAN which is in a VRF.  The PCs that will either be connected to the back of the phone or plugged directly into the switch cannot be configured for 802.1x as these PCs are not owned by the department.

My idea was to run multi-domain as seems to be the suggestion for phone deployments and then put anything that fails authentication into the Data VLAN (30) using guest-vlan as well as authorizing them to Vlan 30 when authentication fails.  It seems like authentication fail Vlan and guest Vlan cannot be used in multi-domain mode though, so I'm out of ideas and the port is not working properly.  Here is my current config that is not working as it's not putting the PC into Vlan 30 when authentication fails.  Vlan 40 is the voice Vlan. Vlan 30 is the data Vlan.

interface GigabitEthernet1/0/1

description Test 802.1x port

switchport mode access

switchport voice vlan 40

authentication event fail action authorize vlan 30

authentication event server dead action authorize vlan 30

authentication event no-response action authorize vlan 30

authentication host-mode multi-domain

authentication port-control auto

authentication violation restrict

dot1x pae authenticator

dot1x timeout server-timeout 15

dot1x timeout supp-timeout 2

spanning-tree portfast

Any ideas on how I can go about acheiving this?

Thanks,

Brian

Everyone's tags (2)
341
Views
0
Helpful
0
Replies
CreatePlease to create content