Will NAC work with non-Cisco IP phones & the devices behind it

[chalkspray]

I've been told that when you implement Cisco NAC and are using non-Cisco IP phones, the device will authenticate the phone but not the pc plugged into it. Is this true or was it true and if so, is there a fix or a workaround? Nortel has been using this as one of their key points to discourage us from buying all Cisco routers and implementing NAC.

We are using Nortel phone systems right now but they aren't IP based. However, it seems it would be cheaper to upgrade those instead of replacing them with Cisco units.

Thanks!

[chalkspray]

Andy,

I'm not sure how the phone is "authenticated"; you'd think they would have thought of MAC spoofing and have some other sort of test it must pass before just being excluded by the MAC.

Everyone,

The whole reason I started this thread was to find out whether or not the PC BEHIND A NORTEL IP PHONE would be able to access the network without being authenticated. No spoofing, no tricks, just plug in and go. What I've been told (and been unable to find anything to prove otherwise) is that Nortel IP phones are not compatible with Cisco NAC and thus WILL NOT pass through the MAC of the PC to a NAC device. Whereas a Cisco IP phone WOULD pass NAC authentication to the PC. So with a Nortel phone, a PC would be able to connect through a phone at any time and could bypass the NAC policy enforcement all together.

We are planning to move to IP phones (most are IP capable already) and we really don't want to re-run CAT6 to all the workstations so that the phones can use their own line, separate from the PC. Not only that, but we'd have to somehow disable the port on the back of the phone so that users would not be able to bypass authentication by connecting through the phone. I imagine this can be done, but I don't manage our phone system, just the network & servers.

Has anyone tried using Cisco NAC with Nortel or other NON-CISCO IP phones?

[jafrazie]

Let's be clear on this:

The typical goal for the IP Phone is to "remain unauthenticated". So yes, by default, the phone can access the voice-VLAN, and any PC connecting to the phone must "authenticate" via std process.

Of course this presents risk, but it's no worse off than you were BEFORE you had the NAC-Appliance in place to begin with. Also remember, the appliance can logistically only do so much anyway. It's not typically in the business of anti-spoofing prevention or fine-grained access-control. I mean, it may be more than 1-2 hops away anyway.

If you are worried about an attacker spoofing a MAC of a phone, then I would invite you to look at something like 802.1X for your phones, Multi-Domain-Authentication (MDA) on x-Catalyst switches, along with anti-spoofing data-plance protection techniques like DHCP-Snooping, Dynamic ARP Inspection, IP Source-Guard, etc. All this could be done irrespective of the NAC Appliance for data devices BTW.

In summary though, the PC behind a Nortel IP Phone, any other IP Phone, or a PC plugged directly into a switch should get authenticated "much the same way" WRT the NAC Appliance. I'm not sure how Nortel phones are not compatible, since it's outside of the end devices control as to whether a MAC is passed up anyway.

Hope this helps,

[chalkspray]

Thanks for your reply. Andy had brought up the MAC spoofing issue. Although I am concerned with MAC spoofing, I'm not as concerned with it as I am with the NAC appliance being able to cut off the switch port to the PC if the device fails the security check.

Nortel was telling us that Cisco NAC does not support Nortel IP phones and that any PC's connected to those phones would be able to access the network immediately without being authenticated by the NAC device. What you're telling me is that this is not true. Do you have any documentation on Nortel IP phone compatibility?

So far every person I've talked to at Cisco has either not had the answer or has believed that Nortel was correct. In all cases both companies blame the other, which really does nothing for the customer.

[green_andrew]

Hi

I found this on Multi Domain Authentication -

Multi Domain Authentication (MDA)-MDA provides enhanced security for IP phone deployments. This allows an IP phone (Cisco or third-party) and a single host behind the IP phone to independently authenticate using 802.1x. Using this method, a switch can place the host in the data VLAN and IP phone in the voice VLAN, though they appear on the same switch port. Data VLAN can be downloaded from the authentication, authorization, and accounting (AAA) server. For non-802.1x devices, MAC Authentication Bypass (MAB) can be used as the fallback to authenticate using the MAC address of the device. For non-802.1x deployments, MAB can be used to authenticate both IP phones and hosts.

However from my research this is only supported on the Cat 4K, 3750 and 3560... I was hoping for a 65xx solution.

May solve your issue though Chalkspray!

Cheers

Andy

[chalkspray]

Thanks Andy. That's one option, but we really wanted to use the Cisco NAC appliance in our environment as it would be much easier to control our network and would integrate well with our Cisco MARS, IPS, and Firewalls... rather than going to a straight 802.1x solution. Cisco NAC provides so much more. MDA can't decide to not allow a particular PC because of missing patches, because the PC has a virus, or has out of date virus definitions.

802.1x also doesn't work well in environments where there are so many consultants coming in and out each day the company's policy is to not allow ANY network connection (isolated VLAN or not) without being first being checked out by IT personnel.

Additionally, we ran into issues while testing 802.1x where the PC could not be accessed via the network (for patches or remote adminstration) when the user was not logged in to Windows. We were using Windows to pass-through the AD information for 802.1x authentication, rather than going by MAC addresses. Maybe this has been resolved now, but at the time, 802.1x was still fairly new and rarely implemented on wired networks.

So really, I'd love to find out if there's some way to allow complete out-of-band functionality with Cisco NAC using Nortel IP phones. Anyone?

Jeremy

[jafrazie]

A few things here:

* Not sure of any docs demonstrating how the NAC Appliance works with IP-Tel, even3rd party IP-Tel. Suffice it to say though, it's just a MAC address, and you can choose to ignore it on the NAC Appliance if you wish to have IP-Tel interop. Not sure why/how this would even have anything to do with Nortel, per se.

* Multi Domain Authentication (MDA). Yes, it's only supported on the switches listed before (Cat 4K, 3750 and 3560). It's around the corner for the 6500, so please contact your account team for an update.

You should be able use the Cisco NAC appliance in your environment either way.

HTH,

[tim.riegert]

Everything Jason is saying makes sense. You enable mac snmp traps on the switch, so the CAS knows when a new mac address is learned (device has come up, even if it is daisy-chained off an IP phone). However, you must configure a filter to ignore the mac-addresses that contain the Nortel IP phone OUI -- so when an IP phone is plugged in, the CAS ignores it.

From what I understand, the only place where you could have a problem is 6500s, which cannot send the mac traps. They can send linkup/down traps, but you would not receive those traps if there is an IP phone on the switchport that is already up. From what I've been told, this will be fixed when Whitney code is released.