Avaya 9600 Series - Part 6: Other Features

Note:
If the Ethernet line interface link fails, the 802.1X Supplicant, if enabled, enters the
Disconnected state.
Related links
802.1X supplicant operation on page 111
802.1X supplicant operation
9600 Series IP Deskphones that support supplicant operation also support Extensible
Authentication Protocol (EAP). For software Release 6.1 and earlier, only the MD5-Challenge
authentication method is supported. For more information about the MD5–Challenge
authentication, see IETF RFC 3748.
A supplicant identity (ID) and password of not more than 12 numeric characters are stored in
reprogrammable non-volatile memory. The phone software downloads do not overwrite the ID and
password. The default ID is the MAC address of the phone, converted to ASCII format without
colon separators, and the default password is null. Both the ID and password are set to default
values at manufacture. EAP-Response/Identity frames use the ID in the Type-Data field. EAP-
Response/MD5-Challenge frames use the password to compute the digest for the Value field,
leaving the Name field blank.
When you install a phone for the first time and 802.1x is in effect, the dynamic address process
prompts the installer to enter the supplicant identity and password. The IP phone does not accept
null value passwords.
The IP deskphone stores 802.1X credentials when the phone achieves successful authentication.
Post-installation authentication attempts occur using the stored 802.1X credentials, without
prompting the user for ID and password entry.
An IP deskphone can support several different 802.1X authentication scenarios, depending on the
capabilities of the Ethernet data switch to which the deskphone is connected. Some switches
might authenticate only a single device per switch port. This operation is known as single-
supplicant or port-based operation. These switches usually send multicast 802.1X packets to
authenticating devices.
These switches support the following three scenarios:
• Standalone phone (Deskphone Only Authenticates) - When you configure the IP phone for
supplicant mode (DOT1XSTAT=2), the phone can support authentication from the switch.
• Phone with attached PC (Deskphone Only Authenticates) - When you configure the IP phone
for supplicant mode (DOT1X=2 and DOT1XSTAT=2), the phone can support authentication
from the switch. The attached computer in this scenario gains access to the network without
being authenticated.
• Deskphone with attached computer (PC Only Authenticates) - When the IPdeskphone is
configured for Pass-Through Mode or Pass-Through Mode with Logoff (DOT1X=0 or 1 and
DOT1XSTAT=0), an attached PC running 802.1X supplicant software can be authenticated
by the data switch. The phone in this scenario gains access to the network without
authentication.
Administering Deskphone Options
March 2018 Administering Avaya 9608/9608G/9611G/9621G/9641G/9641GS IP Deskphones H.
323 111
Comments on this document? infodev@avaya.com