46-24
Software Configuration Guide—Release IOS XE 3.6.0E and IOS 15.2(2)E
OL_28731-01
Chapter 46 Configuring 802.1X Port-Based Authentication
About 802.1X Port-Based Authentication
For information on configuring voice aware 802.1x security, see the “Configuring Voice Aware 802.1x
Security” section on page 46-75
Using Multiple Domain Authentication and Multiple Authentication
Multiple Domain Authentication (MDA) allows both a data device and a voice device, such as an IP
phone (Cisco or third party non-Cisco), to authenticate on the same switch port, which is divided into a
data domain and a voice domain.
Multi Auth allows multiple data devices and a voice device. When a voice VLAN is configured on a
multiple- authentication port, the port can perform authentication in the voice domain as on an MDA
port.
MDA does not enforce the order of device authentication. For best results, however, you should
authenticate a voice device before you authenticate a data device on an MDA-enabled port.
When configuring MDA, consider the following guidelines.
Note The same guidelines also apply for Multiple Authentication when voice VLAN is configured.
• We recommend that you enable CoPP on an MDA-enabled port to protect against a DoS attack.
Refer to Chapter 51, “Configuring Control Plane Policing and Layer 2 Control Packet QoS.”
• To configure a switch port for MDA or Multiple Authentication, see the “Configuring Multiple
Domain Authentication and Multiple Authorization” section on page 46-36.
• You must configure the voice VLAN for the IP phone when the host mode is set to multidomain. For
more information, see Chapter 43, “Configuring Voice Interfaces.”
• To authorize a voice device, the AAA server must be configured to send a Cisco Attribute-Value
(AV) pair attribute with a value of device-traffic-class=voice. Without this value, the switch treats
the voice device as a data device.
• The guest VLAN and restricted VLAN features only apply to the data devices on an MDA-enabled
port. The switch treats a voice device that fails authorization as a data device.
• If more than one device attempts authorization on either the voice or the data domain of a port, it is
error-disabled.
• Until a device is authorized, the port drops its traffic. Non-Cisco IP phones or voice devices are
allowed into both the data and voice VLANs. The data VLAN allows the voice device to contact a
DHCP server to obtain an IP address and acquire the voice VLAN information. After the voice
device starts sending on the voice VLAN, its access to the data VLAN is blocked. A security
violation may occur in MDA if the voice device continues to send traffic on the data VLAN.
• MDA can use MAC authentication bypass as a fallback mechanism to allow the switch port to
connect to devices that do not support 802.1X authentication. it is especially useful for third party
phones without 802.1X supplicant. For more information, see the “Using 802.1X with MAC
Authentication Bypass” section on page 46-13.
• When a data or a voice device is detected on a port, its MAC address is blocked until authorization
succeeds. If the authorization fails, the MAC address remains blocked for 5 minutes.
• If more than one device is detected on the data VLAN or more than one voice device is detected on
the voice VLAN while a port is unauthorized, the port is error-disabled.
To Next Page
Loading...
Need help?
General
