Options
Voice VLan and Dot1x
DevilWAH
Member Posts: 2,997 ■■■■■■■■□□
Hi,
I am implementing Dot1x on my network and I was wondering if it is possible for phones to bypass the Dot1x process.
What I mean by this is if a PC is connected to a phone (non cisco) and the phone to the switch port that is dot1x enabled. is it possible for the switch based on the vendor ID of the mac to place the phone in to the Voice vlan with out carrying out full dot1x authentication sending request to radius server etc?
The reason I ask is that many NAC solutions charge based on number of devices, so to be able to remove the phones from the loop will save a lot of cash.
Thank you
I am implementing Dot1x on my network and I was wondering if it is possible for phones to bypass the Dot1x process.
What I mean by this is if a PC is connected to a phone (non cisco) and the phone to the switch port that is dot1x enabled. is it possible for the switch based on the vendor ID of the mac to place the phone in to the Voice vlan with out carrying out full dot1x authentication sending request to radius server etc?
The reason I ask is that many NAC solutions charge based on number of devices, so to be able to remove the phones from the loop will save a lot of cash.
Thank you
- If you can't explain it simply, you don't understand it well enough. Albert Einstein
- An arrow can only be shot by pulling it backward. So when life is dragging you back with difficulties. It means that its going to launch you into something great. So just focus and keep aiming.
Linkin Profile - Blog: http://Devilwah.com
Comments
-
Options
shodown
Member Posts: 2,271
This is going to get ugly.
There is a bypass feature. However with your setup the security risk that you are trying to overcome you kinda open it backup depending on how what you choose to bypass. I can't remember what doc its in, but its out there. Good luck let us know how you overcome it.
I usually steer customers away from this while I'm doing any type of voip implementation, and have a security group come in to really get a design down and good implementation.Currently Reading
CUCM SRND 9x/10, UCCX SRND 10x, QOS SRND, SIP Trunking Guide, anything contact center related -
OptionsDevilWAH
Member Posts: 2,997 ■■■■■■■■□□
with mac bypass it still send the mac to the authenticion server.
i was thinking more like you can with lldp where you assign the phone to the voice vlan using the vendo code.- If you can't explain it simply, you don't understand it well enough. Albert Einstein
- An arrow can only be shot by pulling it backward. So when life is dragging you back with difficulties. It means that its going to launch you into something great. So just focus and keep aiming.
Linkin Profile - Blog: http://Devilwah.com