Cisco phone-8851

Similar Questions

• MAB with Cisco Phone - authorization failed

  Hello everyone,

  I use MAB to authenticate customers and Cisco IP phones against a NPS Microsoft Radius server. Everything works perfectly, except for 1 phone Cisco. The phone is successfully authentication but authorization fails. The switch port has the following configuration.

  switchport access vlan 500
  switchport mode access
  switchport nonegotiate
  switchport voice vlan 92
  no logging event link-status
  srr-queue bandwidth share 1 30 35 5
  priority-queue out
  authentication control-direction in
  authentication event server dead action authorize voice
  authentication host-mode multi-domain
  authentication port-control auto
  authentication periodic
  authentication timer reauthenticate 10800
  authentication timer inactivity 1800
  mab
  no snmp trap link-status
  mls qos trust device cisco-phone
  mls qos trust cos
  macro description mab
  auto qos voip cisco-phone
  storm-control broadcast level 5.00
  storm-control action shutdown
  spanning-tree portfast
  spanning-tree bpduguard enable
  service-policy input AUTOQOS-SRND4-CISCOPHONE-POLICY
  

  I get the following RADIUS logging of the client authentication process.

  May  7 15:24:53.349: RADIUS:   4D 8F 05 AB 00 00 01 37 00 01 02 00 0A 19 0A 84 00 00 00 00 00 00 00 00 00 00 00 00 01 CE 47 DF 2A A4 B3 70 00 00 00 00 00 00 5F 79           [ M7G*p_y]
  May  7 15:24:53.349: RADIUS:  Vendor, Cisco       [26]  34
  May  7 15:24:53.349: RADIUS:   Cisco AVpair       [1]   28  "device-traffic-class=voice"
  May  7 15:24:53.358: RADIUS(00002749): Received from id 1645/128
  May  7 15:24:53.366: %MAB-5-SUCCESS: Authentication successful for client (442b.03a2.f9e8) on Interface Gi1/0/39 AuditSessionID 0A194B0400002706ED82EB13
  May  7 15:24:53.374: %AUTHMGR-7-RESULT: Authentication result 'success' from 'mab' for client (442b.03a2.f9e8) on Interface Gi1/0/39 AuditSessionID 0A194B0400002706ED82EB13
  SER-02-SW01#clear authentication
  May  7 15:24:53.383: %AUTHMGR-5-FAIL: Authorization failed or unapplied for client (442b.03a2.f9e8) on Interface Gi1/0/39 AuditSessionID 0A194B0400002706ED82EB13
  

  I checked online and blogs and forums suggest to check the use of the downloadable access list, but they are not used in the switch. As mentioned, all Cisco IP phones works perfectly, except this one. I have already removed the Active Directory object and created a new object from scratch, but the same result. I also tried another port in the switch, yet an authorization failure.

  Currently, I don't know where to look further, then maybe some of you can help me!

  Thanks for the update of René. I have suggested for deactivation and reactivation of the dot1x in the world to see where it got stuck somewhere. However, it seems the thought is not okay. Would appreciate if you mark it resolved so that someone else can take advantages out of it.

  Your welcome

  Good day!

  Jatin kone

  -Does the rate of useful messages-

• MAB Cisco phones successfully authenticated, VLANASSIGN assigned and failed authorization?

  I'm getting a strange behavior with a Catalyst switch and 802. 1 x. I use multi-auth, with a PC and phone Cisco patched in. The two devices to authenticate correctly, but only the PC is allowed depending on the switch logs.

  Switch terminal logs:

  Apr  7 09:27:37.836 EDT: %AUTHMGR-5-START: Starting 'mab' for client (001b.d585.205e) on Interface Fa0/1 AuditSessionID 0A0A050E000003B93EBE2E09Apr  7 09:27:37.945 EDT: %MAB-5-SUCCESS: Authentication successful for client (001b.d585.205e) on Interface Fa0/1 AuditSessionID 0A0A050E000003B93EBE2E09Apr  7 09:27:37.945 EDT: %AUTHMGR-5-VLANASSIGN: VLAN 100 assigned to Interface Fa0/1 AuditSessionID UnassignedApr  7 09:27:37.970 EDT: %AUTHMGR-5-FAIL: Authorization failed for client (001b.d585.205e) on Interface Fa0/1 AuditSessionID 0A0A050E000003B93EBE2E09Apr  7 09:27:39.295 EDT: %AUTHMGR-5-START: Starting 'dot1x' for client (0015.c547.7069) on Interface Fa0/1 AuditSessionID 0A0A050E000003BA3EBE5082Apr  7 09:27:43.775 EDT: %DOT1X-5-SUCCESS: Authentication successful for client (0015.c547.7069) on Interface Fa0/1 AuditSessionID Apr  7 09:27:43.783 EDT: %AUTHMGR-5-VLANASSIGN: VLAN 212 assigned to Interface Fa0/1 AuditSessionID 0A0A050E000003BA3EBE5082Apr  7 09:27:45.570 EDT: %AUTHMGR-5-SUCCESS: Authorization succeeded for client (0015.c547.7069) on Interface Fa0/1 AuditSessionID 0A0A050E000003BA3EBE5082

  Config switch:

  aaa authentication dot1x default group RADIUS-DOT1Xaaa authorization network default group radius ip radius source-interface Loopback0 radius-server vsa send accountingradius-server vsa send authenticationdot1x system-auth-controldot1x guest-vlan supplicant

  Configuration interface:

  interface FastEthernet0/1 switchport mode access srr-queue bandwidth share 10 10 60 20 priority-queue out  authentication event fail action next-method authentication event server dead action authorize voice authentication event no-response action authorize vlan 999 authentication host-mode multi-auth authentication order dot1x mab authentication port-control auto authentication periodic authentication violation protect mab mls qos trust cos auto qos voip trust  dot1x pae authenticator no mdix auto spanning-tree portfast

  NPS Windows Server policy:

  radius_attributes.PNG

  

  
  and
  
  

  vendor_specific_attributes.PNG

  

  Hello Jim,

  Try to use the domain host instead of multi-auth mode multiplayer.

  Kind regards

  Poonam Garg

• Cisco phone red service

  Can someone tell me which means that the red zone with a number inside on the screen of the phone and how to delete it?

  I've attached an example of what it looks like.

  Thank you

  Which indicates the combination of invisible missed calls and unread voicemails on a particular line.
  Please take a look in the right side on the screen of the phone, the NDDN button, you see a symbol of the handset as well as number 3, which means that you have 3 missed calls and do not have archive. Pressing this button will allow you to see the missed calls list unchecked, soon you check them, the red zone will be there, but the number is reduced to 5; how you still have something to check, they are nothing else but your voicemail. In the third button what you see is, voice mail unread, press the button and check all the voicemail. After checking all the voice message, the red box will be gone.

  There is a setting on the phone line where you can unceck an option called 'missed call log.
  Please note the useful messages

• SCCP Protocol not available for all cisco phones?

  All our phones are currently using SCCP and using Call Manager.   My company bought a few 8841 s and 7841 s, but I see only the protocols SIP for them on 10.5.1.10000 - 7 of the call manager.  I'll make an assumbtion here that I would need to add a default value for the device with CSPC as Protocol.  After you download a SCCP file for this model.  These phones do not provide a file to download to the SCCP Protocol.   Any help on how to set up a type of phone SCCP for these models?  Or it wouldn't hurt anything to run on the SIP protocol?

  Thank you

  Bill

  Here the SIP phones. No support of CPAC.

  Brandon

• Host multi-domain phone Cisco C2960-mode does not go to the field of voice

  Hello world

  I'm working on the deployment of dot1.x through our company. I'm stuck on configuring Cisco phones to go on one VLAN correct when the multi domain host-mode option is used. I tried on two C2960 switch with two different images. No matter what I do, the phone is going to area: DATA and unable to connect to the network as more likely, it is a wrong VLAN. Poster as authenticated port ISE and MAB works very well. When I set up stream host-mode, the phone Gets a VLAN correct and can top to the network.

  Here is what I use:

  • C2960S-48-i/s-L with C2960S-UNIVERSALK9-M or if C2960 with c2960-lanlitek9 - tar.150 - 2.SE7
  • Phone Cisco 7960 and 7962
  • ISE 1.3.0.876

  Here is the current port configuration:

  GigabitEthernet1/0/1 interface

  switchport access vlan 2

  switchport mode access

  switchport voice vlan 703

  multi-domain of host-mode authentication

  authentication order mab dot1x

  authentication priority dot1x mab

  Auto control of the port of authentication

  periodic authentication

  MAB

  dot1x EAP authenticator

  dot1x tx-time 10

  spanning tree portfast

  end

  Here is the output of logon authentication show inter Gig1/0/1

  MAC address: 0013.1a58.xxxx

  IP address: unknown

  Username: 00-13-1A-xx-xx-xx

  Status: Authz success

  Area: DATA

  Oper host mode: multi-domain

  Oper control dir: in

  Authorized by: authentication server

  Policy of VLAN: n/a

  The session timeout: 5400 s (local), remaining: 5384 s

  Delay action: authenticate again

  Idle timeout: N/A

  The common Session ID: 0AF301450000000C001F3391

  ACCT Session ID: 0x00000010

  Handle: 0x0400000D

  Thanks for your help.

  Looks like youre missing the device class = attribute in your profile authz voice.

• Cisco IP phone 9971 recording on one control vcs

  Hello

  Can sombody please confirm is it possible to record the ip cisco cp-9971 phone on a cisco vcs control server directly. If possible, I appreciate a guide or a document for this. I have a vcs on x7.1 control.

  Thank you.

  Hi tof.

  Registration of cisco phones are completely different with the process how a normal end point sip/h.323 register on VCS

  When the cisco phone register it search TFTP get the firmware, which is obviously not available with VCS. Another important part to phone record 9971 are CTL file and other parameters that are not available with VCS and so what you're trying is not possible.

  See you soon

  Alok

• ASA 5505 Cisco 7940 phone and laptop behind it

  The only problem I'm having is that when I try to use the internet port on the back of the Cisco phone, there is discount on an IP address for the Vlan voice (172.30) and not the VLan data (172.31).  Therefore, a laptop that I plug into the internet port cannot get out to the internet.  I need the laptop to get an IP address that is on the Vlan data if possible.  Thanks in advance for any help.   Here's a copy of my config.

  hostname TESTvpn
  activate the encrypted password of FsaA76FXbsPPlRSQ
  FsaA76FXbsPPlRSQ encrypted passwd
  names of
  name Corp_LAN 10.0.0.0
  name 192.168.64.0 Corp_Voice
  name 172.31.155.0 TESTvpn
  !
  interface Vlan1
  nameif inside
  security-level 100
  IP 172.31.155.1 255.255.255.0
  !
  interface Vlan2
  nameif outside
  security-level 0
  IP address dhcp setroute
  !
  interface Vlan3
  nameif Corp_Voice
  security-level 100
  IP 172.30.155.1 255.255.255.0
  !
  interface Ethernet0/0
  switchport access vlan 2
  !
  interface Ethernet0/1
  !
  interface Ethernet0/2
  !
  interface Ethernet0/3
  !
  interface Ethernet0/4
  !
  interface Ethernet0/5
  !
  interface Ethernet0/6
  !
  interface Ethernet0/7
  switchport access vlan 3
  !
  passive FTP mode
  object-group network SunVoyager
  host of the object-Network 64.70.8.160
  host of the object-Network 64.70.8.242
  the Corp_Networks object-group network
  network-object Corp_LAN 255.0.0.0
  object-network Corp_Voice 255.255.255.0
  outside_access_in list extended access allow all unreachable icmp
  outside_access_in list extended access permit icmp any any echo response
  outside_access_in list extended access permit icmp any one time exceed
  inside_access_in ip TESTvpn 255.255.255.0 allowed extended access list all
  inside_access_in list extended access allowed icmp TESTvpn 255.255.255.0 everything
  Access extensive list ip 172.30.155.0 Corp_Voice_access_in allow 255.255.255.0 any
  Corp_Voice_access_in list extended access allow icmp 172.30.155.0 255.255.255.0 any
  list of VPN access deny ip TESTvpn 255.255.255.0 object-group SunVoyager
  list of VPN access extended permitted ip TESTvpn 255.255.255.0 everything
  extended VPN ip 172.30.155.0 access list allow 255.255.255.0 any
  extended vpn-data access list permit ip TESTvpn 255.255.255.0 everything
  extended voice VPN ip 172.30.155.0 access list allow 255.255.255.0 any
  all - vpn access-list extended permitted ip TESTvpn 255.255.255.0 everything
  172.30.155.0 IP Access-list extended all - vpn 255.255.255.0 allow all
  pager lines 24
  Enable logging
  exploitation forest buffer-size 10000
  monitor debug logging
  logging buffered information
  asdm of logging of information
  Within 1500 MTU
  Outside 1500 MTU
  MTU 1500 Corp_Voice
  no failover
  ICMP unreachable rate-limit 1 burst-size 1
  don't allow no asdm history
  ARP timeout 14400
  Global 1 interface (outside)
  NAT (inside) 0-list of access vpn data
  NAT (inside) 1 TESTvpn 255.255.255.0
  NAT (Corp_Voice) - access list 0 voice-vpn
  inside_access_in access to the interface inside group
  Access-group outside_access_in in interface outside
  Access-group Corp_Voice_access_in in the Corp_Voice interface
  Timeout xlate 03:00
  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
  Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
  Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
  timeout tcp-proxy-reassembly 0:01:00
  dynamic-access-policy-registration DfltAccessPolicy
  Enable http server
  http TESTvpn 255.255.255.0 inside
  http Corp_Voice 255.255.255.0 Corp_Voice
  http Corp_LAN 255.0.0.0 inside
  http 65.170.136.64 255.255.255.224 outside
  http 172.30.155.0 255.255.255.0 Corp_Voice
  No snmp server location
  No snmp Server contact
  Server enable SNMP traps snmp authentication linkup, linkdown cold start
  Crypto ipsec transform-set esp-3des esp-md5-hmac VPN
  life crypto ipsec security association seconds 28800
  Crypto ipsec kilobytes of life - safety 4608000 association
  outside_map 1 match address all vpn crypto card
  peer set card crypto outside_map 1 66.170.136.65
  card crypto outside_map 1 the value transform-set VPN
  outside_map interface card crypto outside
  crypto isakmp identity address
  crypto ISAKMP allow outside
  crypto ISAKMP policy 1
  preshared authentication
  3des encryption
  md5 hash
  Group 2
  lifetime 28800
  crypto ISAKMP policy 65535
  preshared authentication
  3des encryption
  sha hash
  Group 2
  life 86400
  Telnet timeout 5
  SSH Corp_LAN 255.0.0.0 inside
  SSH TESTvpn 255.255.255.0 inside
  SSH 65.170.136.64 255.255.255.224 outside
  SSH timeout 20
  Console timeout 0
  management-access inside
  dhcpd outside auto_config
  dhcpd option 150 ip 192.168.64.4 192.168.64.3
  !
  dhcpd address 172.31.155.10 - 172.31.155.30 inside
  dhcpd dns 10.10.10.7 10.10.10.44 interface inside
  dhcpd sun.ins area inside interface
  dhcpd allow inside
  !
  dhcpd address 172.30.155.10 - 172.30.155.30 Corp_Voice
  dhcpd dns 10.10.10.7 10.10.10.44 interface Corp_Voice
  dhcpd interface of sun.ins of the Corp_Voice domain
  enable Corp_Voice dhcpd
  !

  a basic threat threat detection
  Statistics-list of access threat detection
  no statistical threat detection tcp-interception
  WebVPN
  username, admin pAd1USa81YUMBD/6 password encrypted privilege 15
  tunnel-group 66.170.136.65 type ipsec-l2l
  IPSec-attributes tunnel-group 66.170.136.65
  pre-shared-key *.
  !
  class-map inspection_default
  match default-inspection-traffic
  !
  !
  type of policy-card inspect dns preset_dns_map
  parameters
  message-length maximum 512
  Policy-map global_policy
  class inspection_default
  inspect the preset_dns_map dns
  inspect the ftp
  inspect h323 h225
  inspect the h323 ras
  inspect the netbios
  inspect the rsh
  inspect the rtsp
  inspect the skinny
  inspect esmtp
  inspect sqlnet
  inspect sunrpc
  inspect the tftp
  inspect the sip
  inspect xdmcp
  !
  global service-policy global_policy
  context of prompt hostname
  Cryptochecksum:fd067681ebec6394372ecb1a4d61d3a5

  Peter,

  So unlike switches the ASA does not support CDP.  As a result, there may be no communication between the ASA and the phone to distinguish the vlan data against the vlan voice.  Thus, the phone will use the vlan native to get an ip address and register.  That's what you have already configured on eth 0/7.

  When you connect a computer to the pc to the phone port, it will use the vlan native and thus be put in vlan 3 (vlan native) on port 0/7 eth.  It is expected that it will get an IP out of this range.

  So, that leaves you with two options.

  (1) disable the PC port on the phone.  This will force users to connect on ports 0/1-0/6 and be set to vlan correct.  You can disable it by going to the call Manager (Got to Device > phone, and then set "PC port" to disable).

  (2) configure nat for traffic vlan voice.  Please note that the PC connected to the phone will not be able to connect to one of the other PCs or printers on the VLAN for data (inside interface).

  NAT (Corp_Voice) 1 172.30.155.0 255.255.255.0

  I hope this helps.

  -Jay

• Phone IP Cisco CP - 9971 VCS registration...

  Hi all

  Can someone please confirm is possible to record the Cisco IP Phone CP-9971 on a Cisco VCS control server directly. If possible, I appreciate a guide or a document for this. I have a VCS on X7.0.2 control.

  Please guys suggest something.

  Thank you

  [email protected] / * /.

  Skype ID:-arun.sharma963

  Mob. + 91-8088071229

  Hello.

  You can not.

  Any Cisco phone requires a server TFTP provide the firmware and configuration. A VCS is only for the registration of the device.

  As a result, phones depend on a CUCM as Registrar. It's a plant (CUCM) vs decentralized approach (VCS).

  I had a lot of Cisco phones on my Asterisk server, as SCCP or SIP phones. But you must have good knowledge how to generate XML files that are used as configuration files.

  Concerning

  Danny

• Blind transfer does not not for third-party phones

  Hello

  I use CUCM 10.5 and Cisco and Ascom MyCo phones third-party. I just stumbled across a problem where the immediate or blind transmission does not work on the third-party SIP devices. However, the transfer works very well on all Cisco phones. Against the workflow and no calls work but couldn't find anything wrong. Please help/tips.

  Hi Anish,

  Can check you for 'Calling rerouting space research' on the phone has access to the number you have transferred blind to.

  JB

• Bug in the latest firmware of phone spa3XX-5XXG 7.5.6 - cannot transfer anonymous calls

  Hi supports,

  I found a bug in the latest firmware of the phone 7.5.6.

  Platform:

  Linux Debian Wheezy

  Asterisk 11.7

  2.11 FreePBX

  Cisco phone model affected: SPA504G and SPA514G (I only tested these two models)

  The question is when there is an incoming call with the anonymous caller id, after picking up the call, xfer and bxfer softkeys are missing. On the first page, only conf softkey (3rd place on four soft keys). After pressing the arrow to the right, it's the recomposition, dir, virgins (previously bxfer) and DND.

  TS has been done.

  Tested with other brands of phones, yealink, snom and mitel, all workers.

  Tested with firmware 7.5.5b, all workers.

  Tested with the latest firmware 7.5.6, softkeys xfer and bxfer are missing.

  I read the note to upgrade from 7.5.6 firmware and below:

  CSCuh25063 The SPA5x5 phone has the ability to hide the softKeys Xfer/Bxfer after the initial configuration of the network.

  Maybe it's related? pure conjecture. Does this mean that we should have the ability to display the softkeys Xfer/Bxfer? HOW?

  I want to solve this problem as soon as possible. My clients are happy after demotion to the 7.5.5b. But if it can be fixed in the next firmware available, that would be great.

  Kind regards

  William Jin

  Hello Ryan,

  Firmware 7.5.7 is scheduled for late February 2015. If anyone needs an immediate fix for this issue, we have a special genius which is based on 7.5.6a.

  Thank you

  Shilpa

• 802.1 x (dot1x) with IP phone / workstation using several authentication domains (MDA)

  Scenario:

  Workstation (behind the phone)

  8.5 (2) software IP Phone 7911

  ACS 4.1 with AD on the same server

  Cisco switch WS-C3750E-24PD with c3750e-universalk9 - mz.122 - 53.SE1.bin

  Guide used:

  http://www.Cisco.com/en/us/Tech/tk389/tk814/technologies_configuration_example09186a00808abf2d.shtml

  http://www.Cisco.com/en/us/products/sw/secursw/ps2086/products_configuration_example09186a00801df0e4.shtml

  To accomplish:

  Computer and authentication of the IP phone with 802. 1 x. The phone using EAP - MD5 and the workstation with PEAP-MSCHAP version 2.

  Tried and worked:

  Workstation using EAP - MD5 (with ACS username) and use PEAP (with AD user name) and it also acceded to the vlan correct according to the username.

  The journal of the ACS, authentication failed:

  Message-Type-name of user - Group-Name-Caller ID - network access profile name - Code failure-authentic -.

  Authentic has no EAP type - CP 7911 G-SEP00254594D6BA--00-25-45-94-D6-BA VOZ - (default) - not configured

  Configuration of the Switch:

  Group AAA dot1x default authentication RADIUS

  Group AAA authorization network default RADIUS

  RADIUS-server host 10.32.250.250 auth-port 1645 acct-port 1646 borders 7 095F4B07110445425B54

  interface GigabitEthernet1/0/3

  switchport mode access

  switchport nonegotiate

  switchport voice vlan 200

  multi-domain of host-mode authentication

  Auto control of the port of authentication

  periodic authentication

  MLS qos trust device cisco-phone

  MLS qos based on vlan

  dot1x EAP both

  dot1x quiet-time 20

  dot1x timeout server-timeout 100

  dot1x tx-delay 100

  broadcast storm control 15.00

  multicast storm-control level 10.00

  spanning tree portfast

  spanning tree guard root

  Summary of ACS Configuration:

  Configured the AAA

  2 group - voice and data, each with their VLAN respective and the ACS configuration parameters (attribute / value (AV))

  Added the user name and password for IP phones

  Mapped the announcement to the DataSet

  A certificate and installed in the workstation

  Set up the configuration of global authentication, where I ticked the boxes PEAP and EAP - MD5

  So, as I said, it only authenticates the workstation w / IP phone.  When I add the IP phone it does not authenticate any of them.

  Someone at - it one day?

  Hello

  First of all, you can try a different sw for phone (for example 8.4.2S). I have a similar problem with the 8.5 software and phones 7945/7965. Secondary, you must attribute av-pair confiigure side ACS for the correct placement of the voice phone to vlan.

  Concerning

  Stanislav

• 802. 1 x authentication and phones

  I have just begun to roll authentication of 802. 1 x and found that although I got the authentication for the PC the data VLAN to work, phones on the VOICE VLAN are not unless I put 'host-mode authentication' to 'stream '.

  We did turn not authenticated for 7 years with phones and both work of the PC.

  What I want to do (i.e. what management told me to move), is to have phones connect not authenticated (CDP agreeing to handle correct assignment of VLANS) but require PC to authenticate.

  I guess the simple question is; is it still possible? If this is the case, any advice is greatly appreciated.  (config switch is below).

  Thank you

  Arch

  !
  version 12.2
  no service button
  horodateurs service debug datetime localtime show-timezone msec
  Log service timestamps datetime localtime show-timezone msec
  encryption password service
  !
  switch to hostname
  !
  boot-start-marker
  boot-end-marker
  !
  emergency logging console
  emergency logging monitor
  enable secret 5 *.
  !
  AAA new-model
  !
  !
  Group AAA dot1x default authentication RADIUS
  !
  !
  !
  AAA - the id of the joint session
  clock timezone cst - 6
  clock to summer time recurring cdt
  1 supply ws-c3750g-24ps switch
  mtu 1500 routing system
  VTP transparent mode
  no ip domain-lookup
  !
  !
  interface ip igmp snooping mrouter vlan 41 item in gi1/0/27
  interface ip igmp snooping mrouter vlan 41 item in gi1/0/28
  !
  QoS omitted MLS
  !

  pvst spanning-tree mode
  spanning tree extend id-system
  !
  internal allocation policy of VLAN ascendant
  !
  VLAN 13
  name data - VLAN
  !
  VLAN 857
  name - VLAN VoIP
  !
  VLAN 1611
  name comments - VLAN
  LLDP run
  !
  !
  class-map correspondence AutoQoS-VoIP-RTP-Trust
  match ip dscp ef
  class-map correspondence AutoQoS-VoIP-control-Trust
  match ip dscp cs3 af31
  !
  !
  Policy-map AutoQoS-Police-CiscoPhone
  class AutoQoS-VoIP-RTP-Trust
  DSCP ef Set
  320000 8000 exceed-action of the police controlled-dscp-transmit
  class AutoQoS-VoIP-control-Trust
  DSCP Set cs3
  32000 8000 exceed-action of the police controlled-dscp-transmit
  !
  !
  !
  GigabitEthernet1/0/1 interface
  switchport access vlan 13
  switchport mode access
  switchport voice vlan 857
  security breach port switchport protect
  bandwidth share SRR-queue 10 10 60 20
  form of bandwidth SRR-queue 10 0 0 0
  queue-series 2
  priority queue
  authentication-sense in
  no response from the authentication event action allow vlan 1611
  stream of host-authentication mode
  Auto control of the port of authentication
  protect the violation of authentication
  MLS qos trust device cisco-phone
  MLS qos trust cos
  Auto qos voip cisco-phone
  dot1x EAP authenticator
  spanning tree portfast
  service-policy input AutoQoS-Police-CiscoPhone
  !
  interface GigabitEthernet1/0/2
  !
  interface GigabitEthernet1/0/3
  !
  interface GigabitEthernet1/0/4
  !
  interface GigabitEthernet1/0/5
  !
  interface GigabitEthernet1/0/6
  !
  interface GigabitEthernet1/0/7
  !
  interface GigabitEthernet1/0/8
  !
  interface GigabitEthernet1/0/9
  !
  interface GigabitEthernet1/0/10
  !
  interface GigabitEthernet1/0/11
  !
  interface GigabitEthernet1/0/12
  !
  interface GigabitEthernet1/0/13
  !
  interface GigabitEthernet1/0/14
  !
  interface GigabitEthernet1/0/15
  !
  interface GigabitEthernet1/0/16
  !
  interface GigabitEthernet1/0/17
  !
  interface GigabitEthernet1/0/18
  !
  interface GigabitEthernet1/0/19
  !
  interface GigabitEthernet1/0/20
  !
  interface GigabitEthernet1/0/21
  !
  interface GigabitEthernet1/0/22
  !
  interface GigabitEthernet1/0/23
  !
  interface GigabitEthernet1/0/24
  !
  interface GigabitEthernet1/0/25
  !
  interface GigabitEthernet1/0/26
  !
  interface GigabitEthernet1/0/27
  !
  interface GigabitEthernet1/0/28
  switchport trunk encapsulation dot1q
  switchport trunk allowed vlan 13,857,1611
  switchport mode trunk
  bandwidth share SRR-queue 10 10 60 20
  form of bandwidth SRR-queue 10 0 0 0
  queue-series 2
  MLS qos trust cos
  Auto qos voip trust
  !
  RADIUS-server host 10.1.2.10 auth-port 1645 acct-port 1646
  Server RADIUS 7 key *.
  RADIUS vsa server send authentication
  end

  Hello

  authentication with PC and phone needs "multi-domain of authentication host mode. You con use MAC address or 802. 1 X (username & password) for authentication of IP phone.

  Profile authenticatipo must send "device-traffic-class = voice" to the switch. PC fits the DATA cross-domain and phone VOICE-field.

  See attachment:

• PC profiled as a phone by ISE 1.4

  Hello

  I see that attached to the Cisco phones PC profiled by ISE 1.4 (patch 3) as Cisco phones. When first attached to the n (Cisco 6880 - last worm 15.2) the phone is emerging as a "Cisco-IP-Phone-7911" correctly and the PC is 802. 1 x authenticated ok and profiled as "Microsoft-workstation.

  In the minute the PC varies "Microsoft-Desktop" to "Cisco-IP-Phone-7911"in the list of endpoint ISE."

  When I opened the PC in the endpoint list, I see that he "inherited" details cdp of the phone. When I disconnect and reconnect the phone/PC, they all have two get profiled by ISE that phones - the n is configured to access Multi field (a device authorized in both voice and data) then the switchport is off because of a security breach.

  To work around this problem, I have disabled cdp on the n and active lldp. The phone is now emerging as "Cisco-IP-Phone" (Cisco-IP-Phone-7911 profile requires cdp) and the PC is profiled as "Microsoft-workstation.

  Is this a bug ISE or IOS? I had this problem with all available versions of the track 15.2 for the 6880. I am aware of the bugs CSCuu97659 and CSCuu94127 but these thought related to ISE 1.3 and earlier versions

  Thank you
  Andy

  Hi Andre, I think you're hit these bugs... and add to the mixture CSCuu76087 :)

• Configure the VLAN voice and data in CISCO SF 300 8 P

  I have a couple of Cisco SF 300 8 P and P 24 switches. I have voice and data VLANS configured as:

  Data VLAN: default 145.17.59.0/24

  Voice VLANS: VLAN 20 172.22.20.0/24

  I have different DHCP servers regarding the data VLAN, we have a physical server that is configured for 145.17.59 * extended IP and Voice VLAN DHCP Server is configured as a router gateway with option 150.

  This configuration works very well with other cisco 2960 switches and 3750 etc. except CISCO SF 300 8 P and 24 p. I tried to set up the voice and data VLAN in these CISCO switches so that phone CISCO (model 6941) should get IP of the VLAN voice and PC should get the IP address of the DHCP server on the data VLAN. I tried several techniques such as LLDP, Port-to-VLAN Config etc.

  Can anyone please guide me / help on this.

  Kind regards
  A K.M.Sayeed

  Hi A.K.M., with Cisco phones you should be able to define simply automatic voice VLAN to be VLAN20.

  ID of the vlan 20 voices

  You must ensure CDP or LLDP is enabled as well. I would check in the web GUI. DHCP for phones can come from a DHCP server on a port access VLAN20 switch, or you can use dhcp for assistance to redirect DHCP server elsewhere.

  If you prefer or you have problems with the CDP or LLDP, you can also program the ports as trunks and add the tag VLAN 20 for them.  In this scenario, you need to ensure inter - vlan routing works and phones that download the file config with corrrect VLAN config.

  These switches do not run ios, so they are similar, but different from the catalyst switches that you mentioned.

  -remember messages useful rate.