Cisco Systems 6901 manual Supporting 802.1X Authentication on Cisco Unified IP Phones, Overview

Chapter 1 An Overview of the Cisco Unified IP Phone

Understanding Security Features for Cisco Unified IP Phones

Table 1-7	Security Restrictions with Conference Calls
Initiator’s Phone
Security Level		Feature Used	Security Level of Participants	Results of Action
Non-secure		Conference	Encrypted or authenticated	Non-secure conference bridge
				Non-secure conference
Secure (encrypted		Conference	At least one member is	Non-secure conference
or authenticated)			non-secure
Secure (encrypted)		Conference	All participants are encrypted	Secure encrypted level conference
Secure		Conference	All participants are encrypted or	Secure authenticated level conference
(authenticated)			authenticated
Non-secure		cBarge	All participants are encrypted	Conference changes to non-secure
Non-secure		Meet Me	Minimum security level is	Initiator receives message “Does not meet Security
			encrypted	Level”, call rejected.
Secure (encrypted)		Meet Me	Minimum security level is	Conference accepts encrypted and authenticated
			authenticated	calls
Secure (encrypted)		Meet Me	Minimum security level is	Only secure conference bridge available and used
			non-secure	Conference accepts all calls

Supporting 802.1X Authentication on Cisco Unified IP Phones

These sections provide information about 802.1X support on the Cisco Unified IP Phones:

•Overview, page 1-17

•Required Network Components, page 1-18

•Best Practices—Requirements and Recommendations, page 1-19

Overview

Cisco Unified IP phones and Cisco Catalyst switches have traditionally used Cisco Discovery Protocol (CDP) to identify each other and determine parameters such as VLAN allocation and inline power requirements. However, CDP is not used to identify any locally attached PCs; therefore, Cisco Unified IP Phones provide an EAPOL pass-through mechanism, whereby a PC locally attached to the IP phone, may pass through EAPOL messages to the 802.1X authenticator in the LAN switch. This prevents the IP phone from having to act as the authenticator, yet allows the LAN switch to authenticate a data end point prior to accessing the network.

In conjunction with the EAPOL pass-through mechanism, Cisco Unified IP Phones provide a proxy EAPOL-Logoff mechanism. In the event that the locally attached PC is disconnected from the IP phone, the LAN switch would not see the physical link fail, because the link between the LAN switch and the IP phone is maintained. To avoid compromising network integrity, the IP phone sends an EAPOL-Logoff message to the switch, on behalf of the downstream PC, which triggers the LAN switch to clear the authentication entry for the downstream PC.

The Cisco Unified IP phones also contain an 802.1X supplicant, in addition to the EAPOL pass-through mechanism. This supplicant allows network administrators to control the connectivity of IP phones to the LAN switch ports. The current release of the phone 802.1X supplicant uses the EAP-FAST and EAP-TLS options for network authentication.

	Cisco Unified IP Phone 6901 and 6911 Administration Guide for Cisco Unified Communications Manager 8.5 (SCCP and SIP)
OL-23874-01		1-17