29-12
Software Configuration Guide—Release 12.2(25)SG
OL-7659-03
Chapter29 Understanding and Configuring 802.1X Port-Based Authentication
Understanding 802.1X Port-Based Authentication
Because RADIUS uses the unreliable transport protocol UDP, accounting messages may be lost due to
poor network conditions. If the switch does not receive the accounting response message from the
RADIUS server after a configurable number of retransmissions of an accounting re quest, the following
system message appears:
Accounting message %s for session %s failed to receive Accounting Response.
When the stop message is not transmitted successfully, the following message appears:
00:09:55: %RADIUS-3-NOACCOUNTINGRESPONSE: Accounting message Start for session
172.20.50.145 sam 11/06/03 07:01:16 11000002 failed to receive Accounting Response.
Use the show radius statistics command to display the number of RADIUS messages that do not receive
the accounting response message.
Using 802.1X with Voice VLAN Ports
A voice VLAN port is a special access port associated with two VLAN identifiers:
•Voice VLAN ID (VVID) to carry voice traffic to and from the IP phone. The VVID is used to
configure the IP phone connected to the port.
•Port VLAN ID (PVID) to carry the data traffic to and from the workstation connected to the switch
through the IP phone. The PVID is the native VLAN of the port.
Each port that you configure for a voice VLAN is associated with a VVID and a PVID. This
configuration allows voice traffic and data traffic to be separated onto different VLANs.
When you enable the single-host mode, only one 802.1X client is allowed on the p rimary VLAN; other
workstations are blocked. When you enable the multiple-hosts mode and an 802.1X client is
authenticated on the primary VLAN, additional clients on the voice VLAN are unrestricted after 802.1X
authentication succeeds on the primary VLAN.
A voice VLAN port becomes active when there is a link whether or not the port is AUTHORIZED or
UNAUTHORIZED. All traffic coming through the voice VLAN is learned correctly and appears in the
MAC-address-table. Cisco IP phones do not relay CDP messages from other devices. As a result, if
several Cisco IP phones are connected in series, the switch recognizes only the one directly connected
to it. When 802.1X is enabled on a voice VLAN port, the switch drops packets from unrecognized Cisco
IP phones more than one hop away.
When 802.1X is enabled on a port, you cannot configure a PVID that is equal to a VVID. For more
information about voice VLANs, see Chapter 28, “Configuring Voice Interfaces.”
Be aware of the following feature interactions:
•802.1X VLAN assignment cannot assign to the port the same VLAN as the voice VLAN; otherwise,
the 802.1X authentication will fail.
•802.1X guest VLAN works with the 802.1X voice VLAN port feat ure. However, the guest VLAN
cannot be the same as the voice VLAN.
•802.1X port security works with the 802.1X voice VLAN port feature and is configured per port.
Three secure addresses must be configured: one for the Cisco I P phone MAC address on the VVID,
one for the PC MAC-address on PVID, and a third to allow the Cisco IP phone MAC address on the
PVID.
However, you cannot use the 802.1X voice VLAN port feature with 802.1X port security’s sticky
MAC address configuration and 802.1X port-security's statically configured MAC address
configuration.
•802.1X accounting is unaffected by the 802.1X voice VLAN port feature.