802.1X and Shoretel

[southeasternMI]

Anyone setup a ShoreTel system in a 802.1X environment? How do the phones handle the authentication and do they pass the authentication through the second switch port without issues? I'm assuming you have to authenticate the phones via the MAC, maybe? What about authenticating through V-LANs?

Any info would be great. I have a feeling we are all going to run into this in the future.

[cburgy]

You'll have a solution in the future

Many NAC solutions can authenticate based upon MAC prefix.

[southeasternMI]

So 802.1x doesn't do any MAC base authentication? I didn't know that, I just assumed.
ok, well thats a kick in the stones.

[mike.elam]

802.1x with Cisco

Is there any documentation on configuring shortel phones to work with Cisco 802.1x authentication. It doesn't seem to enjoy the Voice Vlan tag on the interface configuration?????

[Aaron1121]

Is there any documentation on configuring shortel phones to work with Cisco 802.1x authentication. It doesn't seem to enjoy the Voice Vlan tag on the interface configuration?????

You can use 802.1x and Shoretel phones on a Cisco switch, but it is a little bit tricky to setup. What you need to do is setup multiple authentications on the port. You can place a rule within the Radius server that your switch talks to allow the mac addresses of the phones. With any other mac addresses, it will peform the authentication. (thus multiple times) The tricky part is, depending on your configuration, it may or may not shut off the phone if the client fails authentication.

Google "cisco 802.1x multi-auth"

Cisco has supported 802.1x multi-auth on the 3560's for about a year. It was introduced into the 4500 and 6500's about 3 months ago, so you will need a recent IOS to make it work.

http://www.cisco.com/application/pdf/paws/98523/8021x-cat-layer3.pdf

IEEE 802.1x Multi-Domain Authentication on Cisco Catalyst Layer 3 Fixed Configuration Switches Configuration Example - Cisco Systems

Good Luck!