Security

Is there a good document on using a laptop (dot1x) and  ip-phone DUR on same switch-port?  I have a ClearPass service for dot1x and another for mac auth.

This is just standard 802.1X configuration, just don't set the port to "device-mode".

Is there a good document on using a laptop (dot1x) and  ip-phone DUR on same switch-port?  I have a ClearPass service for dot1x and another for mac auth.

on the 2930, where do I configure this?   Just to be sure the phone will use the mac profile and the laptop  will use the dot1x profile?

aaa port-access authenticator 1/2-1/8
aaa port-access authenticator 1/2 tx-period 10
aaa port-access authenticator 1/2 supplicant-timeout 10
aaa port-access authenticator 1/2 client-limit 5
aaa port-access authenticator 1/3 tx-period 10

aaa port-access mac-based 1/2-1/8
aaa port-access mac-based 1/2 addr-limit 4
aaa port-access mac-based 1/3 addr-limit 4
aaa port-access mac-based 1/4 addr-limit 4
aaa port-access mac-based 1/5 addr-limit 4

aa port-access 1/2 mixed
aaa port-access 1/3 mixed
aaa port-access 1/4 mixed

This is just standard 802.1X configuration, just don't set the port to "device-mode".

Is there a good document on using a laptop (dot1x) and  ip-phone DUR on same switch-port?  I have a ClearPass service for dot1x and another for mac auth.

Ah, I figured you meant using 802.1X for both devices.  As long as authenticator and mac-based are configured on the port, both services are available for any devices that connect.  Whether or not an EAP authentication (802.1X) happens is based on whether or not the connecting device supports 802.1X.

My starting point for a configuration looks like:

aaa port-access mac-based 1/1-1/48aaa port-access mac-based 1/1-1/48 addr-limit 2aaa port-access mac-based 1/1-1/48 mac-pinaaa port-access mac-based 1/1-1/48 quiet-period 30aaa port-access authenticator 1/1-1/48 client-limit 2aaa port-access authenticator 1/1-1/48 supplicant-timeout 6aaa port-access authenticator 1/1-1/48 tx-period 6aaa port-access authenticator 1/1-1/48 max-requests 2aaa port-access authenticator 1/1-1/48 max-eap-retries 2aaa port-access authenticator 1/1-1/48aaa port-access authenticator activeaaa port-access 1/1-1/48 auth-order authenticator mac-based aaa port-access 1/1-1/48 auth-priority authenticator mac-based

The important piece here is the auth-order and auth-priority, that decides which method gets attempted first and which method's result gets applied.  When attempting authenticator first, make sure to tune the process so that a client device doesn't spend two minutes before the MAC auth happens.

on the 2930, where do I configure this?   Just to be sure the phone will use the mac profile and the laptop  will use the dot1x profile?

aaa port-access authenticator 1/2-1/8
aaa port-access authenticator 1/2 tx-period 10
aaa port-access authenticator 1/2 supplicant-timeout 10
aaa port-access authenticator 1/2 client-limit 5
aaa port-access authenticator 1/3 tx-period 10

aaa port-access mac-based 1/2-1/8
aaa port-access mac-based 1/2 addr-limit 4
aaa port-access mac-based 1/3 addr-limit 4
aaa port-access mac-based 1/4 addr-limit 4
aaa port-access mac-based 1/5 addr-limit 4

aa port-access 1/2 mixed
aaa port-access 1/3 mixed
aaa port-access 1/4 mixed

This is just standard 802.1X configuration, just don't set the port to "device-mode".

Is there a good document on using a laptop (dot1x) and  ip-phone DUR on same switch-port?  I have a ClearPass service for dot1x and another for mac auth.

Carson,

Can you share the entire config with me?

Ah, I figured you meant using 802.1X for both devices.  As long as authenticator and mac-based are configured on the port, both services are available for any devices that connect.  Whether or not an EAP authentication (802.1X) happens is based on whether or not the connecting device supports 802.1X.

My starting point for a configuration looks like:

aaa port-access mac-based 1/1-1/48aaa port-access mac-based 1/1-1/48 addr-limit 2aaa port-access mac-based 1/1-1/48 mac-pinaaa port-access mac-based 1/1-1/48 quiet-period 30aaa port-access authenticator 1/1-1/48 client-limit 2aaa port-access authenticator 1/1-1/48 supplicant-timeout 6aaa port-access authenticator 1/1-1/48 tx-period 6aaa port-access authenticator 1/1-1/48 max-requests 2aaa port-access authenticator 1/1-1/48 max-eap-retries 2aaa port-access authenticator 1/1-1/48aaa port-access authenticator activeaaa port-access 1/1-1/48 auth-order authenticator mac-based aaa port-access 1/1-1/48 auth-priority authenticator mac-based

The important piece here is the auth-order and auth-priority, that decides which method gets attempted first and which method's result gets applied.  When attempting authenticator first, make sure to tune the process so that a client device doesn't spend two minutes before the MAC auth happens.

on the 2930, where do I configure this?   Just to be sure the phone will use the mac profile and the laptop  will use the dot1x profile?

aaa port-access authenticator 1/2-1/8
aaa port-access authenticator 1/2 tx-period 10
aaa port-access authenticator 1/2 supplicant-timeout 10
aaa port-access authenticator 1/2 client-limit 5
aaa port-access authenticator 1/3 tx-period 10

aaa port-access mac-based 1/2-1/8
aaa port-access mac-based 1/2 addr-limit 4
aaa port-access mac-based 1/3 addr-limit 4
aaa port-access mac-based 1/4 addr-limit 4
aaa port-access mac-based 1/5 addr-limit 4

aa port-access 1/2 mixed
aaa port-access 1/3 mixed
aaa port-access 1/4 mixed

This is just standard 802.1X configuration, just don't set the port to "device-mode".

Is there a good document on using a laptop (dot1x) and  ip-phone DUR on same switch-port?  I have a ClearPass service for dot1x and another for mac auth.

No, I don't have a configuration that is shareable.  Is there a particular piece you are wanting to see?

Carson,

Can you share the entire config with me?

Ah, I figured you meant using 802.1X for both devices.  As long as authenticator and mac-based are configured on the port, both services are available for any devices that connect.  Whether or not an EAP authentication (802.1X) happens is based on whether or not the connecting device supports 802.1X.

My starting point for a configuration looks like:

aaa port-access mac-based 1/1-1/48aaa port-access mac-based 1/1-1/48 addr-limit 2aaa port-access mac-based 1/1-1/48 mac-pinaaa port-access mac-based 1/1-1/48 quiet-period 30aaa port-access authenticator 1/1-1/48 client-limit 2aaa port-access authenticator 1/1-1/48 supplicant-timeout 6aaa port-access authenticator 1/1-1/48 tx-period 6aaa port-access authenticator 1/1-1/48 max-requests 2aaa port-access authenticator 1/1-1/48 max-eap-retries 2aaa port-access authenticator 1/1-1/48aaa port-access authenticator activeaaa port-access 1/1-1/48 auth-order authenticator mac-based aaa port-access 1/1-1/48 auth-priority authenticator mac-based

The important piece here is the auth-order and auth-priority, that decides which method gets attempted first and which method's result gets applied.  When attempting authenticator first, make sure to tune the process so that a client device doesn't spend two minutes before the MAC auth happens.

on the 2930, where do I configure this?   Just to be sure the phone will use the mac profile and the laptop  will use the dot1x profile?

aaa port-access authenticator 1/2-1/8
aaa port-access authenticator 1/2 tx-period 10
aaa port-access authenticator 1/2 supplicant-timeout 10
aaa port-access authenticator 1/2 client-limit 5
aaa port-access authenticator 1/3 tx-period 10

aaa port-access mac-based 1/2-1/8
aaa port-access mac-based 1/2 addr-limit 4
aaa port-access mac-based 1/3 addr-limit 4
aaa port-access mac-based 1/4 addr-limit 4
aaa port-access mac-based 1/5 addr-limit 4

aa port-access 1/2 mixed
aaa port-access 1/3 mixed
aaa port-access 1/4 mixed

This is just standard 802.1X configuration, just don't set the port to "device-mode".

Is there a good document on using a laptop (dot1x) and  ip-phone DUR on same switch-port?  I have a ClearPass service for dot1x and another for mac auth.

I am not getting the DUR  from clearPass. ClearPass shows ACCEPT and sends the DUR. The swiitch is not getting it:

No, I don't have a configuration that is shareable.  Is there a particular piece you are wanting to see?

Carson,

Can you share the entire config with me?

Ah, I figured you meant using 802.1X for both devices.  As long as authenticator and mac-based are configured on the port, both services are available for any devices that connect.  Whether or not an EAP authentication (802.1X) happens is based on whether or not the connecting device supports 802.1X.

My starting point for a configuration looks like:

aaa port-access mac-based 1/1-1/48aaa port-access mac-based 1/1-1/48 addr-limit 2aaa port-access mac-based 1/1-1/48 mac-pinaaa port-access mac-based 1/1-1/48 quiet-period 30aaa port-access authenticator 1/1-1/48 client-limit 2aaa port-access authenticator 1/1-1/48 supplicant-timeout 6aaa port-access authenticator 1/1-1/48 tx-period 6aaa port-access authenticator 1/1-1/48 max-requests 2aaa port-access authenticator 1/1-1/48 max-eap-retries 2aaa port-access authenticator 1/1-1/48aaa port-access authenticator activeaaa port-access 1/1-1/48 auth-order authenticator mac-based aaa port-access 1/1-1/48 auth-priority authenticator mac-based

The important piece here is the auth-order and auth-priority, that decides which method gets attempted first and which method's result gets applied.  When attempting authenticator first, make sure to tune the process so that a client device doesn't spend two minutes before the MAC auth happens.

on the 2930, where do I configure this?   Just to be sure the phone will use the mac profile and the laptop  will use the dot1x profile?

aaa port-access authenticator 1/2-1/8
aaa port-access authenticator 1/2 tx-period 10
aaa port-access authenticator 1/2 supplicant-timeout 10
aaa port-access authenticator 1/2 client-limit 5
aaa port-access authenticator 1/3 tx-period 10

aaa port-access mac-based 1/2-1/8
aaa port-access mac-based 1/2 addr-limit 4
aaa port-access mac-based 1/3 addr-limit 4
aaa port-access mac-based 1/4 addr-limit 4
aaa port-access mac-based 1/5 addr-limit 4

aa port-access 1/2 mixed
aaa port-access 1/3 mixed
aaa port-access 1/4 mixed

This is just standard 802.1X configuration, just don't set the port to "device-mode".

Is there a good document on using a laptop (dot1x) and  ip-phone DUR on same switch-port?  I have a ClearPass service for dot1x and another for mac auth.

There are a few guides for setting up DUR on the switches, including a pretty comprehensive video series by Herman.

The important parts that get missed:

1. creating the administrative user in ClearPass with the proper permissions
2. adding the ta-profile (root CA) for the HTTPS certificate used by ClearPass
3. configuring the username and password for the ClearPass integration

I am not getting the DUR  from clearPass. ClearPass shows ACCEPT and sends the DUR. The swiitch is not getting it:

No, I don't have a configuration that is shareable.  Is there a particular piece you are wanting to see?

Carson,

Can you share the entire config with me?

Ah, I figured you meant using 802.1X for both devices.  As long as authenticator and mac-based are configured on the port, both services are available for any devices that connect.  Whether or not an EAP authentication (802.1X) happens is based on whether or not the connecting device supports 802.1X.

My starting point for a configuration looks like:

aaa port-access mac-based 1/1-1/48aaa port-access mac-based 1/1-1/48 addr-limit 2aaa port-access mac-based 1/1-1/48 mac-pinaaa port-access mac-based 1/1-1/48 quiet-period 30aaa port-access authenticator 1/1-1/48 client-limit 2aaa port-access authenticator 1/1-1/48 supplicant-timeout 6aaa port-access authenticator 1/1-1/48 tx-period 6aaa port-access authenticator 1/1-1/48 max-requests 2aaa port-access authenticator 1/1-1/48 max-eap-retries 2aaa port-access authenticator 1/1-1/48aaa port-access authenticator activeaaa port-access 1/1-1/48 auth-order authenticator mac-based aaa port-access 1/1-1/48 auth-priority authenticator mac-based

The important piece here is the auth-order and auth-priority, that decides which method gets attempted first and which method's result gets applied.  When attempting authenticator first, make sure to tune the process so that a client device doesn't spend two minutes before the MAC auth happens.

on the 2930, where do I configure this?   Just to be sure the phone will use the mac profile and the laptop  will use the dot1x profile?

aaa port-access authenticator 1/2-1/8
aaa port-access authenticator 1/2 tx-period 10
aaa port-access authenticator 1/2 supplicant-timeout 10
aaa port-access authenticator 1/2 client-limit 5
aaa port-access authenticator 1/3 tx-period 10

aaa port-access mac-based 1/2-1/8
aaa port-access mac-based 1/2 addr-limit 4
aaa port-access mac-based 1/3 addr-limit 4
aaa port-access mac-based 1/4 addr-limit 4
aaa port-access mac-based 1/5 addr-limit 4

aa port-access 1/2 mixed
aaa port-access 1/3 mixed
aaa port-access 1/4 mixed

This is just standard 802.1X configuration, just don't set the port to "device-mode".

Is there a good document on using a laptop (dot1x) and  ip-phone DUR on same switch-port?  I have a ClearPass service for dot1x and another for mac auth.

Carson,

Thank you for the information, I had this working last week all of the DUR's were working. Is there a trouble shooting guide that would help me find out what changed that it no longer works?

There are a few guides for setting up DUR on the switches, including a pretty comprehensive video series by Herman.

The important parts that get missed:

1. creating the administrative user in ClearPass with the proper permissions
2. adding the ta-profile (root CA) for the HTTPS certificate used by ClearPass
3. configuring the username and password for the ClearPass integration

I am not getting the DUR  from clearPass. ClearPass shows ACCEPT and sends the DUR. The swiitch is not getting it:

No, I don't have a configuration that is shareable.  Is there a particular piece you are wanting to see?

Carson,

Can you share the entire config with me?

Ah, I figured you meant using 802.1X for both devices.  As long as authenticator and mac-based are configured on the port, both services are available for any devices that connect.  Whether or not an EAP authentication (802.1X) happens is based on whether or not the connecting device supports 802.1X.

My starting point for a configuration looks like:

aaa port-access mac-based 1/1-1/48aaa port-access mac-based 1/1-1/48 addr-limit 2aaa port-access mac-based 1/1-1/48 mac-pinaaa port-access mac-based 1/1-1/48 quiet-period 30aaa port-access authenticator 1/1-1/48 client-limit 2aaa port-access authenticator 1/1-1/48 supplicant-timeout 6aaa port-access authenticator 1/1-1/48 tx-period 6aaa port-access authenticator 1/1-1/48 max-requests 2aaa port-access authenticator 1/1-1/48 max-eap-retries 2aaa port-access authenticator 1/1-1/48aaa port-access authenticator activeaaa port-access 1/1-1/48 auth-order authenticator mac-based aaa port-access 1/1-1/48 auth-priority authenticator mac-based

The important piece here is the auth-order and auth-priority, that decides which method gets attempted first and which method's result gets applied.  When attempting authenticator first, make sure to tune the process so that a client device doesn't spend two minutes before the MAC auth happens.

on the 2930, where do I configure this?   Just to be sure the phone will use the mac profile and the laptop  will use the dot1x profile?

aaa port-access authenticator 1/2-1/8
aaa port-access authenticator 1/2 tx-period 10
aaa port-access authenticator 1/2 supplicant-timeout 10
aaa port-access authenticator 1/2 client-limit 5
aaa port-access authenticator 1/3 tx-period 10

aaa port-access mac-based 1/2-1/8
aaa port-access mac-based 1/2 addr-limit 4
aaa port-access mac-based 1/3 addr-limit 4
aaa port-access mac-based 1/4 addr-limit 4
aaa port-access mac-based 1/5 addr-limit 4

aa port-access 1/2 mixed
aaa port-access 1/3 mixed
aaa port-access 1/4 mixed

This is just standard 802.1X configuration, just don't set the port to "device-mode".

Is there a good document on using a laptop (dot1x) and  ip-phone DUR on same switch-port?  I have a ClearPass service for dot1x and another for mac auth.