802.1X Authentication - Cisco 7800 Series Administration Manual

802.1x Authentication

3. The user hears a security tone if the call connects to another secured phone, indicating that both ends of
the conversation are encrypted and secured. If the call connects to a nonsecure phone, the user does not
hear the security tone.
Note Secure calling is supported between two phones. For protected phones, some features, such as conference
calling, shared lines, and Extension Mobility, are not available when secure calling is configured.
Only protected phones play these secure or nonsecure indication tones. Nonprotected phones never play tones.
If the overall call status changes during the call, the indication tone changes and the protected phone plays
the appropriate tone.
A protected phone plays a tone or not under these circumstances:
• When the Play Secure Indication Tone option is enabled:
If the Play Secure Indication Tone option is disabled, no tone plays.
Note Secure calling is supported between two phones. For protected phones, some features, such as conference
calling, shared lines, and Extension Mobility, are not available when secure calling is configured.
802.1x Authentication
The Cisco IP Phones support 802.1X Authentication.
Cisco IP Phones and Cisco Catalyst switches traditionally use Cisco Discovery Protocol (CDP) to identify
each other and determine parameters such as VLAN allocation and inline power requirements. CDP does not
identify locally attached workstations. Cisco IP Phones provide an EAPOL pass-through mechanism. This
mechanism allows a workstation attached to the Cisco IP Phone to pass EAPOL messages to the 802.1X
authenticator at the LAN switch. The pass-through mechanism ensures that the IP phone does not act as the
LAN switch to authenticate a data endpoint before accessing the network.
Cisco IP Phones also provide a proxy EAPOL Logoff mechanism. In the event that the locally attached PC
disconnects from the IP phone, the LAN switch does not see the physical link fail, because the link between
the LAN switch and the IP phone is maintained. To avoid compromising network integrity, the IP phone sends
an EAPOL-Logoff message to the switch on behalf of the downstream PC, which triggers the LAN switch to
clear the authentication entry for the downstream PC.
Support for 802.1X authentication requires several components:
• Cisco IP Phone: The phone initiates the request to access the network. Phones contain an 802.1X
Cisco IP Phone 7800 Series Administration Guide for Cisco Unified Communications Manager
80
• When end-to-end secure media is established and the call status is secure, the phone plays the secure
indication tone (three long beeps with pauses).
• When end-to-end nonsecure media is established and the call status is nonsecure, the phone plays
the nonsecure indication tone (six short beeps with brief pauses).
supplicant. This supplicant allows network administrators to control the connectivity of IP phones to the
LAN switch ports. The current release of the phone 802.1X supplicant uses the EAP-FAST and EAP-TLS
options for network authentication.
Cisco IP Phone Administration