802.1X Authentication; Overview; Required Network Components - Cisco 8961 Administration Manual

Cisco Unified IP Phone
Initiator phone
security level
Secure
Secure
Nonsecure
Secure
When using secure video over VPN and VXC/VPN, the maximum supported bandwidth is 320 kpbs.
When the phone calls Cisco TelePresence, the maximum bandwidth is 320 kbps.

802.1X Authentication

The Cisco Unified IP Phones support 802.1X Authentication.

Overview

Cisco Unified IP Phones and Cisco Catalyst switches traditionally use Cisco Discovery Protocol (CDP) to
identify each other and determine parameters such as VLAN allocation and inline power requirements. CDP
does not identify locally attached workstations. Cisco Unified IP Phones provide an EAPOL pass-through
mechanism. This mechanism allows a workstation attached to the Cisco Unified IP Phone to pass EAPOL
messages to the 802.1X authenticator at the LAN switch. The pass-through mechanism ensures that the IP
phone does not act as the LAN switch to authenticate a data endpoint before accessing the network.
Cisco Unified IP Phones also provide a proxy EAPOL Logoff mechanism. In the event that the locally attached
PC disconnects from the IP phone, the LAN switch does not see the physical link fail, because the link between
the LAN switch and the IP phone is maintained. To avoid compromising network integrity, the IP phone sends
an EAPOL-Logoff message to the switch on behalf of the downstream PC, which triggers the LAN switch to
clear the authentication entry for the downstream PC.
Cisco Unified IP Phones also contain an 802.1X supplicant. This supplicant allows network administrators
to control the connectivity of IP phones to the LAN switch ports. The current release of the phone 802.1X
supplicant uses the EAP-FAST, EAP-TLS, and EAP-MD5 options for network authentication.

Required Network Components

Support for 802.1X authentication on Cisco Unified IP Phones requires several components, including:
• Cisco Unified IP Phone: The phone acts as the 802.1X supplicant, which initiates the request to access
REVIEW DRAFT - CISCO CONFIDENTIAL
Feature Security level of
used participants
Conference At least one member is
nonsecure.
Conference Secure
Meet Me Minimum security level is
encrypted.
Meet Me Minimum security level is
nonsecure.
the network.
Cisco Unified IP Phone 8961, 9951, and 9971 Administration Guide for Cisco Unified Communications Manager 10.0
802.1X Authentication
Results of action
Secure conference bridge
Nonsecure conference
Secure conference bridge
Secure encrypted level conference
Initiator receives message Does not meet
Security Level, call rejected.
Secure conference bridge
Conference accepts all calls.
(SIP)
33