Supporting 802.1X Authentication On Cisco Unified Ip Phones; Overview; Required Network Components - Cisco 7906G - Unified IP Phone VoIP Administration Manual

Chapter 1 An Overview of the Cisco Unified IP Phone

Supporting 802.1X Authentication on Cisco Unified IP Phones

Overview

Required Network Components

Cisco Unified IP Phone 7906G and 7911G for Cisco Unified Communications Manager 6.1
OL-14585-01
These sections provide information about 802.1X support on the Cisco Unified IP
Phones:
Overview, page 1-23
•
• Required Network Components, page 1-23
Best Practices—Requirements and Recommendations, page 1-24
•
Cisco Unified IP phones and Cisco Catalyst switches have traditionally used
Cisco Discovery Protocol (CDP) to identify each other and to determine
parameters such as VLAN allocation and inline power requirements. However,
CDP is not used to identify any locally attached PCs; therefore, Cisco Unified IP
Phones provide an EAPOL pass-through mechanism, whereby a PC locally
attached to the IP phone may pass through EAPOL messages to the 802.1X
authenticator in the LAN switch. This capability prevents the IP phone from
having to act as the authenticator, yet allows the LAN switch to authenticate a data
end point prior to accessing the network.
In conjunction with the EAPOL pass-through mechanism, Cisco Unified IP
Phones provide a proxy EAPOL-Logoff mechanism. If the locally attached PC is
disconnected from the IP phone, the LAN switch would not see the physical link
fail, because the link between the LAN switch and the IP phone is maintained. To
avoid compromising network integrity, the IP phone sends an EAPOL-Logoff
message to the switch on behalf of the downstream PC, which triggers the LAN
switch to clear the authentication entry for the downstream PC.
The Cisco Unified IP phones contain an 802.1X supplicant in addition to the
EAPOL pass-through mechanism. This supplicant allows network administrators
to control the connectivity of IP phones to the LAN switch ports. The IP phone
802.1X supplicant implements the EAP-MD5 option for 802.1X authentication.
Support for 802.1X authentication on Cisco Unified IP Phones requires several
components, including:
Understanding Security Features for Cisco Unified IP Phones
1-23