Supporting 802.1X Authentication On Cisco Unified Ip Phones; Overview - Cisco 7961G-GE - IP Phone VoIP Administration Manual

Chapter 1 An Overview of the Cisco Unified IP Phone

Supporting 802.1X Authentication on Cisco Unified IP Phones

Overview

Cisco Unified IP Phone 7961G/7961G-GE and 7941G/7941G-GE for Cisco Unified Communications Manager 6.0
OL-11953-01
These sections provide information about 802.1X support on the Cisco Unified IP
Phones:
Overview, page 1-23
•
• Required Network Components, page 1-24
Best Practices—Requirements and Recommendations, page 1-24
•
Cisco Unified IP phones and Cisco Catalyst switches have traditionally used
Cisco Discovery Protocol (CDP) to identify each other and determine parameters
such as VLAN allocation and inline power requirements. However, CDP is not
used to identify any locally attached PCs, therefore Cisco Unified IP Phones
provide an EAPOL pass-through mechanism, whereby a PC locally attached to
the IP phone, may pass through EAPOL messages to the 802.1X authenticator in
the LAN switch. This prevents the IP phone from having to act as the
authenticator, yet allows the LAN switch to authenticate a data end point prior to
accessing the network.
In conjunction with the EAPOL pass-through mechanism, Cisco Unified IP
Phones provide a proxy EAPOL-Logoff mechanism. In the event that the locally
attached PC is disconnected from the IP phone, the LAN switch would not see the
physical link fail, because the link between the LAN switch and the IP phone is
maintained. To avoid compromising network integrity, the IP phone sends an
EAPOL-Logoff message to the switch, on behalf of the downstream PC, which
triggers the LAN switch to clear the authentication entry for the downstream PC.
The Cisco Unified IP phones also contain an 802.1X supplicant, in addition to the
EAPOL pass-through mechanism. This supplicant allows network administrators
to control the connectivity of IP phones to the LAN switch ports. The initial
release of the IP phone 802.1X supplicant implements the EAP-MD5 option for
802.1X authentication.
Understanding Security Features for Cisco Unified IP Phones
1-23