I am currently working on dot1x solution for wired users. Configuration we have is working fine for most of our use cases, except one. We have working solution for users that are connected to the network via IP phones. However, one group of those users are changing their working place quite often during the day (they work on shifts). Which is quite problem because IP phone reboots every time when one user disconnects laptopA and new user connects laptopB to the phone. I am not sure why change of device which is connected to the IP phone, prompts reboot of the phone.
I am using MAB as authentication for IP phones and dot1x for end stations.
Please see switchport configuration bellow.
Interface XXX
switchport mode access
switchport voice vlan xxx
authentication event fail action authorize vlan xxx
authentication event server dead action authorize vlan xxx
authentication event server dead action authorize voice
authentication event no-response action authorize vlan xxx
authentication host-mode multi-domain
authentication order mab dot1x
authentication priority dot1x mab
authentication port-control auto
authentication periodic
authentication timer reauthenticate server
authentication timer restart 10
authentication timer inactivity server dynamic
mab
dot1x pae authenticator
dot1x timeout server-timeout 30
dot1x timeout tx-period 3
dot1x max-req 3
dot1x max-reauth-req 5
spanning-tree portfast
Host-mode is multi-domain as you can see. Thus, I thought that IP phones which have been successfully authenticated do VOICE domain, don't have to re-authenticate every time DATA device behind phone is changed.
Example of successful authentication:
switchxxx#show authentication sessions | inc Gi1/0/37
Gi1/0/37 28d2.xxxx.xxx dot1x DATA Authz Success 0AF07F0F000004F5F45C4567
Gi1/0/37 0080.xxxx.xxxx mab VOICE Authz Success 0AF07F0F000004F7F45C6E86
It seems to me like switch removes all MAC addresses from CAM for particular interface, when computers are changed. But this does not happen when dot1x is not configured on the port. In this case, IP phone doesn't reboot. It has to have something with dot1x.
Do you have any idea how to fix it?
Many thanks.
Dan