Note:
If you administer the CA to require manual approval of certificate requests, then the
phone takes a minimum of two minutes to download the identity certificate after the CA
approves the request. Therefore, do not reboot the phones until at least two minutes
after approving the certificate enrollment request. If the certificate enrollment process
is automatic, the process takes less time than manual enrollment.
6. Administer the RADIUS server to accept the identity certificates provided by the phones.
7. Change the 46xxsettings.txt file, to turn on 802.1x authentication, by setting
DOT1XSTAT
to
a value of 1 or 2.
8. Set the EAPS authentication method to TLS by setting
SET DOT1XEAPS TLS
in the
46xxsettings.txt file.
9. Configure the Layer 2 switches to which you have attached these phones, to support EAP-
TLS on the ports to which you have attached the phones.
Result
The switches prompt the phones to authenticate using EAP-TLS and the phones authenticate
using the enrolled certificates. After setup completes, the phones maintain the configurations
across restarts and upgrades. Depending on the value of
MYCERTRENEW
, the phones try to renew
their certificates enrollment, periodically. The administrator must monitor pending enrollments.
Related links
EAP-TLS support for authentication
on page 134
About IEEE 802.1X
IP phones support the IEEE 802.1X standard for Supplicant operation and support pass-through
of 802.1X messages to an attached PC. The system parameter DOT1X determines how the
phones handle pass-through of 802.1X multicast packets and proxy logoff:
• When DOT1X = 0, the phone forwards 802.1X multicast packets from the Authenticator to
the PC attached to the phone and forwards multicast packets from the attached PC to the
Authenticator (multicast pass-through). The phone does not support Proxy Logoff. This is the
default value.
• When DOT1X = 1, the phone supports the same multicast pass-through as when DOT1X=0,
but Proxy Logoff is also supported. When the secondary Ethernet interface loses link
integrity, the phone sends an 802.1X EAPOL-Logoff message to the Authenticator with a
source MAC address from the previously attached device. This message alerts the
Authenticator that the device is no longer connected.
• When DOT1X = 2, the phone forwards multicast packets from the Authenticator only to the
phone, ignoring multicast packets from the attached PC (no multicast pass-through). The
phone does not support Proxy Logoff.
• Regardless of the DOT1X setting, the phone always properly directs unicast packets from the
Authenticator to the phone or its attached PC as specified by the destination MAC address in
the packet.
Administering Deskphone Options
May 2018
Installing and Administering Avaya J169/J179 IP Phone H.323
139
