1-20
Cisco Unified IP Phone Administration Guide for Cisco Unified Communications Manager 8.5
OL-23092-01
Chapter 1 An Overview of the Cisco Unified IP Phone
Understanding Security Features for Cisco Unified IP Phones
Overview
Cisco Unified IP phones and Cisco Catalyst switches have traditionally used Cisco Discovery Protocol
(CDP) to identify each other and to determine parameters such as VLAN allocation and inline power
requirements. However, CDP is not used to identify any locally attached PCs. Therefore, Cisco Unified
IP Phones provide an EAPOL pass-through mechanism, whereby a PC locally attached to the IP phone
may pass through EAPOL messages to the 802.1X authenticator in the LAN switch. This capability
prevents the IP phone from having to act as the authenticator, yet allows the LAN switch to authenticate
a data end point prior to accessing the network.
In conjunction with the EAPOL pass-through mechanism, Cisco Unified IP Phones provide a proxy
EAPOL-Logoff mechanism. If the locally attached PC is disconnected from the IP phone, the LAN
switch would not see the physical link fail, because the link between the LAN switch and the IP phone
is maintained. To avoid compromising network integrity, the IP phone sends an EAPOL-Logoff message
to the switch on behalf of the downstream PC, which triggers the LAN switch to clear the authentication
entry for the downstream PC.
The Cisco Unified IP phones contain an 802.1X supplicant in addition to the EAPOL pass-through
mechanism. This supplicant allows network administrators to control the connectivity of IP phones to
the LAN switch ports. The Cisco Unified IP Phone 802.1X supplicant uses the EAP-FAST, EAP-TLS,
and EAP-MD5 options for network authentication.
Required Network Components
Support for 802.1X authentication on Cisco Unified IP Phones requires several components, including:
•
Cisco Unified IP Phone—The phone acts as the 802.1X supplicant, which initiates the request to
access the network.
•
Cisco Secure Access Control Server (ACS) (or other third-party authentication server)—The
authentication server and the phone must both be configured with a shared secret that is used to
authenticate the phone.
•
Cisco Catalyst Switch (or other third-party switch)—The switch must support 802.1X to act as the
authenticator
and pass the messages between the phone and the authentication server. When the
exchange is completed, the switch grants or denies the phone access to the network.
Best Practices—Requirements and Recommendations
•
Enable 802.1X Authentication—If you want to use the 802.1X standard to authenticate Cisco
Unified IP Phones, make sure that you have properly configured the other components before
enabling it on the phone. See
802.1X Authentication and Status, page 4-42
for more information.
•
Configure PC Port—The 802.1X standard does not take into account the use of VLANs and thus
recommends that only a single device be authenticated to a specific switch port. However, some
switches (including Cisco Catalyst switches) support multi-domain authentication. The switch
configuration determines whether you can connect a PC to the phone PC port.
–
Enabled—If you are using a switch that supports multi-domain authentication, you can enable
the PC port and connect a PC to it. In this case, Cisco Unified IP Phones support proxy
EAPOL-Logoff to monitor the authentication exchanges between the switch and the attached
PC. For more information about IEEE 802.1X support on the Cisco Catalyst switches, refer to
the Cisco Catalyst switch configuration guides at:
http://www.cisco.com/en/US/products/hw/switches/ps708/tsd_products_support_series_home.
html
