All IP phones support Supplicant operation as specified in IEEE 802.1X, but, as of software
Release 2.0, only if the value of the parameter DOT1XSTAT is
1
or
2
. If DOT1XSTAT has any
other value, the phone does not support Supplicant operation.
Unicast 802.1X frames contain the MAC address of the phone as the destination MAC address
and a protocol type of 88-8E hex. IP phones respond to unicast 802.1X frames received on the
Ethernet line interface if the value of DOT1XSTAT is
1
or
2
.
IP phones respond to 802.1X frames that have the PAE group multicast address as the
destination MAC address only if the value of DOT1XSTAT is 2. If the value of DOT1XSTAT is
changed to 0 from any other value after the Supplicant has been authenticated, an EAPOL-Logoff
will be transmitted before the Supplicant is disabled.
From Release 2.0 onwards, the system parameter DOT1XSTAT determines how the phone
handles Supplicants as follows:
• When DOT1XSTAT = 0, Supplicant operation is completely disabled. This is the default
value.
• When DOT1XSTAT = 1, Supplicant operation is enabled, but responds only to received
unicast EAPOL messages.
• When DOT1XSTAT = 2, Supplicant operation is enabled and responds to received unicast
and multicast EAPOL messages.
Note:
If the Ethernet line interface link fails, the 802.1X Supplicant, if enabled, enters the
Disconnected state.
Related links
on page 140
802.1X supplicant operation
IP phone that support supplicant operation also support Extensible Authentication Protocol (EAP).
For software Release 6.1 and earlier, only the MD5-Challenge authentication method is supported.
For more information about the MD5–Challenge authentication, see IETF RFC 3748.
A supplicant identity (ID) and password of not more than 12 numeric characters are stored in
reprogrammable non-volatile memory. The phone software downloads do not overwrite the ID and
password. The default ID is the MAC address of the phone, converted to ASCII format without
colon separators, and the default password is null. Both the ID and password are set to default
values at manufacture. EAP-Response/Identity frames use the ID in the Type-Data field. EAP-
Response/MD5-Challenge frames use the password to compute the digest for the Value field,
leaving the Name field blank.
When you install a phone for the first time and 802.1x is in effect, the dynamic address process
prompts the installer to enter the supplicant identity and password. The IP phone does not accept
null value passwords.
The IP deskphone stores 802.1X credentials when the phone achieves successful authentication.
Post-installation authentication attempts occur using the stored 802.1X credentials, without
prompting the user for ID and password entry.
Administering your phone
May 2018
Installing and Administering Avaya J169/J179 IP Phone H.323
140