Hello,
We are currently trying to implement 802.1x port authentication and the idea is to use MAB for the Cisco phones and certificate based authentication for the workstations. In the majority of cases the workstation is connected behind the phone so we need the phone to pass on the EAPOL packet to the switch.
When the phone and the computer boot at the same timem for example after shuting down the port, port authentication is working fine and the work station can authenticate using the certificate. After some time the phone is then authencitcated via MAB. However when we then reboot the workstation or unplug the cable it seems that the phone is no longer passing on the EAPOL packet and the workstation is trying MAB instead and is thus put into the guest VLAN.
When using a model 8851 the entire procedure is wotking as expected, also after rebooting or unpluging the workstation it is performing 802.1X
The phone has the following firmware version: SCCP45.9-4-2SR4-3S
The Call Manager is on version 10.5.2.10000-5
The following is the interface config
switchport access vlan <vlan id>
switchport mode access
switchport voice vlan <voice vlan id>
authentication host-mode multi-domain
authentication order dot1x mab
authentication priority dot1x mab
authentication port-control auto
authentication periodic
authentication timer reauthenticate 10800
authentication timer restart 5
authentication violation replace
mab
no snmp trap link-status
dot1x pae authenticator
dot1x timeout quiet-period 2
dot1x timeout tx-period 3
spanning-tree portfast
