We have a situation where when ISE does a dynamic VLAN assignment for the voice VLAN, the voice device doe snot auth like it should. From what we can tell ISE is doing it's job. Auth logs on ISE show the phone being properly identified and assigned the VLAN/DACL/VOICE domain as expected. RADIUS debug on the switch confirms that the switch is getting the correct VLAN, but the switch appears not to apply it properly.
The switches that we are using are 2960S & 2960X switches with at the 15.2.2.e4 as the code level. Per the documentation you need to be at least at version 15.2.2.e3 to support ISE. We see this behavior on both models of 2960's.
We have tried the following:
- No voice VLAN defined: this resulted in the auth session being put in
the voice domain, but not applying the vlan that ISE assigned and the
status was "Unauth" rather than the usual "Auth" status.
- Voice VLAN defined as quarantine VLAN: same result as above
- Voice VLAN defined as usual/correct VLAN for the switch: works
great. But we're trying to avoid having to manually specify the voice
VLAN on all switch ports.
- Removed voice domain from the ISE authorization policy. This,
surprisingly, worked-- kinda. The switch used the VLAN specified by ISE
for the phone's auth session, but in the data domain. But this won't
play nice with "multi-domain" authorization-- since the phone and the
workstation behind it are both put in the "data" domain, only one of
them will function at a time.
Looking over documentation and others trials and tribulations, this should work with the voice domain checked from the ISE authentication policy, The phone never gets authed, but on the data side all appears to work as expected.
Has anyone had this work as expected with the data & voice both being dynamically assigned.
Thanks,
Sam
