Cisco Unified 8961 Vue d'ensemble - Page 22

Parcourez en ligne ou téléchargez le pdf Vue d'ensemble pour {nom_de_la_catégorie} Cisco Unified 8961. Cisco Unified 8961 30 pages. Cisco systems telephone
Également pour Cisco Unified 8961 : Notes de mise à jour (16 pages), Manuel de configuration (4 pages), Manuel d'administration (8 pages), Manuel de l'utilisateur (48 pages), Manuel de l'utilisateur (10 pages), Caractéristiques (35 pages), Démarrage rapide (2 pages), Manuel de l'utilisateur (22 pages), Mise en place (4 pages), Manuel de démarrage rapide (2 pages), Manuel de référence rapide (3 pages), Manuel (12 pages), Référence rapide (4 pages), Coup d'œil rapide (3 pages), Manuel rapide (10 pages), Manuel de démarrage rapide (2 pages), (portugais) Manuel de démarrage rapide (2 pages)

Imprimer la page

Understanding Security Features for Cisco Unified IP Phones

Supporting 802.1X Authentication on Cisco Unified IP Phones

These sections provide information about 802.1X support on the Cisco Unified IP Phones:

•

Overview

Cisco Unified IP phones and Cisco Catalyst switches have traditionally used Cisco Discovery Protocol

(CDP) to identify each other and determine parameters such as VLAN allocation and inline power

requirements. However, CDP is not used to identify any locally attached PCs; therefore, Cisco Unified

IP Phones provide an EAPOL pass-through mechanism, whereby a PC locally attached to the IP phone,

may pass through EAPOL messages to the 802.1X authenticator in the LAN switch. This prevents the

IP phone from having to act as the authenticator, yet allows the LAN switch to authenticate a data

endpoint prior to accessing the network.

In conjunction with the EAPOL pass-through mechanism, Cisco Unified IP Phones provide a proxy

EAPOL-Logoff mechanism. In the event that the locally attached PC is disconnected from the IP phone,

the LAN switch would not see the physical link fail, because the link between the LAN switch and the

IP phone is maintained. To avoid compromising network integrity, the IP phone sends an EAPOL-Logoff

message to the switch, on behalf of the downstream PC, which triggers the LAN switch to clear the

authentication entry for the downstream PC.

The Cisco Unified IP phones also contain an 802.1X supplicant, in addition to the EAPOL pass-through

mechanism. This supplicant allows network administrators to control the connectivity of IP phones to

the LAN switch ports. The current release of the phone 802.1X supplicant uses the EAP-FAST,

EAP-TLS, and EAP-MD5 options for network authentication.

Required Network Components

Support for 802.1X authentication on Cisco Unified IP Phones requires several components, including:

•

Best Practices—Requirements and Recommendations

•

Cisco Unified IP Phone 8961, 9951, and 9971 Administration Guide for Cisco Unified Communications Manager 8.5 (SIP)

1-22

Overview, page 1-22

Required Network Components, page 1-22

Best Practices—Requirements and Recommendations, page 1-22

Cisco Unified IP Phone—The phone acts as the 802.1X supplicant, which initiates the request to

access the network.

Cisco Secure Access Control Server (ACS) (or other third-party authentication server)—The

authentication server and the phone must both be configured with a shared secret that is used to

authenticate the phone.

Cisco Catalyst Switch (or other third-party switch)—The switch must support 802.1X, so it can act

as the authenticator and pass the messages between the phone and the authentication server. When

the exchange is completed, the switch then grants or denies the phone access to the network.

Enable 802.1X Authentication—If you want to use the 802.1X standard to authenticate Cisco

Unified IP Phones, be sure that you have properly configured the other components before enabling

it on the phone. See the

"802.1X Authentication and Transaction Status" section on page 7-15

more information.

Chapter 1

An Overview of the Cisco Unified IP Phone

for

OL-20861-01