topic Re: How to use XMC to configure Unify phone or Cisco Phone with LLDP-MED in ExtremeCloud IQ- Site Engine Management Center

How to use XMC to configure Unify phone or Cisco Phone with LLDP-MED

Giuseppe_Montan — Wed, 15 Dec 2021 00:25:29 GMT

Hi everyone,
I have an XMC system and X440 switches. I need to authenticate unify or Cisco phones using the LLDP-MED protocol.
Is this possible?
I have created a policy in the NAC that analyzes the mac-address but I want to exploit the potential of the LLDP-MED protocol and XMC to configure the phone with the vlan correct (egress tagged for voip and pvid untagged for data for example ). Thanks to all
Giuseppe

Re: How to use XMC to configure Unify phone or Cisco Phone with LLDP-MED

Zdeněk_Pala — Wed, 15 Dec 2021 10:55:42 GMT

Hi Giuseppe.
there are several options:

use NAC (ExtremeControl). Based on MAC address (OUI or list) you can assign the policy through Radius Access Accept
use UPM scripting. Based on the event generated by the switch the switch can assign policy to the port. check the Universal Port section of the documentation = https://documentation.extremenetworks.com/exos_31.5/GUID-7C3FD5E9-0088-4BFA-82C9-954A70BB9A52.shtml

Re: How to use XMC to configure Unify phone or Cisco Phone with LLDP-MED

Giuseppe_Montan — Wed, 15 Dec 2021 11:25:34 GMT

Hi Zdeněk Pala, I have XMC and NAC. I have created a policy to check OUI and it works but only whit the port untagged.
I am not able to add lldp parameter to put the phone on the "voice vlan " as tagged.

Thanks
Giuseppe

Re: How to use XMC to configure Unify phone or Cisco Phone with LLDP-MED

Zdeněk_Pala — Wed, 15 Dec 2021 11:37:36 GMT

I see these options:

assign tagged VLAN by policy = switch will send frames with VLAN ID and configure LLDP-MED statically to tell the phone to tag its own traffic
assign tagged VLAN by policy + use UPM script to configure and reconfigure the LLDP-MED dynamically
use untagged traffic for both voice and user data, the switch will assign the VLAN based on policy. Not all phones are happy with untagged traffic

here is an example of EXOS config for the option dynamic command execution as a result of radius access accept:

Here is the radius attribute:

Extreme-Security-Profile=UserLogonProfile;LOGOFF-PROFILE=UserLogoffProfile;

Here is the UPM:

X440G2.1 # sh upm profile

================================================================================

UPM Profile Events Flags Ports

================================================================================

UserLogoffProfile user-unauthenticated e 1-6

UserLogonProfile user-authenticated e 1-6

================================================================================

Number of UPM Profiles: 2

Number of UPM Events in Queue for execution: 0

Flags: d - disabled, e - enabled

Event name: log-message(Log filter name) - Truncated to 20 chars

X440G2.2 # sh configuration upm

# Module upm configuration.

create upm profile UserLogoffProfile

create log message "Logoff EnterpriseUser UPM executed"

create upm profile UserLogonProfile

create log message "Logon EnterpriseUser UPM executed"

configure upm event user-authenticate profile UserLogonProfile ports 1-6

configure upm event user-unauthenticated profile UserLogoffProfile ports 1-6

Re: How to use XMC to configure Unify phone or Cisco Phone with LLDP-MED

Zdeněk_Pala — Wed, 15 Dec 2021 11:48:00 GMT

I would use the option 1: assign tagged VLAN by policy = switch will send frames with VLAN ID and configure LLDP-MED statically to tell the phone to tag its own traffic

Re: How to use XMC to configure Unify phone or Cisco Phone with LLDP-MED

Giuseppe_Montan — Wed, 15 Dec 2021 13:31:51 GMT

Hi Zdeněk Pala

Before try to use XMC I have configured UPM and everything works,with XMC I can not configure static lldp without configure the port dedicated to Voip as tagged, I can configure lldp only after I connect the phone to the switch.

At the moment I can use XMC-NAC only if I want to configure Voip on untagged port.

Giuseppe

Re: How to use XMC to configure Unify phone or Cisco Phone with LLDP-MED

Zdeněk_Pala — Wed, 15 Dec 2021 15:13:09 GMT

Ok.

The Radius Access-Accept can contain both the Policy and script name for logon and the script name for logoff.

Then EXOS will execute the UPM script, the script will configure LLDP-MED

I shared an example...