Cisco 7942G Administration Guide

1-15
Cisco Unified IP Phone 7962G and 7942G Administration Guide for Cisco Unified Communications Manager 6.1(3)
OL-17679-01
Chapter 1 An Overview of the Cisco Unified IP Phone
Understanding Security Features for Cisco Unified IP Phones
Supporting 802.1X Authentication on Cisco Unified IP Phones
These sections provide information about 802.1X support on the Cisco Unified IP Phones:
• Overview, page 1-15
• Required Network Components, page 1-15
• Best Practices—Requirements and Recommendations, page 1-16
Overview
Cisco Unified IP phones and Cisco Catalyst switches have traditionally used Cisco Discovery Protocol
(CDP) to identify each other and determine parameters such as VLAN allocation and inline power
requirements. However, CDP is not used to identify any locally attached PCs; therefore, Cisco Unified
IP Phones provide an EAPOL pass-through mechanism, whereby a PC locally attached to the IP phone,
may pass through EAPOL messages to the 802.1X authenticator in the LAN switch. This prevents the
IP phone from having to act as the authenticator, yet allows the LAN switch to authenticate a data end
point prior to accessing the network.
In conjunction with the EAPOL pass-through mechanism, Cisco Unified IP Phones provide a proxy
EAPOL-Logoff mechanism. In the event that the locally attached PC is disconnected from the IP phone,
the LAN switch would not see the physical link fail, because the link between the LAN switch and the
IP phone is maintained. To avoid compromising network integrity, the IP phone sends an EAPOL-Logoff
message to the switch, on behalf of the downstream PC, which triggers the LAN switch to clear the
authentication entry for the downstream PC.
The Cisco Unified IP phones also contain an 802.1X supplicant, in addition to the EAPOL pass-through
mechanism. This supplicant allows network administrators to control the connectivity of IP phones to
the LAN switch ports. The 802.1X supplicant implements the EAP-MD5 option for 802.1X
authentication.
Required Network Components
Support for 802.1X authentication on Cisco Unified IP Phones requires several components, including:
• Cisco Unified IP Phone—The phone acts as the 802.1X supplicant, which initiates the request to
access the network.
Non-secure cBarge All participants are encrypted Secure conference bridge
Conference changes to non-secure
Non-secure MeetMe Minimum security level is
encrypted
Initiator receives message “Does not meet Security
Level”, call rejected.
Secure (encrypted) MeetMe Minimum security level is
authenticated
Secure conference bridge
Conference accepts encrypted and authenticated
calls
Secure (encrypted) MeetMe Minimum security level is
non-secure
Only secure conference bridge available and used
Conference accepts all calls
Table 1-5 Security Restrictions with Conference Calls (continued)
Initiator’s Phone
Security Level Feature Used Security Level of Participants Results of Action

Cisco 7942G Specifications

General

Brand	Cisco
Model	7942G
Category	IP Phone
Language	English