 |
|
|
|
This document describes how ProCurve switches and Avaya 4600 Series IP phones interoperate to build a secure and easy-to-manage network. Both the switch and the phone rely on standard protocols:
- 802.3af, standard for Power-over-Ethernet (PoE) enables the switch to allocate up to 15.4W of power per port.
- Quality-of-Service (QoS) mechanisms enable the network to give voice flow—which is sensitive to delay, jitter and packet loss—priority over the data traffic, to guarantee that the communications will continue in case of congestion.
- LLDP-MED is a discovery protocol that enables switches to get some layer 2 information about a phone (such as its model, firmware, location, etc.) and automatically allocate certain network parameters (VLAN and QoS) to the phone.
- 802.1X is the most recommended authentication method for access control on the network. It is recognized as a standard, and is implemented by most IP telephony constructors. Multiple 802.1X authentication enables authentication both of a phone plugged into a switch and of a user plugged into the dual port of the phone, while assigning them different profiles (VLAN, QoS, bandwidth).
» Return to top
|
|
|
|
|
|
The platform contains:
- One or more servers with the following services: Active Directory, DHCP, DNS, Certificate Authority, IAS.
- Latest versions of ProCurve Manager Plus (PCM+) and Identity-Driven Manager (IDM).
- Avaya 4625SW IP Telephone.
- A ProVision Switch 3500yl or 2610-PWR with the latest firmware version. A similar configuration can also be used with a ProCurve 5400zl series switch or a 8212zl series switch. The configuration commands are identical for these products and the 3500yl.
- A client laptop that can be plugged into the phone dual port for multiple authentication tests or used as a network analyzer (e.g., Wireshark).
Figure 1. Setup for ProCurve-Avaya interoperability
» Return to top
|
|
|
|
|
|
This section explains how to configure Quality of Service parameters.
4.1 Configure QoS on the Avaya phone
Avaya 4600 Series IP Telephones support 802.1p and DSCP configuration (except for the 4601 IP Telephone, which does not support setting QoS options).
To configure QoS on the Avaya phone:
- Press Mute 7 6 7 # (for Mute QoS #). You see the following screen displayed:
L2 audio=d
New=_
- Enter a value between 0 and 7 for the 802.1p priority of the voice signal. Then press #. You see the next screen displayed:
L2 signaling=d
New=_
- Enter a value between 0 and 7 for the 802.1p priority of the signaling data. Then press #. You see the following screen displayed:
L3 audio=dd
New=_
- Enter a value between 0 and 63 for the DSCP value of the voice signal. Then press #. You see the following screen displayed:
- Enter a value between 0 and 63 for the DSCP value of the signaling data. Then press #. You see the question:
- Click # to answer yes and save the values.
» Return to top
4.2 Configure QoS on the ProCurve switch
The recommended method is to have a dedicated VLAN for voice and configure the QoS parameters for the VLAN.
The L2 and DSCP policy advertised are based on the actual QoS configuration for the voice VLAN. By default these values are:
- L2 priority 6
- DSCP 46, which corresponds to the Expedited Forwarding (EF) class
To modify the 802.1p or DSCP values:
To view which DSCP and QoS values are configured:
For more information on QoS settings on ProCurve switches, please refer to the following documents:
» Return to top
|
|
|
|
|
|
This section explains how to configure 802.1X support.
6.1 About 802.1X support on the Avaya phone
Beginning with software Release 2.6 Avaya 4600 Series IP Telephones support 802.1X authentication, with three modes:
- Pass-through: The telephone forwards 802.1X multicast packets between the switch and the PC attached to the dual port.
- Pass-through with proxy logoff: Same mode as pass-through, but with proxy logoff supported. This function enables the phone to send the switch an EAPOL-Logoff packet on behalf of the PC if the PC becomes disconnected.
- Supplicant: The telephone forwards packets between the switch and the telephone only, and ignores 802.1X multicast packets from the attached PC. Proxy logoff is not supported. This supplicant mode supports EAPMD5.
A Supplicant identity (ID) and password of no more than 12 numeric characters are stored in reprogrammable
non-volatile memory. The default ID is the MAC address of the telephone, converted to ASCII format without
colon separators, and the default password is null.
When a telephone is installed for the first time and 802.1X is in effect, the dynamic address process prompts
the installer to enter the Supplicant identity and password. The IP telephone does not accept null value
passwords. The IP telephone stores 802.1X credentials when successful authentication is achieved. Postinstallation
authentication attempts occur using the stored 802.1X credentials, without prompting the user for
ID and password entry.
Unicast packets between the switch and the telephone or the PC are always properly forwarded, regardless of the
mode.
» Return to top
6.2 Configure 802.1X on the Avaya phone
To configure 802.1X on the Avaya IP Telephone:
- Press Mute 8 0 2 1 9 # (for Mute 802.1X). You see the following screen:
Where setting is the current value of the system value DOTIX (802.1X Supplicant Mode), defined as:
- Unicast Supplicant operation only with PAE multicast pass-through, without logoff if setting = 0
- Unicast Supplicant operation only with PAE multicast pass-through and proxy logoff if setting = 1
- Unicast or multicast Supplicant operation without PAE multicast pass-through or proxy logoff if setting = 2
» Return to top
6.3 Configure 802.1X on the ProCurve switch
To configure 802.1X on the switch:
- Enable 802.1X on the phone ports:
- Enable 802.1X on the phone ports:
Example: This shows the results when a username of 12345 and a password of 12345 are configured on the Avaya
phone. The authentication success appears in the IAS RADIUS log:
» Return to top
6.4 Configure multiple 802.1X sessions
To configure multiple 802.1X sessions:
- Modify the switch configuration for the port connected to the phone. Configure it so the voice VLAN is tagged and the data VLAN untagged.
- Set the client-limit parameter on the switch to 3 to enable both the PC and the phone to authenticate. For example:
- On the Avaya IP Telephone, ensure the 802.1X mode is set to 1 (pass-through with proxy-logoff) to enable both the PC and the phone to authenticate.
After configuration, you can see both authentications. On the phone:
On the PC:
The data VLAN can also be dynamically assigned using Identity Driven Manager. For example:
» Return to top
|
|
|
|
|
|
This concludes the procedures for interoperating ProCurve switches and Avaya telephones.
For further information about how to configure ProCurve switches to support convergence, please refer to the following links:
For information on Avaya phones please refer to the following links:
» Return to top
|
|
|
