Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

VoIP on EX Series Switches

 

You can configure voice over IP (VoIP) on an EX Series switch to support IP telephones. When you use VoIP, you can connect IP telephones to the switch and configure IEEE 802.1X authentication for 802.1X-compatible IP telephones. For more information, read this topic.

Understanding 802.1X and VoIP on EX Series Switches

When you use VoIP, you can connect IP telephones to the switch and configure IEEE 802.1X authentication for 802.1X-compatible IP telephones. The 802.1X authentication provides network edge security, protecting Ethernet LANs from unauthorized user access.

VoIP is a protocol used for the transmission of voice through packet-switched networks. VoIP transmits voice calls by using a network connection instead of an analog phone line.

When VoIP is used with 802.1X, the RADIUS server authenticates the phone, and Link Layer Discovery Protocol–Media Endpoint Discovery (LLDP-MED) provides the class-of-service (CoS) parameters to the phone.

You can configure 802.1X authentication to work with VoIP in multiple supplicant or single supplicant mode. In multiple supplicant mode, the 802.1X process allows multiple supplicants to connect to the interface. Each supplicant is authenticated individually. For an example of a VoIP multiple supplicant topology, see Figure 1.

Figure 1: VoIP Multiple Supplicant Topology
VoIP Multiple Supplicant
Topology

If an 802.1X-compatible IP telephone does not have an 802.1X host but has another 802.1X-compatible device connected to its data port, you can connect the phone to an interface in single supplicant mode. In single supplicant mode, the 802.1X process authenticates only the first supplicant. All other supplicants who connect later to the interface are allowed full access without any further authentication. They effectively “piggyback” on the first supplicant’s authentication. For an example of a VoIP single supplicant topology, see Figure 2 .

Figure 2: VoIP Single Supplicant Topology
VoIP Single Supplicant Topology

If an IP telephone does not support 802.1X, you can configure VoIP to bypass 802.1X and LLDP-MED and have the packets forwarded to a VoIP VLAN.

Multi Domain 802.1X Authentication

Multi-domain 802.1X authentication is an extension of multiple supplicant mode that allows one default VoIP device and multiple data devices to authenticate on a single port. Multi-domain 802.1X authentication provides enhanced security over multiple supplicant mode by restricting the number of authenticated data and VoIP sessions on the port. In multiple supplicant mode, any number of VoIP or data sessions can be authenticated; the number of sessions can be restricted using MAC limiting, but there is no way to apply the limit specifically to either data or VoIP sessions.

With multi-domain 802.1X authentication, the single port is divided into two domains; one is the data domain and the other is the voice domain. Multi-domain 802.1X authentication maintains separate session counts based on the domain. You can configure the maximum number of authenticated data sessions allowed on the port. The number of VoIP sessions is not configurable; only one authenticated VoIP session is allowed on the port.

If a new client attempts to authenticate on the interface after the maximum session count has been reached, the default action is to drop the packet and generate an error log message. You can also configure the action to shut down the interface. The port can be manually recovered from the down state by issuing the clear dot1x recovery-timeout command, or by can recover automatically after a configured recovery timeout period.

Multi-domain authentication does not enforce the order of device authentication. However, for the best results, the VoIP device should be authenticated before a data device on a multi domain 802.1X-enabled port. Multi-domain authentication is supported only in multiple supplicant mode.

Example: Setting Up VoIP with 802.1X and LLDP-MED on an EX Series Switch

You can configure voice over IP (VoIP) on an EX Series switch to support IP telephones. The Link Layer Discovery Protocol–Media Endpoint Discovery (LLDP-MED) protocol forwards VoIP parameters from the switch to the phone. You also configure 802.1X authentication to allow the telephone access to the LAN. Authentication is done through a backend RADIUS server.

This example describes how to configure VoIP on an EX Series switch to support an Avaya IP phone, as well as the LLDP-MED protocol and 802.1X authentication:

Note

If your switch runs Junos OS for EX Series switches with support for the Enhanced Layer 2 Software (ELS) configuration style, see Example: Setting Up VoIP with 802.1X and LLDP-MED on an EX Series Switch with ELS Support. For ELS details, see Using the Enhanced Layer 2 Software CLI.

Requirements

This example uses the following hardware and software components:

  • Junos OS Release 9.1 or later for EX Series switches

  • One EX Series switch acting as an authenticator port access entity (PAE). The interfaces on the authenticator PAE form a control gate that blocks all traffic to and from supplicants until they are authenticated.

  • An Avaya 9620 IP telephone that supports LLDP-MED and 802.1X

Before you configure VoIP, be sure you have:

Note

If the IP address isn't configured on the Avaya IP phone, the phone exchanges LLDP-MED information to get the VLAN ID for the voice VLAN. You must configure the voip statement on the interface to designate the interface as a VoIP interface and allow the switch to forward the VLAN name and VLAN ID for the voice VLAN to the IP telephone. The IP telephone then uses the voice VLAN (that is, it references the voice VLAN’s ID) to send a DHCP discover request and exchange information with the DHCP server (voice gateway).

Overview and Topology

Instead of using a regular telephone, you connect an IP telephone directly to the switch. An IP phone has all the hardware and software needed to handle VoIP. You also can power an IP telephone by connecting it to one of the Power over Ethernet (PoE) interfaces on the switch.

In this example, the access interface ge-0/0/2 on the EX4200 switch is connected to an Avaya 9620 IP telephone. Avaya phones have a built-in bridge that allows you to connect a desktop PC to the phone, so the desktop and phone in a single office require only one interface on the switch. The EX Series switch is connected to a RADIUS server on interface ge-0/0/10 (see Figure 3).

Figure 3: VoIP Topology
VoIP Topology

In this example, you configure VoIP parameters and specify the forwarding class assured-forward for voice traffic to provide the highest quality of service.

Table 1 describes the components used in this VoIP configuration example.

Table 1: Components of the VoIP Configuration Topology

PropertySettings

Switch hardware

EX4200 switch

VLAN names

data-vlan

voice-vlan

Connection to Avaya phone—with integrated hub, to connect phone and desktop PC to a single interface (requires PoE)

ge-0/0/2

One RADIUS server

Provides backend database connected to the switch through interface ge-0/0/10.

As well as configuring a VoIP for interface ge-0/0/2, you configure:

  • 802.1X authentication. Authentication is set to multiple supplicant to support more than one supplicant's access to the LAN through interface ge-0/0/2.

  • LLDP-MED protocol information. The switch uses LLDP-MED to forward VoIP parameters to the phone. Using LLDP-MED ensures that voice traffic gets tagged and prioritized with the correct values at the source itself. For example, 802.1p class of service and 802.1Q tag information can be sent to the IP telephone.

    Note

    A PoE configuration is not necessary if an IP telephone is using a power adapter.

Configuration

To configure VoIP, LLDP-MED, and 802.1X authentication:

CLI Quick Configuration

To quickly configure VoIP, LLDP-MED, and 802.1X, copy the following commands and paste them into the switch terminal window:

[edit]


set vlans data-vlan vlan-id 77


set vlans voice-vlan vlan-id 99


set vlans data-vlan interface ge-0/0/2.0


set interfaces ge-0/0/2 unit 0 family ethernet-switching vlan members data-vlan


set interfaces ge-0/0/2 unit 0 family ethernet-switching port-mode access


set ethernet-switching-options voip interface ge-0/0/2.0 vlan voice-vlan


set ethernet-switching-options voip interface ge-0/0/2.0 forwarding-class assured-forwarding


set protocols lldp-med interface ge-0/0/2.0


set protocols dot1x authenticator interface ge-0/0/2.0 supplicant multiple

Step-by-Step Procedure

To configure VoIP with LLDP-MED and 802.1X:

  1. Configure the VLANs for voice and data:
    [edit vlans]

    user@switch# set data-vlan vlan-id 77

    user@switch# set voice-vlan vlan-id 99
  2. Associate the VLAN data-vlan with the interface:
    [edit vlans]

    user@switch# set data-vlan interface ge-0/0/2.0

  3. Configure the interface as an access interface, configure support for Ethernet switching, and add the data-vlan VLAN:
    [edit interfaces]

    user@switch# set ge-0/0/2 unit 0 family ethernet-switching vlan members data-vlan

    user@switch# set ge-0/0/2 unit 0 family ethernet-switching port-mode access
  4. Configure VoIP on the interface and specify the assured-forwarding forwarding class to provide the most dependable class of service:
    [edit ethernet—switching—options]

    user@switch# set voip interface ge-0/0/2.0 vlan voice-vlan

    user@switch# set voip interface ge-0/0/2.0 forwarding-class assured-forwarding

  5. Configure LLDP-MED protocol support:
    [edit protocols]

    user@switch# set lldp-med interface ge-0/0/2.0

  6. To authenticate an IP phone and a PC connected to the IP phone on the interface, configure 802.1X authentication support and specify multiple supplicant mode:Note

    If you do not want to authenticate any device, skip the 802.1X configuration on this interface.

    [edit protocols]

    user@switch# set dot1x authenticator interface ge-0/0/2.0 supplicant multiple

Results

Display the results of the configuration:

Verification

To confirm that the configuration is working properly, perform these tasks:

Verifying LLDP-MED Configuration

Purpose

Verify that LLDP-MED is enabled on the interface.

Action

user@switch> show lldp detail

Meaning

The show lldp detail output shows that both LLDP and LLDP-MED are configured on the ge-0/0/2.0 interface. The end of the output shows the list of supported LLDP basic TLVs, 802.3 TLVs, and LLDP-MED TLVs that are supported.

Verifying 802.1X Authentication for IP Phone and Desktop PC

Purpose

Display the 802.1X configuration to confirm that the VoIP interface has access to the LAN.

Action

user@switch> show dot1x interface ge/0/0/2.0 detail

Meaning

The field Role shows that the ge-0/0/2.0 interface is in the authenticator state. The Supplicant field shows that the interface is configured in multiple supplicant mode, permitting multiple supplicants to be authenticated on this interface. The MAC addresses of the supplicants currently connected are displayed at the bottom of the output.

Verifying the VLAN Association with the Interface

Purpose

Display the interface state and VLAN membership.

Action

Meaning

The field VLAN members shows that the ge-0/0/2.0 interface supports both the data-vlan VLAN and voice-vlan VLAN. The State field shows that the interface is up.

Example: Configuring VoIP on an EX Series Switch Without Including LLDP-MED Support

You can configure voice over IP (VoIP) on an EX Series switch to support IP telephones. The Link Layer Discovery Protocol–Media Endpoint Discovery (LLDP-MED) protocol is sometimes used with IP phones to forward VoIP parameters from the switch to the phone. However, not all IP phones support LLDP-MED.

This example describes how to configure VoIP on an EX Series switch without using LLDP-MED:

Requirements

This example uses the following hardware and software components:

  • One EX Series switch with support for ELS acting as an authenticator port access entity (PAE). The interfaces on the authenticator PAE form a control gate that blocks all traffic to and from supplicants until they are authenticated.

  • An IP phone that does not support LLDP-MED.

  • Junos OS Release 13.2X50 or later for EX Series switches.

Before you configure VoIP, be sure you have:

Overview

Instead of using a regular telephone, you connect an IP telephone directly to the switch. An IP phone has all the hardware and software needed to handle VoIP. You can also power an IP telephone by connecting it to one of the Power over Ethernet (PoE) interfaces on the switch.

EX Series switches can accommodate an IP telephone and end host connected to a single switch port. In such a scenario, voice and data traffic must be separated into different broadcast domains, or VLANs. One method for accomplishing this is by configuring a voice VLAN, which enables access ports to accept untagged data traffic as well as tagged voice traffic from IP phones, and associate each type of traffic with separate and distinct VLANs. Voice traffic (tagged) can then be treated differently, generally with a higher priority than data traffic (untagged).

The voice VLAN delivers the greatest benefit when used with IP phones that support LLDP-MED, but it is flexible enough that IP phones that do not support LLDP-MED can also use it effectively. However, in the absence of LLDP-MED, the voice VLAN ID must be set manually on the IP phone because LLDP-MED is not available to accomplish this dynamically. For information about setting up a voice VLAN for IP phones that support LLDP-MED, see Example: Setting Up VoIP with 802.1X and LLDP-MED on an EX Series Switch with ELS Support.

Another method to separate voice (tagged) and data (untagged) traffic into different VLANs is to use a trunk port with the native VLAN ID option. The trunk port is added as a member of the voice VLAN, and processes only tagged voice traffic from that VLAN. The trunk port must also be configured with the native VLAN ID for the data VLAN so that it can process untagged data traffic from the data VLAN. This configuration also requires that the voice VLAN ID be set manually on the IP phone.

This example illustrates both methods. In this example, the interface ge-0/0/2 on the switch is connected to a non-LLDP-MED IP phone.

Note

The implementation of a voice VLAN on an IP telephone is vendor-specific. Consult the documentation that came with your IP telephone for instructions on configuring a voice VLAN. For example, on an Avaya phone, you can ensure that the phone gets the correct VoIP VLAN ID even in the absence of LLDP-MED by enabling DHCP option 176.

Configuring VoIP Without LLDP-MED by Using a Voice VLAN on an Access Port

CLI Quick Configuration

To quickly configure VoIP, copy the following commands and paste them into the switch terminal window:

[edit]


set vlans data-vlan vlan-id 77


set vlans voice-vlan vlan-id 99


set vlans data-vlan switch-options interface ge-0/0/2.0


set interfaces ge-0/0/2 unit 0 family ethernet-switching port-mode access


set interfaces ge-0/0/2 unit 0 family ethernet-switching vlan members data-vlan


set switch-options voip interface ge-0/0/2.0 vlan voice-vlan


set switch-options voip interface ge-0/0/2.0 forwarding-class assured-forwarding






Step-by-Step Procedure

  1. Configure two VLANs: one for data traffic and one for voice traffic:
    [edit vlans]

    user@switch# set data-vlan vlan-id 77

    user@switch# set voice-vlan vlan-id 99
    Note

    The voice VLAN ID must be set manually on the IP phone.

  2. Associate the VLAN data-vlan with the interface ge-0/0/2:
    [edit vlans]

    user@switch# set data-vlan switch-options interface ge-0/0/2.0

  3. Configure the interface ge-0/0/2 as an access port belonging to the data VLAN:
    [edit interfaces]

    user@switch# set ge-0/0/2 unit 0 family ethernet-switching port-mode access

    user@switch# set ge-0/0/2 unit 0 family ethernet-switching vlan member data-vlan

  4. Configure VoIP on the interface ge-0/0/2 and add this interface to the voice VLAN:
    [edit switch-options]

    user@switch# set voip interface ge-0/0/2.0 vlan voice-vlan
  5. Specify the assured-forwarding forwarding class to provide the most dependable class of service:
    [edit switch-options]

    user@switch# set voip interface ge-0/0/2.0 forwarding-class assured-forwarding

Results

Display the results of the configuration:

Configuring VoIP Without LLDP-MED by Using a Trunk Port with Native VLAN Option

CLI Quick Configuration

To quickly configure VoIP, copy the following commands and paste them into the switch terminal window:

[edit]


set vlans data-vlan vlan-id 77


set vlans voice-vlan vlan-id 99


set interfaces ge-0/0/2 unit 0 family ethernet-switching port-mode trunk


set interfaces ge-0/0/2 unit 0 family ethernet-switching vlan members voice-vlan


set interfaces ge-0/0/2 unit 0 family ethernet-switching native-vlan-id data-vlan

Step-by-Step Procedure

  1. Configure two VLANs: one for data traffic and one for voice traffic:
    [edit vlans]

    user@switch# set data-vlan vlan-id 77

    user@switch# set voice-vlan vlan-id 99
    Note

    The voice VLAN ID must be set manually on the IP phone.

  2. Configure interface ge-0/0/2 as a trunk port that includes only the voice VLAN:
    [edit interfaces]

    user@switch# set ge-0/0/2 unit 0 family ethernet-switching port-mode trunk

    user@switch# set ge-0/0/2 unit 0 family ethernet-switching vlan member voice-vlan
  3. Configure the native VLAN ID for the data VLAN on the trunk port:
    [edit interfaces]

    user@switch# set ge-0/0/2 unit 0 family ethernet-switching native-vlan-id data-vlan

Results

Display the results of the configuration:

Verification

To confirm that the configuration is working properly, perform the following task:

Verifying the VLAN Association With the Interface

Purpose

Display the interface state and VLAN membership.

Action

Meaning

The field VLAN members shows that the ge-0/0/2.0 interface supports both the data VLAN, data-vlan, and the voice VLAN, voice-vlan. The State field shows that the interface is up.

Example: Configuring VoIP on an EX Series Switch Without Including LLDP-MED Support

You can configure voice over IP (VoIP) on an EX Series switch to support IP telephones. The Link Layer Discovery Protocol–Media Endpoint Discovery (LLDP-MED) protocol is sometimes used with IP phones to forward VoIP parameters from the switch to the phone. However, not all IP phones support LLDP-MED.

This example describes how to configure VoIP on an EX Series switch without using LLDP-MED:

Requirements

This example uses the following hardware and software components:

  • One EX4200 switch acting as an authenticator port access entity (PAE). The interfaces on the authenticator PAE form a control gate that blocks all traffic to and from supplicants until they are authenticated.

  • An IP phone that does not support LLDP-MED.

  • Junos OS Release 9.1 or later for EX Series switches.

Before you configure VoIP, be sure you have:

Overview

Instead of using a regular telephone, you connect an IP telephone directly to the switch. An IP phone has all the hardware and software needed to handle VoIP. You can also power an IP telephone by connecting it to one of the Power over Ethernet (PoE) interfaces on the switch.

EX Series switches can accommodate an IP telephone and end host connected to a single switch port. In such a scenario, voice and data traffic must be separated into different broadcast domains, or VLANs. One method for accomplishing this is by configuring a voice VLAN, which enables access ports to accept untagged data traffic as well as tagged voice traffic from IP phones, and associate each type of traffic with separate and distinct VLANs. Voice traffic (tagged) can then be treated differently, generally with a higher priority than data traffic (untagged).

The voice VLAN delivers the greatest benefit when used with IP phones that support LLDP-MED, but it is flexible enough that IP phones that do not support LLDP-MED can also use it effectively. However, in the absence of LLDP-MED, the voice VLAN ID must be set manually on the IP phone because LLDP-MED is not available to accomplish this dynamically. For information about setting up a voice VLAN for IP phones that support LLDP-MED, see Example: Setting Up VoIP with 802.1X and LLDP-MED on an EX Series Switch.

Another method to separate voice (tagged) and data (untagged) traffic into different VLANs is to use a trunk port with the native VLAN ID option. The trunk port is added as a member of the voice VLAN, and processes only tagged voice traffic from that VLAN. The trunk port must also be configured with the native VLAN ID for the data VLAN so that it can process untagged data traffic from the data VLAN. This configuration also requires that the voice VLAN ID be set manually on the IP phone.

This example illustrates both methods. In this example, the interface ge-0/0/2 on the EX4200 switch is connected to a non-LLDP-MED IP phone.

Note

The implementation of a voice VLAN on an IP telephone is vendor-specific. Consult the documentation that came with your IP telephone for instructions on configuring a voice VLAN. For example, on an Avaya phone, you can ensure that the phone gets the correct VoIP VLAN ID even in the absence of LLDP-MED by enabling DHCP option 176.

Configuring VoIP Without LLDP-MED by Using a Voice VLAN on an Access Port

CLI Quick Configuration

To quickly configure VoIP, copy the following commands and paste them into the switch terminal window:

[edit]


set vlans data-vlan vlan-id 77


set vlans voice-vlan vlan-id 99


set vlans data-vlan interface ge-0/0/2.0


set interfaces ge-0/0/2 unit 0 family ethernet-switching port-mode access


set interfaces ge-0/0/2 unit 0 family ethernet-switching vlan members data-vlan


set ethernet-switching-options voip interface ge-0/0/2.0 vlan voice-vlan








Step-by-Step Procedure

  1. Configure two VLANs: one for data traffic and one for voice traffic:
    [edit vlans]

    user@switch# set data-vlan vlan-id 77

    user@switch# set voice-vlan vlan-id 99
    Note

    The voice VLAN ID must be set manually on the IP phone.

  2. Configure the VLAN data-vlan on the interface ge-0/0/2:
    [edit vlans]

    user@switch# set data-vlan interface ge-0/0/2.0

  3. Configure the interface ge-0/0/2 as an access port belonging to the data VLAN:
    [edit interfaces]

    user@switch# set ge-0/0/2 unit 0 family ethernet-switching port-mode access

    user@switch# set ge-0/0/2 unit 0 family ethernet-switching vlan member data-vlan

  4. Configure VoIP on the interface ge-0/0/2 and add this interface to the voice VLAN:
    [edit ethernet-switching-options]

    user@switch# set voip interface ge-0/0/2.0 vlan voice-vlan

Results

Display the results of the configuration:

Configuring VoIP Without LLDP-MED by Using a Trunk Port with Native VLAN Option

CLI Quick Configuration

To quickly configure VoIP, copy the following commands and paste them into the switch terminal window:

[edit]


set vlans data-vlan vlan-id 77


set vlans voice-vlan vlan-id 99


set interfaces ge-0/0/2 unit 0 family ethernet-switching port-mode trunk


set interfaces ge-0/0/2 unit 0 family ethernet-switching vlan members voice-vlan


set interfaces ge-0/0/2 unit 0 family ethernet-switching native-vlan-id data-vlan

Step-by-Step Procedure

  1. Configure two VLANs: one for data traffic and one for voice traffic:
    [edit vlans]

    user@switch# set data-vlan vlan-id 77

    user@switch# set voice-vlan vlan-id 99
    Note

    The voice VLAN ID must be set manually on the IP phone.

  2. Configure interface ge-0/0/2 as a trunk port that includes only the voice VLAN:
    [edit interfaces]

    user@switch# set ge-0/0/2 unit 0 family ethernet-switching port-mode trunk

    user@switch# set ge-0/0/2 unit 0 family ethernet-switching vlan member voice-vlan
  3. Configure the native VLAN ID for the data VLAN on the trunk port:
    [edit interfaces]

    user@switch# set ge-0/0/2 unit 0 family ethernet-switching native-vlan-id data-vlan

Results

Display the results of the configuration:

Verification

To confirm that the configuration is working properly, perform the following task:

Verifying the VLAN Association With the Interface

Purpose

Display the interface state and VLAN membership.

Action

Meaning

The field VLAN members shows that the ge-0/0/2.0 interface supports both the data VLAN, data-vlan, and the voice VLAN, voice-vlan. The State field shows that the interface is up.

Example: Configuring VoIP on an EX Series Switch Without Including 802.1X Authentication

You can configure voice over IP (VoIP) on an EX Series switch to support IP telephones.

To configure VoIP on an EX Series switch to support an IP phone that does not support 802.1X authentication, you must either add the MAC address of the phone to the static MAC bypass list or enable MAC RADIUS authentication on the switch.

This example describes how to configure VoIP on an EX Series switch without 802.1X authentication using static MAC bypass of authentication:

Requirements

This example uses the following hardware and software components:

  • Junos OS Release 9.1 or later for EX Series switches

  • An IP telephone

Before you configure VoIP, be sure you have:

Note

If the IP address isn't configured on the Avaya IP phone, the phone exchanges LLDP-MED information to get the VLAN ID for the voice VLAN. You must configure the voip statement on the interface to designate the interface as a VoIP interface and allow the switch to forward the VLAN name and VLAN ID for the voice VLAN to the IP telephone. The IP telephone then uses the voice VLAN (that is, it references the voice VLAN’s ID) to send a DHCP discover request and exchange information with the DHCP server (voice gateway).

Overview

Instead of using a regular telephone, you connect an IP telephone directly to the switch. An IP phone has all the hardware and software needed to handle VoIP. You also can power an IP telephone by connecting it to one of the Power over Ethernet (PoE) interfaces on the switch.

In this example, the access interface ge-0/0/2 on the EX4200 switch is connected to a non-802.1X IP phone.

To configure VoIP on an EX Series switch to support an IP phone that does not support 802.1X authentication, add the MAC address of the phone as a static entry in the authenticator database and set the supplicant mode to multiple.

Configuration

To configure VoIP without 802.1X authentication:

CLI Quick Configuration

To quickly configure VoIP, copy the following commands and paste them into the switch terminal window:

[edit]


set vlans data-vlan vlan-id 77


set vlans voice-vlan vlan-id 99


set vlans data-vlan interface ge-0/0/2.0


set interfaces ge-0/0/2 unit 0 family ethernet-switching vlan members data-vlan


set interfaces ge-0/0/2 unit 0 family ethernet-switching port-mode access


set ethernet-switching-options voip interface ge-0/0/2.0 vlan voice-vlan


set ethernet-switching-options voip interface ge-0/0/2.0 forwarding-class assured-forwarding


set protocols lldp-med interface ge-0/0/2.0


set protocols dot1x authenticator authentication-profile-name auth-profile


set protocols dot1x authenticator static 00:04:f2:11:aa:a7


set protocols dot1x authenticator interface ge-0/0/2.0 supplicant multiple


Step-by-Step Procedure

To configure VoIP without 802.1X:

  1. Configure the VLANs for voice and data:
    [edit vlans]

    user@switch# set data-vlan vlan-id 77

    user@switch# set voice-vlan vlan-id 99
  2. Associate the VLAN data-vlan with the interface:
    [edit vlans]

    user@switch# set data-vlan interface ge-0/0/2.0

  3. Configure the interface as an access interface, configure support for Ethernet switching, and add the data-vlan VLAN:
    [edit interfaces]

    user@switch# set ge-0/0/2 unit 0 family ethernet-switching vlan members data-vlan

    user@switch# set ge-0/0/2 unit 0 family ethernet-switching port-mode access
  4. Configure VoIP on the interface and specify the assured-forwarding forwarding class to provide the most dependable class of service:
    [edit ethernet-switching-options]

    user@switch# set voip interface ge-0/0/2.0 vlan voice-vlan

    user@switch# set voip interface ge-0/0/2.0 forwarding-class assured-forwarding

  5. Configure LLDP-MED protocol support:
    [edit protocols]

    user@switch# set lldp-med interface ge-0/0/2.0

  6. Set the authentication profile (see Configuring 802.1X Interface Settings (CLI Procedure) and Configuring 802.1X RADIUS Accounting (CLI Procedure)):
    [edit protocols]

    set dot1x authenticator authentication-profile-name auth-profile
  7. Add the MAC address of the phone to the static MAC bypass list:
    [edit protocols]

    set dot1x authenticator static 00:04:f2:11:aa:a7
  8. Set the supplicant mode to multiple:
    [edit protocols]

    set dot1x authenticator interface ge-0/0/2.0 supplicant multiple

Results

Display the results of the configuration:

Verification

To confirm that the configuration is working properly, perform these tasks:

Verifying LLDP-MED Configuration

Purpose

Verify that LLDP-MED is enabled on the interface.

Action

user@switch> show lldp detail

Meaning

The show lldp detail output shows that both LLDP and LLDP-MED are configured on the ge-0/0/2.0 interface. The end of the output shows the list of supported LLDP basic TLVs, 802.3 TLVs, and LLDP-MED TLVs that are supported.

Verifying Authentication for the Desktop PC

Purpose

Display the 802.1X configuration for the desktop PC connected to the VoIP interface through the IP phone.

Action

user@switch> show dot1x interface ge/0/0/2.0 detail

Meaning

The field Role shows that the ge-0/0/2.0 interface is in the authenticator state. The Supplicant field shows that the interface is configured in multiple supplicant mode, permitting multiple supplicants to be authenticated on this interface. The MAC addresses of the supplicants currently connected are displayed at the bottom of the output.

Verifying the VLAN Association with the Interface

Purpose

Display the interface state and VLAN membership.

Action

Meaning

The field VLAN members shows that the ge-0/0/2.0 interface supports both the data-vlan VLAN and voice-vlan VLAN. The State field shows that the interface is up.

Example: Setting Up VoIP with 802.1X and LLDP-MED on an EX Series Switch with ELS Support

Note

This example uses Junos OS for EX Series switches with support for the Enhanced Layer 2 Software (ELS) configuration style. If your switch runs software that does not support ELS, see Example: Setting Up VoIP with 802.1X and LLDP-MED on an EX Series Switch. For ELS details, see Using the Enhanced Layer 2 Software CLI.

You can configure VoIP on an EX Series switch to support IP telephones. The Link Layer Discovery Protocol–Media Endpoint Discovery (LLDP-MED) protocol forwards VoIP parameters from the switch to the phone. You also configure 802.1X authentication to allow the telephone access to the LAN. Authentication is done through a backend RADIUS server.

This example describes how to configure VoIP on an EX Series switch to support an Avaya IP phone, as well as how to configure the LLDP-MED protocol and 802.1X authentication:

Requirements

This example uses the following software and hardware components:

Note

This example also applies to QFX5100 switches.

  • Junos OS Release 13.2X50 or later for EX Series switches

  • One EX Series switch with support for ELS acting as an authenticator port access entity (PAE). The interfaces on the authenticator PAE form a control gate that blocks all traffic to and from supplicants until they are authenticated.

  • An Avaya IP telephone that supports LLDP-MED and 802.1X

Before you configure VoIP, be sure you have:

Note

If the IP address is not configured on the Avaya IP phone, the phone exchanges LLDP-MED information to get the VLAN ID for the voice VLAN. You must configure the voip statement on the interface to designate the interface as a VoIP interface and allow the switch to forward the VLAN name and VLAN ID for the voice VLAN to the IP telephone. The IP telephone then uses the voice VLAN (that is, it references the voice VLAN’s ID) to send a DHCP discover request and exchange information with the DHCP server (voice gateway).

Overview and Topology

Instead of using a regular telephone, you connect an IP telephone directly to the switch. An IP phone has all the hardware and software needed to handle VoIP. You also can power an IP telephone by connecting it to one of the Power over Ethernet (PoE) interfaces on the switch.

In this example, the access interface ge-0/0/2 on the EX Series switch is connected to an Avaya IP telephone. Avaya phones have a built-in bridge that enables you to connect a desktop PC to the phone, so the desktop and phone in a single office require only one interface on the switch. The EX Series switch is connected to a RADIUS server on the ge-0/0/10 interface (see Figure 4).

Note

This figure also applies to QFX5100 switches.

Figure 4: VoIP Topology
VoIP Topology

In this example, you configure VoIP parameters and specify the forwarding class assured-forward for voice traffic to provide the highest quality of service.

Table 2 describes the components used in this VoIP configuration example.

Table 2: Components of the VoIP Configuration Topology

PropertySettings

Switch hardware

EX Series switch with support for ELS.

VLAN names and IDs

data-vlan, 77

voice-vlan, 99

Connection to Avaya phone—with integrated hub, to connect phone and desktop PC to a single interface (requires PoE)

ge-0/0/2

One RADIUS server

Provides backend database connected to the switch through interface ge-0/0/10.

Besides configuring a VoIP for interface ge-0/0/2, you configure:

  • 802.1X authentication. Authentication is set to multiple supplicant mode to support more than one supplicant's access to the LAN through interface ge-0/0/2.

  • LLDP-MED protocol information. The switch uses LLDP-MED to forward VoIP parameters to the phone. Using LLDP-MED ensures that voice traffic gets tagged and prioritized with the correct values at the source itself. For example, 802.1p class of service and 802.1Q tag information can be sent to the IP telephone.

    Note

    A PoE configuration is not necessary if an IP telephone uses a power adapter.

Configuration

CLI Quick Configuration

To quickly configure VoIP, LLDP-MED, and 802.1X, copy the following commands and paste them into the switch terminal window:

[edit]


set vlans data-vlan vlan-id 77


set vlans voice-vlan vlan-id 99


set vlans data-vlan switch-options interface ge-0/0/2.0




set interfaces ge-0/0/2 unit 0 family ethernet-switching interface-mode access


set interfaces ge-0/0/2 unit 0 family ethernet-switching vlan members data-vlan
set switch-options voip interface ge-0/0/2.0 vlan voice-vlan


set switch-options voip interface ge-0/0/2.0 forwarding-class assured-forwarding


set protocols lldp-med interface ge-0/0/2


set protocols dot1x authenticator interface ge-0/0/2.0 supplicant multiple

Step-by-Step Procedure

To configure VoIP with LLDP-MED and 802.1X:

  1. Configure the VLANs for voice and data:
    [edit vlans]

    user@switch# set data-vlan vlan-id 77

    user@switch# set voice-vlan vlan-id 99
  2. Associate the VLAN data-vlan with the interface:
    [edit vlans]

    user@switch# set data-vlan switch-options interface ge-0/0/2.0

  3. Configure the interface as an access interface, configure support for Ethernet switching, and add the interface as a member of the data-vlan VLAN:
    [edit interfaces]

    user@switch# set ge-0/0/2 unit 0 family ethernet-switching interface-mode access

    user@switch# set ge-0/0/2 unit 0 family ethernet-switching vlan members data-vlan
  4. Configure VoIP on the interface and specify the assured-forwarding forwarding class to provide the most dependable class of service:
    [edit switch—options]

    user@switch# set voip interface ge-0/0/2.0 vlan voice-vlan

    user@switch# set voip interface ge-0/0/2.0 forwarding-class assured-forwarding

  5. Configure LLDP-MED protocol support:
    [edit protocols]

    user@switch# set lldp-med interface ge-0/0/2

  6. To authenticate an IP phone and a PC connected to the IP phone on the interface, configure 802.1X authentication support and specify multiple supplicant mode:Note

    If you do not want to authenticate any device, skip the 802.1X configuration on this interface.

    [edit protocols]

    user@switch# set dot1x authenticator interface ge-0/0/2.0 supplicant multiple

Results

Display the results of the configuration:

Verification

To confirm that the configuration is working properly, perform these tasks:

Verifying LLDP-MED Configuration

Purpose

Verify that LLDP-MED is enabled on the interface.

Action

user@switch> show lldp detail

Meaning

The show lldp detail output shows that both LLDP and LLDP-MED are configured on the ge-0/0/2 interface. The end of the output shows the list of supported LLDP basic management TLVs and organizationally specific TLVs that are supported.

Verifying 802.1X Authentication for IP Phone and Desktop PC

Purpose

Display the 802.1X configuration to confirm that the VoIP interface has access to the LAN.

Action

user@switch> show dot1x interface ge/0/0/2.0 detail

Meaning

The field Role shows that the ge-0/0/2.0 interface is in the authenticator state. The Supplicant mode field shows that the interface is configured in multiple supplicant mode, permitting multiple supplicants to be authenticated on this interface. The MAC addresses of the supplicants currently connected are displayed at the bottom of the output.

Verifying the VLAN Association with the Interface

Purpose

Display the interface’s VLAN membership.

Action

user@switch> show ethernet-switching interface ge-0/0/2.0

Meaning

The field VLAN members shows that the ge-0/0/2.0 interface supports both the data-vlan VLAN and voice-vlan VLAN.