Administrator Guide

Layer 2 Switching Commands 852
User Guidelines
During authentication, the switch identifies a device as a voice device when
an Access-Accept is received from the AAA service with Cisco proprietary
VSA device-traffic-class=voice. Phones/devices using the voice VLAN are
periodically re-authenticated. If no AAA server is available during re-
authentication, access to the voice VLAN is removed when authentication
fails.
Critical voice VLAN supports voice VLAN access on an interface connected
to an 802.1X-capable host during RADIUS server outages. Use of this
command allows traffic to continue to flow over the voice VLAN when no
RADIUS server is available to re-authenticate the IP phone. Newly
authenticating phones do not have access to the critical voice VLAN service.
Only 802.1X-capable devices are eligible for critical voice VLAN treatment.
This restriction is not enforced by configuration.
Enable critical voice VLAN using the following steps:
• Create the voice VLAN on the switch .
• Configure the interface in access or general mode.
• Configure MAC based authentication on the interface.
• Configure one or more RADIUS servers on the switch and enable 802.1X
globally.
• Configure the RADIUS servers to send the VSA traffic-class=voice in the
Access-Accept.
• Enable 802.1X authentication on the phone.
• Enable voice VLAN on the interface and globally.
• Enable critical voice VLAN.
IP phones that bypass authentication (switchport voice vlan auto override-
authentication) do not interoperate with the critical voice VLAN. If override
authentication is enabled, voice packets received are switched, regardless of
the 802.1X authentication state. Likewise, voice packets from the switch are
transmitted over the port, regardless of the 802.1x authentication state when
the override option is enabled.
The voice VLAN must be configured on the interface and must be different
than the data VLAN (PVID).