close

keyboard_arrow_left

Table of Contents Expand all

list Table of Contents

English

Understanding 802.1X and VoIP on EX Series Switches
Example: Setting Up VoIP with 802.1X and LLDP-MED on an EX Series Switch
Example: Configuring VoIP on an EX Series Switch Without Including LLDP-MED Support
Example: Configuring VoIP on an EX Series Switch Without Including LLDP-MED Support
Example: Configuring VoIP on an EX Series Switch Without Including 802.1X Authentication
Example: Setting Up VoIP with 802.1X and LLDP-MED on an EX Series Switch with ELS Support
Example: Configuring VoIP on an EX Series Switch with ELS Support Without Including 802.1X Authentication

keyboard_arrow_right

VoIP on EX Series Switches

date_range 30-Nov-23

arrow_backward

arrow_forward

You can configure voice over IP (VoIP) on an EX Series switch to support IP telephones. When you use VoIP, you can connect IP telephones to the switch and configure IEEE 802.1X authentication for 802.1X-compatible IP telephones. For more information, read this topic.

Understanding 802.1X and VoIP on EX Series Switches

When you use VoIP, you can connect IP telephones to the switch and configure IEEE 802.1X authentication for 802.1X-compatible IP telephones. The 802.1X authentication provides network edge security, protecting Ethernet LANs from unauthorized user access.

VoIP is a protocol used for the transmission of voice through packet-switched networks. VoIP transmits voice calls by using a network connection instead of an analog phone line.

When VoIP is used with 802.1X, the RADIUS server authenticates the phone, and Link Layer Discovery Protocol–Media Endpoint Discovery (LLDP-MED) provides the class-of-service (CoS) parameters to the phone.

You can configure 802.1X authentication to work with VoIP in multiple supplicant or single supplicant mode. In multiple supplicant mode, the 802.1X process allows multiple supplicants to connect to the interface. Each supplicant is authenticated individually. For an example of a VoIP multiple supplicant topology, see Figure 1.

Figure 1: VoIP Multiple Supplicant Topology

If an 802.1X-compatible IP telephone does not have an 802.1X host but has another 802.1X-compatible device connected to its data port, you can connect the phone to an interface in single supplicant mode. In single supplicant mode, the 802.1X process authenticates only the first supplicant. All other supplicants who connect later to the interface are allowed full access without any further authentication. They effectively “piggyback” on the first supplicant’s authentication. For an example of a VoIP single supplicant topology, see Figure 2 .

Figure 2: VoIP Single Supplicant Topology

If an IP telephone does not support 802.1X, you can configure VoIP to bypass 802.1X and LLDP-MED and have the packets forwarded to a VoIP VLAN.

Multi Domain 802.1X Authentication

Multi-domain 802.1X authentication is an extension of multiple supplicant mode that allows one default VoIP device and multiple data devices to authenticate on a single port. Multi-domain 802.1X authentication provides enhanced security over multiple supplicant mode by restricting the number of authenticated data and VoIP sessions on the port. In multiple supplicant mode, any number of VoIP or data sessions can be authenticated; the number of sessions can be restricted using MAC limiting, but there is no way to apply the limit specifically to either data or VoIP sessions.

With multi-domain 802.1X authentication, the single port is divided into two domains; one is the data domain and the other is the voice domain. Multi-domain 802.1X authentication maintains separate session counts based on the domain. You can configure the maximum number of authenticated data sessions allowed on the port. The number of VoIP sessions is not configurable; only one authenticated VoIP session is allowed on the port.

If a new client attempts to authenticate on the interface after the maximum session count has been reached, the default action is to drop the packet and generate an error log message. You can also configure the action to shut down the interface. The port can be manually recovered from the down state by issuing the clear dot1x recovery-timeout command, or by can recover automatically after a configured recovery timeout period.

Multi-domain authentication does not enforce the order of device authentication. However, for the best results, the VoIP device should be authenticated before a data device on a multi domain 802.1X-enabled port. Multi-domain authentication is supported only in multiple supplicant mode.

Example: Setting Up VoIP with 802.1X and LLDP-MED on an EX Series Switch

You can configure voice over IP (VoIP) on an EX Series switch to support IP telephones. The Link Layer Discovery Protocol–Media Endpoint Discovery (LLDP-MED) protocol forwards VoIP parameters from the switch to the phone. You also configure 802.1X authentication to allow the telephone access to the LAN. Authentication is done through a backend RADIUS server.

This example describes how to configure VoIP on an EX Series switch to support an Avaya IP phone, as well as the LLDP-MED protocol and 802.1X authentication:

Note:

If your switch runs Junos OS for EX Series switches with support for the Enhanced Layer 2 Software (ELS) configuration style, see Example: Setting Up VoIP with 802.1X and LLDP-MED on an EX Series Switch with ELS Support. For ELS details, see Using the Enhanced Layer 2 Software CLI.

Requirements
Overview and Topology
Configuration
Verification

Requirements

This example uses the following hardware and software components:

Junos OS Release 9.1 or later for EX Series switches
One EX Series switch acting as an authenticator port access entity (PAE). The interfaces on the authenticator PAE form a control gate that blocks all traffic to and from supplicants until they are authenticated.
An Avaya 9620 IP telephone that supports LLDP-MED and 802.1X

Before you configure VoIP, be sure you have:

Installed your EX Series switch. See Installing and Connecting an EX3200 Switch.
Performed the initial switch configuration. See Connecting and Configuring an EX Series Switch (J-Web Procedure).
Performed basic bridging and VLAN configuration on the switch. See Example: Setting Up Basic Bridging and a VLAN for an EX Series Switch.
Configured the RADIUS server for 802.1X authentication and set up the access profile. See Example: Connecting a RADIUS Server for 802.1X to an EX Series Switch.
(Optional) Configured interface ge-0/0/2 for Power over Ethernet (PoE). The PoE configuration is not necessary if the VoIP supplicant is using a power adapter. For information about configuring PoE, see Configuring PoE Interfaces on EX Series Switches.

Note:

If the IP address isn't configured on the Avaya IP phone, the phone exchanges LLDP-MED information to get the VLAN ID for the voice VLAN. You must configure the voip statement on the interface to designate the interface as a VoIP interface and allow the switch to forward the VLAN name and VLAN ID for the voice VLAN to the IP telephone. The IP telephone then uses the voice VLAN (that is, it references the voice VLAN’s ID) to send a DHCP discover request and exchange information with the DHCP server (voice gateway).

Overview and Topology

Instead of using a regular telephone, you connect an IP telephone directly to the switch. An IP phone has all the hardware and software needed to handle VoIP. You also can power an IP telephone by connecting it to one of the Power over Ethernet (PoE) interfaces on the switch.

In this example, the access interface ge-0/0/2 on the EX4200 switch is connected to an Avaya 9620 IP telephone. Avaya phones have a built-in bridge that allows you to connect a desktop PC to the phone, so the desktop and phone in a single office require only one interface on the switch. The EX Series switch is connected to a RADIUS server on interface ge-0/0/10 (see Figure 3).

Figure 3: VoIP Topology

In this example, you configure VoIP parameters and specify the forwarding class assured-forward for voice traffic to provide the highest quality of service.

Table 1 describes the components used in this VoIP configuration example.

Table 1: Components of the VoIP Configuration Topology
Property	Settings
Switch hardware	EX4200 switch
VLAN names	data-vlan voice-vlan
Connection to Avaya phone—with integrated hub, to connect phone and desktop PC to a single interface (requires PoE)	ge-0/0/2
One RADIUS server	Provides backend database connected to the switch through interface ge-0/0/10.

As well as configuring a VoIP for interface ge-0/0/2, you configure:

802.1X authentication. Authentication is set to multiple supplicant to support more than one supplicant's access to the LAN through interface ge-0/0/2.
LLDP-MED protocol information. The switch uses LLDP-MED to forward VoIP parameters to the phone. Using LLDP-MED ensures that voice traffic gets tagged and prioritized with the correct values at the source itself. For example, 802.1p class of service and 802.1Q tag information can be sent to the IP telephone.

Note:
A PoE configuration is not necessary if an IP telephone is using a power adapter.

Configuration

To configure VoIP, LLDP-MED, and 802.1X authentication:

CLI Quick Configuration

To quickly configure VoIP, LLDP-MED, and 802.1X, copy the following commands and paste them into the switch terminal window:

content_copy zoom_out_map
[edit]
set vlans data-vlan vlan-id 77 
set vlans voice-vlan vlan-id 99 
set vlans data-vlan interface ge-0/0/2.0 
set interfaces ge-0/0/2 unit 0 family ethernet-switching vlan members data-vlan
set interfaces ge-0/0/2 unit 0 family ethernet-switching port-mode access
set ethernet-switching-options voip interface ge-0/0/2.0 vlan voice-vlan
set ethernet-switching-options voip interface ge-0/0/2.0 forwarding-class assured-forwarding 
set protocols lldp-med interface ge-0/0/2.0
set protocols dot1x authenticator interface ge-0/0/2.0 supplicant multiple

Step-by-Step Procedure

To configure VoIP with LLDP-MED and 802.1X:

Configure the VLANs for voice and data:

content_copy zoom_out_map
[edit vlans]
user@switch# set data-vlan vlan-id 77
user@switch# set voice-vlan vlan-id 99                         

Associate the VLAN data-vlan with the interface:

content_copy zoom_out_map
[edit vlans]
user@switch# set data-vlan interface ge-0/0/2.0
                         

Configure the interface as an access interface, configure support for Ethernet switching, and add the data-vlan VLAN:

content_copy zoom_out_map
[edit interfaces]
user@switch# set ge-0/0/2 unit 0 family ethernet-switching vlan members data-vlan
user@switch# set ge-0/0/2 unit 0 family ethernet-switching port-mode  access  

Configure VoIP on the interface and specify the assured-forwarding forwarding class to provide the most dependable class of service:

content_copy zoom_out_map
[edit ethernet—switching—options]
user@switch# set voip interface ge-0/0/2.0 vlan voice-vlan
user@switch# set voip interface ge-0/0/2.0 forwarding-class assured-forwarding

Configure LLDP-MED protocol support:

content_copy zoom_out_map
[edit protocols]
user@switch# set lldp-med interface ge-0/0/2.0
 

To authenticate an IP phone and a PC connected to the IP phone on the interface, configure 802.1X authentication support and specify multiple supplicant mode:

Note:
If you do not want to authenticate any device, skip the 802.1X configuration on this interface.
```
[edit protocols]
user@switch# set dot1x authenticator interface ge-0/0/2.0 supplicant multiple                         
```

Results

Display the results of the configuration:

content_copy zoom_out_map
[edit]
user@switch# show configuration                     
interfaces {
    ge-0/0/2 {
        unit 0 {
            family ethernet-switching {
                port-mode access;
                vlan {
                    members data-vlan;
                }
            }
        }
    }
}
protocols {
    lldp-med {
        interface ge-0/0/2.0;
    }
    dot1x {
        authenticator {
            interface {
                ge-0/0/2.0 {
                    supplicant multiple;
                }
            }
        }
    }
}
vlans {
    data-vlan {
        vlan-id 77;
        interface {
            ge-0/0/2.0;
        }
    }
    voice-vlan {
        vlan-id 99;
    }
}
ethernet-switching options {
    voip {
        interface ge-0/0/2.0 {
            vlan voice-vlan;
            forwarding-class assured-forwarding;
        }
    }
}

Verification

To confirm that the configuration is working properly, perform these tasks:

Verifying LLDP-MED Configuration
Verifying 802.1X Authentication for IP Phone and Desktop PC
Verifying the VLAN Association with the Interface

Verifying LLDP-MED Configuration

Purpose
Action
Meaning

Purpose

Verify that LLDP-MED is enabled on the interface.

Action

content_copy zoom_out_map
user@switch>                              show lldp detail                     
LLDP                   : Enabled
Advertisement interval : 30 Second(s)
Transmit delay         : 2 Second(s)
Hold timer             : 2 Second(s)
Config Trap Interval   : 300 Second(s)
Connection Hold timer  : 60 Second(s)

LLDP MED               : Enabled
MED fast start count   : 3 Packet(s)


Interface      LLDP       LLDP-MED    Neighbor count
all            Enabled    -           0         
ge-0/0/2.0     -          Enabled     0         

Interface     VLAN-id     VLAN-name
ge-0/0/0.0    0           default  
ge-0/0/1.0    0           employee-vlan
ge-0/0/2.0    0           data-vlan
ge-0/0/2.0    99          voice-vlan
ge-0/0/3.0    0           employee-vlan
ge-0/0/8.0    0           employee-vlan
ge-0/0/10.0   0           default  
ge-0/0/11.0   20          employee-vlan
ge-0/0/23.0   0           default  

LLDP basic TLVs supported: 
Chassis identifier, Port identifier, Port description, System name, System
description, System capabilities, Management address.

LLDP 802 TLVs supported: 
Power via MDI, Link aggregation, Maximum frame size, Port VLAN tag, Port
VLAN name.

LLDP MED TLVs supported: 
LLDP MED capabilities, Network policy, Endpoint location, Extended power
Via MDI.

Meaning

The show lldp detail output shows that both LLDP and LLDP-MED are configured on the ge-0/0/2.0 interface. The end of the output shows the list of supported LLDP basic TLVs, 802.3 TLVs, and LLDP-MED TLVs that are supported.

Verifying 802.1X Authentication for IP Phone and Desktop PC

Purpose
Action
Meaning

Purpose

Display the 802.1X configuration to confirm that the VoIP interface has access to the LAN.

Action

content_copy zoom_out_map
user@switch> show dot1x interface ge/0/0/2.0 detail 
ge-0/0/2.0
  Role: Authenticator
  Administrative state: Auto
  Supplicant mode: Multiple
  Number of retries: 3
  Quiet period: 60 seconds
  Transmit period: 30 seconds
  Mac Radius: Disabled
  Mac Radius Restrict: Disabled
  Reauthentication: Enabled
  Configured Reauthentication interval: 3600 seconds
  Supplicant timeout: 30 seconds
  Server timeout: 30 seconds
  Maximum EAPOL requests: 2
  Guest VLAN member: <not configured>
  Number of connected supplicants: 1
    Supplicant: user101, 00:04:0f:fd:ac:fe
      Operational state: Authenticated
      Authentication method: Radius
      Authenticated VLAN: vo11
      Dynamic Filter: match source-dot1q-tag 10 action deny
      Session Reauth interval: 60 seconds
      Reauthentication due in 50 seconds

Meaning

The field Role shows that the ge-0/0/2.0 interface is in the authenticator state. The Supplicant field shows that the interface is configured in multiple supplicant mode, permitting multiple supplicants to be authenticated on this interface. The MAC addresses of the supplicants currently connected are displayed at the bottom of the output.

Verifying the VLAN Association with the Interface

Purpose
Action
Meaning

Purpose

Display the interface state and VLAN membership.

Action

content_copy zoom_out_map
user@switch> show ethernet-switching interfaces 
 Ethernet-switching table: 0 entries, 0 learned

user@switch> show ethernet-switching interfaces 
Interface   State    VLAN members           Blocking 
ge-0/0/0.0  down     default                unblocked
ge-0/0/1.0  down     employee-vlan          unblocked
ge-0/0/5.0  down     employee-vlan          unblocked
ge-0/0/3.0  down     employee-vlan          unblocked
ge-0/0/8.0  down     employee-vlan          unblocked
ge-0/0/10.0 down     default                unblocked
ge-0/0/11.0 down     employee-vlan          unblocked
ge-0/0/23.0 down     default                unblocked
ge-0/0/2.0  up       voice-vlan             unblocked
                     data-vlan              unblocked

Meaning

The field VLAN members shows that the ge-0/0/2.0 interface supports both the data-vlan VLAN and voice-vlan VLAN. The State field shows that the interface is up.

Example: Configuring VoIP on an EX Series Switch Without Including LLDP-MED Support

You can configure voice over IP (VoIP) on an EX Series switch to support IP telephones. The Link Layer Discovery Protocol–Media Endpoint Discovery (LLDP-MED) protocol is sometimes used with IP phones to forward VoIP parameters from the switch to the phone. However, not all IP phones support LLDP-MED.

This example describes how to configure VoIP on an EX Series switch without using LLDP-MED:

Requirements
Overview
Configuring VoIP Without LLDP-MED by Using a Voice VLAN on an Access Port
Configuring VoIP Without LLDP-MED by Using a Trunk Port with Native VLAN Option
Verification

Requirements

This example uses the following hardware and software components:

One EX Series switch with support for ELS acting as an authenticator port access entity (PAE). The interfaces on the authenticator PAE form a control gate that blocks all traffic to and from supplicants until they are authenticated.
An IP phone that does not support LLDP-MED.
Junos OS Release 13.2X50 or later for EX Series switches.

Before you configure VoIP, be sure you have:

Performed basic bridging and VLAN configuration on the switch. See Example: Setting Up Basic Bridging and a VLAN for an EX Series Switch with ELS Support .
Configured the IP phone as a member of the voice VLAN.
(Optional) Configured interface ge-0/0/2 for Power over Ethernet (PoE). The PoE configuration is not necessary if the VoIP supplicant is using a power adapter. See Configuring PoE Interfaces on EX Series Switches.

Overview

Instead of using a regular telephone, you connect an IP telephone directly to the switch. An IP phone has all the hardware and software needed to handle VoIP. You can also power an IP telephone by connecting it to one of the Power over Ethernet (PoE) interfaces on the switch.

EX Series switches can accommodate an IP telephone and end host connected to a single switch port. In such a scenario, voice and data traffic must be separated into different broadcast domains, or VLANs. One method for accomplishing this is by configuring a voice VLAN, which enables access ports to accept untagged data traffic as well as tagged voice traffic from IP phones, and associate each type of traffic with separate and distinct VLANs. Voice traffic (tagged) can then be treated differently, generally with a higher priority than data traffic (untagged).

The voice VLAN delivers the greatest benefit when used with IP phones that support LLDP-MED, but it is flexible enough that IP phones that do not support LLDP-MED can also use it effectively. However, in the absence of LLDP-MED, the voice VLAN ID must be set manually on the IP phone because LLDP-MED is not available to accomplish this dynamically. For information about setting up a voice VLAN for IP phones that support LLDP-MED, see Example: Setting Up VoIP with 802.1X and LLDP-MED on an EX Series Switch with ELS Support.

Another method to separate voice (tagged) and data (untagged) traffic into different VLANs is to use a trunk port with the native VLAN ID option. The trunk port is added as a member of the voice VLAN, and processes only tagged voice traffic from that VLAN. The trunk port must also be configured with the native VLAN ID for the data VLAN so that it can process untagged data traffic from the data VLAN. This configuration also requires that the voice VLAN ID be set manually on the IP phone.

This example illustrates both methods. In this example, the interface ge-0/0/2 on the switch is connected to a non-LLDP-MED IP phone.

Note:

The implementation of a voice VLAN on an IP telephone is vendor-specific. Consult the documentation that came with your IP telephone for instructions on configuring a voice VLAN. For example, on an Avaya phone, you can ensure that the phone gets the correct VoIP VLAN ID even in the absence of LLDP-MED by enabling DHCP option 176.

Topology

Configuring VoIP Without LLDP-MED by Using a Voice VLAN on an Access Port

Procedure

CLI Quick Configuration
Step-by-Step Procedure
Results

CLI Quick Configuration

To quickly configure VoIP, copy the following commands and paste them into the switch terminal window:

content_copy zoom_out_map
[edit]
set vlans data-vlan vlan-id 77
set vlans voice-vlan vlan-id 99
set interfaces ge-0/0/2 unit 0 family ethernet-switching port-mode access
set interfaces ge-0/0/2 unit 0 family ethernet-switching vlan members data-vlan
set switch-options voip interface ge-0/0/2.0 vlan voice-vlan
set switch-options voip interface ge-0/0/2.0 forwarding-class assured-forwarding

Step-by-Step Procedure

Configure two VLANs: one for data traffic and one for voice traffic:
```
[edit vlans]
user@switch# set data-vlan vlan-id 77
user@switch# set voice-vlan vlan-id 99                         
```
Note:
The voice VLAN ID must be set manually on the IP phone.
Associate the VLAN data-vlan with the interface ge-0/0/2:
```
[edit vlans]
user@switch# set data-vlan switch-options interface ge-0/0/2.0
```

Configure the interface ge-0/0/2 as an access port belonging to the data VLAN:

content_copy zoom_out_map
[edit interfaces]
user@switch# set ge-0/0/2 unit 0 family ethernet-switching port-mode access
user@switch# set ge-0/0/2 unit 0 family ethernet-switching vlan member data-vlan

Configure VoIP on the interface ge-0/0/2 and add this interface to the voice VLAN:
```
[edit switch-options]
user@switch# set voip interface ge-0/0/2.0 vlan voice-vlan 
```
Specify the assured-forwarding forwarding class to provide the most dependable class of service:
```
[edit switch-options]
user@switch# set voip interface ge-0/0/2.0 forwarding-class assured-forwarding 
```

Results

Display the results of the configuration:

content_copy zoom_out_map
[edit]
user@switch> show configuration                     
interfaces {
    ge-0/0/2 {
        unit 0 {
            family ethernet-switching {
                port-mode access;
                vlan {
                    members data-vlan;
                }
            }
        }
    }
}
vlans {
    data-vlan {
        vlan-id 77;
        interface {
            ge-0/0/2.0;
        }
    }
    voice-vlan {
        vlan-id 99;
    }
}
ethernet-switching options {
    voip {
        interface ge-0/0/2.0 {
            vlan voice-vlan;
            forwarding-class assured-forwarding;
        }
    }
}

Configuring VoIP Without LLDP-MED by Using a Trunk Port with Native VLAN Option

Procedure

CLI Quick Configuration
Step-by-Step Procedure
Results

CLI Quick Configuration

To quickly configure VoIP, copy the following commands and paste them into the switch terminal window:

content_copy zoom_out_map
[edit]
set vlans data-vlan vlan-id 77
set vlans voice-vlan vlan-id 99
set interfaces ge-0/0/2 unit 0 family ethernet-switching port-mode trunk

set interfaces ge-0/0/2 unit 0 family ethernet-switching vlan members voice-vlan
set interfaces ge-0/0/2 unit 0 family ethernet-switching native-vlan-id data-vlan

Step-by-Step Procedure

Configure two VLANs: one for data traffic and one for voice traffic:
```
[edit vlans]
user@switch# set data-vlan vlan-id 77
user@switch# set voice-vlan vlan-id 99
```
Note:
The voice VLAN ID must be set manually on the IP phone.

Configure interface ge-0/0/2 as a trunk port that includes only the voice VLAN:

content_copy zoom_out_map
[edit interfaces]
user@switch# set ge-0/0/2 unit 0 family ethernet-switching port-mode trunk
user@switch# set ge-0/0/2 unit 0 family ethernet-switching vlan member voice-vlan

Configure the native VLAN ID for the data VLAN on the trunk port:

content_copy zoom_out_map
[edit interfaces]
user@switch# set ge-0/0/2 unit 0 family ethernet-switching native-vlan-id data-vlan

Results

Display the results of the configuration:

content_copy zoom_out_map
[edit]
user@switch> show configuration                     
interfaces {
    ge-0/0/2 {
        unit 0 {
            family ethernet-switching {
                port-mode trunk;
                vlan {
                    members voice-vlan;
                }
                native-vlan-id data-vlan;
            }
        }
    }
}
vlans {
    data-vlan {
        vlan-id 77;
    }
    voice-vlan {
        vlan-id 99;
    }
}

Verification

To confirm that the configuration is working properly, perform the following task:

Verifying the VLAN Association With the Interface

Purpose
Action
Meaning

Purpose

Display the interface state and VLAN membership.

Action

content_copy zoom_out_map
user@switch>                              show ethernet-switching interfaces                                              
 Ethernet-switching table: 0 entries, 0 learned

user@switch> show ethernet-switching interfaces 
Interface   State    VLAN members           Blocking 
ge-0/0/0.0  down     default                unblocked
ge-0/0/1.0  down     employee-vlan          unblocked
ge-0/0/5.0  down     employee-vlan          unblocked
ge-0/0/3.0  down     employee-vlan          unblocked
ge-0/0/8.0  down     employee-vlan          unblocked
ge-0/0/10.0 down     default                unblocked
ge-0/0/11.0 down     employee-vlan          unblocked
ge-0/0/23.0 down     default                unblocked
ge-0/0/2.0  up       voice-vlan             unblocked
                     data-vlan              unblocked

Meaning

The field VLAN members shows that the ge-0/0/2.0 interface supports both the data VLAN, data-vlan, and the voice VLAN, voice-vlan. The State field shows that the interface is up.

Example: Configuring VoIP on an EX Series Switch Without Including LLDP-MED Support

This example describes how to configure VoIP on an EX Series switch without using LLDP-MED:

Requirements
Overview
Configuring VoIP Without LLDP-MED by Using a Voice VLAN on an Access Port
Configuring VoIP Without LLDP-MED by Using a Trunk Port with Native VLAN Option
Verification

Requirements

This example uses the following hardware and software components:

One EX4200 switch acting as an authenticator port access entity (PAE). The interfaces on the authenticator PAE form a control gate that blocks all traffic to and from supplicants until they are authenticated.
An IP phone that does not support LLDP-MED.
Junos OS Release 9.1 or later for EX Series switches.

Before you configure VoIP, be sure you have:

Performed basic bridging and VLAN configuration on the switch. See Example: Setting Up Basic Bridging and a VLAN for an EX Series Switch.
Configured the IP phone as a member of the voice VLAN.
(Optional) Configured interface ge-0/0/2 for Power over Ethernet (PoE). The PoE configuration is not necessary if the VoIP supplicant is using a power adapter. See Configuring PoE Interfaces on EX Series Switches.

Overview

This example illustrates both methods. In this example, the interface ge-0/0/2 on the EX4200 switch is connected to a non-LLDP-MED IP phone.

Note:

Topology

Configuring VoIP Without LLDP-MED by Using a Voice VLAN on an Access Port

Procedure

CLI Quick Configuration
Step-by-Step Procedure
Results

CLI Quick Configuration

To quickly configure VoIP, copy the following commands and paste them into the switch terminal window:

content_copy zoom_out_map
[edit]
set vlans data-vlan vlan-id 77
set vlans voice-vlan vlan-id 99
set vlans data-vlan interface ge-0/0/2.0
set interfaces ge-0/0/2 unit 0 family ethernet-switching port-mode access
set interfaces ge-0/0/2 unit 0 family ethernet-switching vlan members data-vlan
set ethernet-switching-options voip interface ge-0/0/2.0 vlan voice-vlan

Step-by-Step Procedure

Configure two VLANs: one for data traffic and one for voice traffic:
```
[edit vlans]
user@switch# set data-vlan vlan-id 77
user@switch# set voice-vlan vlan-id 99                         
```
Note:
The voice VLAN ID must be set manually on the IP phone.
Configure the VLAN data-vlan on the interface ge-0/0/2:
```
[edit vlans]
user@switch# set data-vlan interface ge-0/0/2.0
```

Configure the interface ge-0/0/2 as an access port belonging to the data VLAN:

content_copy zoom_out_map
[edit interfaces]
user@switch# set ge-0/0/2 unit 0 family ethernet-switching port-mode access
user@switch# set ge-0/0/2 unit 0 family ethernet-switching vlan member data-vlan

Configure VoIP on the interface ge-0/0/2 and add this interface to the voice VLAN:
```
[edit ethernet-switching-options]
user@switch# set voip interface ge-0/0/2.0 vlan voice-vlan 
```

Results

Display the results of the configuration:

content_copy zoom_out_map
[edit]
user@switch> show configuration                     
interfaces {
    ge-0/0/2 {
        unit 0 {
            family ethernet-switching {
                port-mode access;
                vlan {
                    members data-vlan;
                }
            }
        }
    }
}
vlans {
    data-vlan {
        vlan-id 77;
        interface {
            ge-0/0/2.0;
        }
    }
    voice-vlan {
        vlan-id 99;
    }
}
ethernet-switching options {
    voip {
        interface ge-0/0/2.0 {
            vlan voice-vlan;
        }
    }
}

Configuring VoIP Without LLDP-MED by Using a Trunk Port with Native VLAN Option

Procedure

CLI Quick Configuration
Step-by-Step Procedure
Results

CLI Quick Configuration

To quickly configure VoIP, copy the following commands and paste them into the switch terminal window:

content_copy zoom_out_map
[edit]
set vlans data-vlan vlan-id 77
set vlans voice-vlan vlan-id 99
set interfaces ge-0/0/2 unit 0 family ethernet-switching port-mode trunk

set interfaces ge-0/0/2 unit 0 family ethernet-switching vlan members voice-vlan
set interfaces ge-0/0/2 unit 0 family ethernet-switching native-vlan-id data-vlan

Step-by-Step Procedure

Configure two VLANs: one for data traffic and one for voice traffic:
```
[edit vlans]
user@switch# set data-vlan vlan-id 77
user@switch# set voice-vlan vlan-id 99
```
Note:
The voice VLAN ID must be set manually on the IP phone.

Configure interface ge-0/0/2 as a trunk port that includes only the voice VLAN:

content_copy zoom_out_map
[edit interfaces]
user@switch# set ge-0/0/2 unit 0 family ethernet-switching port-mode trunk
user@switch# set ge-0/0/2 unit 0 family ethernet-switching vlan member voice-vlan

Configure the native VLAN ID for the data VLAN on the trunk port:

content_copy zoom_out_map
[edit interfaces]
user@switch# set ge-0/0/2 unit 0 family ethernet-switching native-vlan-id data-vlan

Results

Display the results of the configuration:

content_copy zoom_out_map
[edit]
user@switch> show configuration                     
interfaces {
    ge-0/0/2 {
        unit 0 {
            family ethernet-switching {
                port-mode trunk;
                vlan {
                    members voice-vlan;
                }
                native-vlan-id data-vlan;
            }
        }
    }
}
vlans {
    data-vlan {
        vlan-id 77;
    }
    voice-vlan {
        vlan-id 99;
    }
}

Verification

To confirm that the configuration is working properly, perform the following task:

Verifying the VLAN Association With the Interface

Purpose
Action
Meaning

Purpose

Display the interface state and VLAN membership.

Action

content_copy zoom_out_map
user@switch>                              show ethernet-switching interfaces                                              
 Ethernet-switching table: 0 entries, 0 learned

user@switch> show ethernet-switching interfaces 
Interface   State    VLAN members           Blocking 
ge-0/0/0.0  down     default                unblocked
ge-0/0/1.0  down     employee-vlan          unblocked
ge-0/0/5.0  down     employee-vlan          unblocked
ge-0/0/3.0  down     employee-vlan          unblocked
ge-0/0/8.0  down     employee-vlan          unblocked
ge-0/0/10.0 down     default                unblocked
ge-0/0/11.0 down     employee-vlan          unblocked
ge-0/0/23.0 down     default                unblocked
ge-0/0/2.0  up       voice-vlan             unblocked
                     data-vlan              unblocked

Meaning

The field VLAN members shows that the ge-0/0/2.0 interface supports both the data VLAN, data-vlan, and the voice VLAN, voice-vlan. The State field shows that the interface is up.

Example: Configuring VoIP on an EX Series Switch Without Including 802.1X Authentication

You can configure voice over IP (VoIP) on an EX Series switch to support IP telephones.

To configure VoIP on an EX Series switch to support an IP phone that does not support 802.1X authentication, you must either add the MAC address of the phone to the static MAC bypass list or enable MAC RADIUS authentication on the switch.

This example describes how to configure VoIP on an EX Series switch without 802.1X authentication using static MAC bypass of authentication:

Requirements
Overview
Configuration
Verification

Requirements

This example uses the following hardware and software components:

Junos OS Release 9.1 or later for EX Series switches
An IP telephone

Before you configure VoIP, be sure you have:

Installed your EX Series switch. See the installation information for your switch.
Performed the initial switch configuration. See Connecting and Configuring an EX Series Switch (CLI Procedure).
Performed basic bridging and VLAN configuration on the switch. See Example: Setting Up Basic Bridging and a VLAN for an EX Series Switch.
Configured the RADIUS server for 802.1X authentication and set up the access profile. See Example: Connecting a RADIUS Server for 802.1X to an EX Series Switch.
(Optional) Configured interface ge-0/0/2 for Power over Ethernet (PoE). The PoE configuration is not necessary if the VoIP supplicant is using a power adapter. For information about configuring PoE, see Configuring PoE Interfaces on EX Series Switches.

Note:

Overview

In this example, the access interface ge-0/0/2 on the EX4200 switch is connected to a non-802.1X IP phone.

To configure VoIP on an EX Series switch to support an IP phone that does not support 802.1X authentication, add the MAC address of the phone as a static entry in the authenticator database and set the supplicant mode to multiple.

Configuration

To configure VoIP without 802.1X authentication:

Procedure

CLI Quick Configuration
Step-by-Step Procedure
Results

CLI Quick Configuration

To quickly configure VoIP, copy the following commands and paste them into the switch terminal window:

content_copy zoom_out_map
[edit]
set vlans data-vlan vlan-id 77 
set vlans voice-vlan vlan-id 99
set vlans data-vlan interface ge-0/0/2.0 
set interfaces ge-0/0/2 unit 0 family ethernet-switching vlan members data-vlan
set interfaces ge-0/0/2 unit 0 family ethernet-switching port-mode access
set ethernet-switching-options voip interface ge-0/0/2.0 vlan voice-vlan
set ethernet-switching-options voip interface ge-0/0/2.0 forwarding-class assured-forwarding
set protocols lldp-med interface ge-0/0/2.0 
set protocols dot1x authenticator authentication-profile-name auth-profile
set protocols dot1x authenticator static 00:04:f2:11:aa:a7
set protocols dot1x authenticator interface ge-0/0/2.0 supplicant multiple

Step-by-Step Procedure

To configure VoIP without 802.1X:

Configure the VLANs for voice and data:

content_copy zoom_out_map
[edit vlans]
user@switch# set data-vlan vlan-id 77
user@switch# set voice-vlan vlan-id 99                         

Associate the VLAN data-vlan with the interface:

content_copy zoom_out_map
[edit vlans]
user@switch# set data-vlan interface ge-0/0/2.0
                         

Configure the interface as an access interface, configure support for Ethernet switching, and add the data-vlan VLAN:

content_copy zoom_out_map
[edit interfaces]
user@switch# set ge-0/0/2 unit 0 family ethernet-switching vlan members data-vlan
user@switch# set ge-0/0/2 unit 0 family ethernet-switching port-mode access

Configure VoIP on the interface and specify the assured-forwarding forwarding class to provide the most dependable class of service:

content_copy zoom_out_map
[edit ethernet-switching-options]
user@switch# set voip interface ge-0/0/2.0 vlan voice-vlan
user@switch# set voip interface ge-0/0/2.0 forwarding-class assured-forwarding

Configure LLDP-MED protocol support:

content_copy zoom_out_map
[edit protocols]
user@switch# set lldp-med interface ge-0/0/2.0

Set the authentication profile (see Configuring 802.1X Interface Settings (CLI Procedure) and Configuring 802.1X RADIUS Accounting (CLI Procedure)):
```
[edit protocols]
set dot1x authenticator authentication-profile-name auth-profile
```
Add the MAC address of the phone to the static MAC bypass list:
```
[edit protocols]
set dot1x authenticator static 00:04:f2:11:aa:a7
```

Set the supplicant mode to multiple:

content_copy zoom_out_map
[edit protocols]
set dot1x authenticator interface ge-0/0/2.0 supplicant multiple

Results

Display the results of the configuration:

content_copy zoom_out_map
[edit]
user@switch# show configuration                     
interfaces {
    ge-0/0/2 {
        unit 0 {
            family ethernet-switching {
                port-mode access;
                vlan {
                    members data-vlan;
                }
            }
        }
    }
}
protocols {
    lldp-med {
        interface ge-0/0/2.0;
    }
    dot1x {
        authenticator {
            authentication-profile-name auth-profile;
                static {
                    00:04:f2:11:aa:a7;
                }
            }
            interface {
                ge-0/0/2.0 {
                    supplicant multiple;
                }
        }
    }
}
vlans {
    data-vlan {
        vlan-id 77;
        interface {
            ge-0/0/2.0;
        }
    }
    voice-vlan {
        vlan-id 99;
    }
}
ethernet-switching options {
    voip {
        interface ge-0/0/2.0 {
            vlan voice-vlan;
            forwarding-class assured-forwarding;
        }
    }
}

Verification

To confirm that the configuration is working properly, perform these tasks:

Verifying LLDP-MED Configuration
Verifying Authentication for the Desktop PC
Verifying the VLAN Association with the Interface

Verifying LLDP-MED Configuration

Purpose
Action
Meaning

Purpose

Verify that LLDP-MED is enabled on the interface.

Action

content_copy zoom_out_map
user@switch>                              show lldp detail                     
LLDP                   : Enabled
Advertisement interval : 30 Second(s)
Transmit delay         : 2 Second(s)
Hold timer             : 2 Second(s)
Config Trap Interval   : 300 Second(s)
Connection Hold timer  : 60 Second(s)

LLDP MED               : Enabled
MED fast start count   : 3 Packet(s)


Interface      LLDP       LLDP-MED    Neighbor count
all            Enabled    -           0         
ge-0/0/2.0     -          Enabled     0         

Interface     VLAN-id     VLAN-name
ge-0/0/0.0    0           default  
ge-0/0/1.0    0           employee-vlan
ge-0/0/2.0    0           data-vlan
ge-0/0/2.0    99          voice-vlan
ge-0/0/3.0    0           employee-vlan
ge-0/0/8.0    0           employee-vlan
ge-0/0/10.0   0           default  
ge-0/0/11.0   20          employee-vlan
ge-0/0/23.0   0           default  

LLDP basic TLVs supported: 
Chassis identifier, Port identifier, Port description, System name, System
description, System capabilities, Management address.

LLDP 802 TLVs supported: 
Power via MDI, Link aggregation, Maximum frame size, Port VLAN tag, Port
VLAN name.

LLDP MED TLVs supported: 
LLDP MED capabilities, Network policy, Endpoint location, Extended power
Via MDI.

Meaning

The show lldp detail output shows that both LLDP and LLDP-MED are configured on the ge-0/0/2.0 interface. The end of the output shows the list of supported LLDP basic TLVs, 802.3 TLVs, and LLDP-MED TLVs that are supported.

Verifying Authentication for the Desktop PC

Purpose
Action
Meaning

Purpose

Display the 802.1X configuration for the desktop PC connected to the VoIP interface through the IP phone.

Action

content_copy zoom_out_map
user@switch>  show dot1x interface ge/0/0/2.0 detail
ge-0/0/2.0
  Role: Authenticator
  Administrative state: Auto
  Supplicant mode: Multiple
  Number of retries: 3
  Quiet period: 60 seconds
  Transmit period: 30 seconds
  Mac Radius: Disabled
  Mac Radius Restrict: Disabled
  Reauthentication: Enabled
  Configured Reauthentication interval: 3600 seconds
  Supplicant timeout: 30 seconds
  Server timeout: 30 seconds
  Maximum EAPOL requests: 2
  Guest VLAN member: <not configured>
  Number of connected supplicants: 1
    Supplicant: user101, 00:04:0f:fd:ac:fe
      Operational state: Authenticated
      Authentication method: Radius
      Authenticated VLAN: vo11
      Dynamic Filter: match source-dot1q-tag 10 action deny
      Session Reauth interval: 60 seconds
      Reauthentication due in 50 seconds

Meaning

The field Role shows that the ge-0/0/2.0 interface is in the authenticator state. The Supplicant field shows that the interface is configured in multiple supplicant mode, permitting multiple supplicants to be authenticated on this interface. The MAC addresses of the supplicants currently connected are displayed at the bottom of the output.

Verifying the VLAN Association with the Interface

Purpose
Action
Meaning

Purpose

Display the interface state and VLAN membership.

Action

content_copy zoom_out_map
user@switch> show ethernet-switching interfaces 
 Ethernet-switching table: 0 entries, 0 learned

user@switch> show ethernet-switching interfaces 
Interface   State    VLAN members           Blocking 
ge-0/0/0.0  down     default                unblocked
ge-0/0/1.0  down     employee-vlan          unblocked
ge-0/0/5.0  down     employee-vlan          unblocked
ge-0/0/3.0  down     employee-vlan          unblocked
ge-0/0/8.0  down     employee-vlan          unblocked
ge-0/0/10.0 down     default                unblocked
ge-0/0/11.0 down     employee-vlan          unblocked
ge-0/0/23.0 down     default                unblocked
ge-0/0/2.0  up       voice-vlan             unblocked
                     data-vlan              unblocked

Meaning

The field VLAN members shows that the ge-0/0/2.0 interface supports both the data-vlan VLAN and voice-vlan VLAN. The State field shows that the interface is up.

Example: Setting Up VoIP with 802.1X and LLDP-MED on an EX Series Switch with ELS Support

Note:

This example uses Junos OS for EX Series switches with support for the Enhanced Layer 2 Software (ELS) configuration style. If your switch runs software that does not support ELS, see Example: Setting Up VoIP with 802.1X and LLDP-MED on an EX Series Switch. For ELS details, see Using the Enhanced Layer 2 Software CLI.

You can configure VoIP on an EX Series switch to support IP telephones. The Link Layer Discovery Protocol–Media Endpoint Discovery (LLDP-MED) protocol forwards VoIP parameters from the switch to the phone. You also configure 802.1X authentication to allow the telephone access to the LAN. Authentication is done through a backend RADIUS server.

This example describes how to configure VoIP on an EX Series switch to support an Avaya IP phone, as well as how to configure the LLDP-MED protocol and 802.1X authentication:

Requirements
Overview and Topology
Configuration
Verification

Requirements

This example uses the following software and hardware components:

Note:

This example also applies to QFX5100 switches.

Junos OS Release 13.2X50 or later for EX Series switches
One EX Series switch with support for ELS acting as an authenticator port access entity (PAE). The interfaces on the authenticator PAE form a control gate that blocks all traffic to and from supplicants until they are authenticated.
An Avaya IP telephone that supports LLDP-MED and 802.1X

Before you configure VoIP, be sure you have:

Installed your EX Series switch. See the installation information for your switch.
Performed the initial switch configuration. See Connecting and Configuring an EX Series Switch (CLI Procedure).
Performed basic bridging and VLAN configuration on the switch. See Example: Setting Up Basic Bridging and a VLAN for an EX Series Switch with ELS Support or Example: Setting Up Basic Bridging and a VLAN on Switches.
Configured the RADIUS server for 802.1X authentication and set up the access profile. See Example: Connecting a RADIUS Server for 802.1X to an EX Series Switch.
(Optional) Configured the interface ge-0/0/2 for Power over Ethernet (PoE). The PoE configuration is not necessary if the VoIP supplicant uses a power adapter. For information about configuring PoE, see Configuring PoE Interfaces on EX Series Switches.

Note:

If the IP address is not configured on the Avaya IP phone, the phone exchanges LLDP-MED information to get the VLAN ID for the voice VLAN. You must configure the voip statement on the interface to designate the interface as a VoIP interface and allow the switch to forward the VLAN name and VLAN ID for the voice VLAN to the IP telephone. The IP telephone then uses the voice VLAN (that is, it references the voice VLAN’s ID) to send a DHCP discover request and exchange information with the DHCP server (voice gateway).

Overview and Topology

Note:

If a MAC addresses has been learned on both the data and voice VLANs, it remains active unless it ages out of both VLANs, or both VLANs are deleted.

In this example, the access interface ge-0/0/2 on the EX Series switch is connected to an Avaya IP telephone. Avaya phones have a built-in bridge that enables you to connect a desktop PC to the phone, so the desktop and phone in a single office require only one interface on the switch. The EX Series switch is connected to a RADIUS server on the ge-0/0/10 interface (see Figure 4).

Note:

This figure also applies to QFX5100 switches.

Figure 4: VoIP Topology

In this example, you configure VoIP parameters and specify the forwarding class assured-forward for voice traffic to provide the highest quality of service.

Table 2 describes the components used in this VoIP configuration example.

Table 2: Components of the VoIP Configuration Topology
Property	Settings
Switch hardware	EX Series switch with support for ELS.
VLAN names and IDs	data-vlan, 77 voice-vlan, 99
Connection to Avaya phone—with integrated hub, to connect phone and desktop PC to a single interface (requires PoE)	ge-0/0/2
One RADIUS server	Provides backend database connected to the switch through interface ge-0/0/10.

Besides configuring a VoIP for interface ge-0/0/2, you configure:

802.1X authentication. Authentication is set to multiple supplicant mode to support more than one supplicant's access to the LAN through interface ge-0/0/2.
LLDP-MED protocol information. The switch uses LLDP-MED to forward VoIP parameters to the phone. Using LLDP-MED ensures that voice traffic gets tagged and prioritized with the correct values at the source itself. For example, 802.1p class of service and 802.1Q tag information can be sent to the IP telephone.

Note:
A PoE configuration is not necessary if an IP telephone uses a power adapter.

Topology

Configuration

Procedure

CLI Quick Configuration
Step-by-Step Procedure
Results

CLI Quick Configuration

To quickly configure VoIP, LLDP-MED, and 802.1X, copy the following commands and paste them into the switch terminal window:

content_copy zoom_out_map
[edit]
set vlans data-vlan vlan-id 77 
set vlans voice-vlan vlan-id 99  
set interfaces ge-0/0/2 unit 0 family ethernet-switching interface-mode access
set interfaces ge-0/0/2 unit 0 family ethernet-switching vlan members data-vlan
set switch-options voip interface ge-0/0/2.0 vlan voice-vlan
set switch-options voip interface ge-0/0/2.0 forwarding-class assured-forwarding 
set protocols lldp-med interface ge-0/0/2
set protocols dot1x authenticator interface ge-0/0/2.0 supplicant multiple

Step-by-Step Procedure

To configure VoIP with LLDP-MED and 802.1X:

Configure the VLANs for voice and data:

content_copy zoom_out_map
[edit vlans]
user@switch# set data-vlan vlan-id 77
user@switch# set voice-vlan vlan-id 99                         

Associate the VLAN data-vlan with the interface:

content_copy zoom_out_map
[edit vlans]
user@switch# set data-vlan switch-options interface ge-0/0/2.0
                         

Configure the interface as an access interface, configure support for Ethernet switching, and add the interface as a member of the data-vlan VLAN:
```
[edit interfaces]
user@switch# set ge-0/0/2 unit 0 family ethernet-switching interface-mode access 
user@switch# set ge-0/0/2 unit 0 family ethernet-switching vlan members data-vlan
```
Note:
You must not configure both data and voice on the same VLAN. If you configure data and voice on the same VLAN, the configuration will not be accepted.

If you have enabled 802.1X authentication on your switch and:
- The voice VLAN you have configured is the same as the data VLAN that the authentication server sends,
- The data VLAN you have configured is the same as the voice VLAN that the authentication server sends, or
- The data VLAN and the voice VLAN that the authentication server sends are the same
The client would move to HELD state.

Configure VoIP on the interface and specify the assured-forwarding forwarding class to provide the most dependable class of service:

content_copy zoom_out_map
[edit switch—options]
user@switch# set voip interface ge-0/0/2.0 vlan voice-vlan
user@switch# set voip interface ge-0/0/2.0 forwarding-class assured-forwarding

Configure LLDP-MED protocol support:

content_copy zoom_out_map
[edit protocols]
user@switch# set lldp-med interface ge-0/0/2
 

To authenticate an IP phone and a PC connected to the IP phone on the interface, configure 802.1X authentication support and specify multiple supplicant mode:

Note:
If you do not want to authenticate any device, skip the 802.1X configuration on this interface.
```
[edit protocols]
user@switch# set dot1x authenticator interface ge-0/0/2.0 supplicant multiple                         
```

Results

Display the results of the configuration:

content_copy zoom_out_map
[edit]
user@switch# show configuration                     
interfaces {
    ge-0/0/2 {
        unit 0 {
            family ethernet-switching {
                interface-mode access;
                vlan {
                    members data-vlan;
                }
            }
        }
    }
}
protocols {
    lldp-med {
        interface ge-0/0/2;
    }
    dot1x {
        authenticator {
            interface {
                ge-0/0/2.0 {
                    supplicant multiple;
                }
            }
        }
    }
}
vlans {
    data-vlan {
        vlan-id 77;
        switch-options {
            interface ge-0/0/2.0;
        }
    }
    voice-vlan {
        vlan-id 99;
    }
}
switch-options {
    voip {
        interface ge-0/0/2.0 {
            vlan voice-vlan;
            forwarding-class assured-forwarding;
        }
    }
}

Verification

To confirm that the configuration is working properly, perform these tasks:

Verifying LLDP-MED Configuration
Verifying 802.1X Authentication for IP Phone and Desktop PC
Verifying the VLAN Association with the Interface

Verifying LLDP-MED Configuration

Purpose
Action
Meaning

Purpose

Verify that LLDP-MED is enabled on the interface.

Action

content_copy zoom_out_map
user@switch>                              show lldp detail                     
LLDP                   : Enabled
Advertisement interval : 30 seconds
Transmit delay         : 2 seconds
Hold timer             : 120 seconds
Notification interval  : 0 Second(s)
Config Trap Interval   : 0 seconds
Connection Hold timer  : 300 seconds

LLDP MED               : Enabled
MED fast start count   : 3 Packets

Port ID TLV subtype    : locally-assigned

Interface      Parent Interface    LLDP        LLDP-MED     Power Negotiation
  Neighbor count
all            -                   Enabled     Enabled      Enabled
  0
ge-0/0/2       -                   -           Enabled      -
  0

Interface      Parent Interface    Vlan-id     Vlan-name
ge-0/0/0       -                   1           vlan-1
ge-0/0/1       -                   1           vlan-1
ge-0/0/2       -                   77          vlan-77
ge-0/0/2       -                   99          vlan-99
ge-0/0/3       -                   1           vlan-1
ge-0/0/4       -                   1           vlan-1
ge-0/0/5       -                   1           vlan-1
ge-0/0/6       -                   1           vlan-1
ge-0/0/7       -                   1           vlan-1
ge-0/0/8       -                   1           vlan-1
ge-0/0/9       -                   1           vlan-1
ge-0/0/10      -                   1           vlan-1

Basic Management TLVs supported:
End Of LLDPDU, Chassis ID, Port ID, Time To Live, Port Description, System Name,
 System Description, System Capabilities, Management Address

Organizationally Specific TLVs supported:
MAC/PHY configuration/status, Power via MDI, Link aggregation, Maximum Frame Size,
 Port VLAN tag, Port VLAN name.

Meaning

The show lldp detail output shows that both LLDP and LLDP-MED are configured on the ge-0/0/2 interface. The end of the output shows the list of supported LLDP basic management TLVs and organizationally specific TLVs that are supported.

Verifying 802.1X Authentication for IP Phone and Desktop PC

Purpose
Action
Meaning

Purpose

Display the 802.1X configuration to confirm that the VoIP interface has access to the LAN.

Action

content_copy zoom_out_map
user@switch> show dot1x interface ge/0/0/2.0 detail 
ge-0/0/2.0
  Role: Authenticator
  Administrative state: Auto
  Supplicant mode: Multiple
  Number of retries: 3
  Quiet period: 60 seconds
  Transmit period: 30 seconds
  Mac Radius: Disabled
  Mac Radius Restrict: Disabled
  Reauthentication: Enabled
  Configured Reauthentication interval: 3600 seconds
  Supplicant timeout: 30 seconds
  Server timeout: 30 seconds
  Maximum EAPOL requests: 2
  Guest VLAN member: <not configured>
  Number of connected supplicants: 1
    Supplicant: user101, 00:04:0f:fd:ac:fe
      Operational state: Authenticated
      Authentication method: Radius
      Authenticated VLAN: vo11
      Dynamic Filter: match source-dot1q-tag 10 action deny
      Session Reauth interval: 60 seconds
      Reauthentication due in 50 seconds

Meaning

The field Role shows that the ge-0/0/2.0 interface is in the authenticator state. The Supplicant mode field shows that the interface is configured in multiple supplicant mode, permitting multiple supplicants to be authenticated on this interface. The MAC addresses of the supplicants currently connected are displayed at the bottom of the output.

Verifying the VLAN Association with the Interface

Purpose
Action
Meaning

Purpose

Display the interface’s VLAN membership.

Action

content_copy zoom_out_map
user@switch> show ethernet-switching interface ge-0/0/2.0 
Routing Instance Name : default-switch
Logical Interface flags (DL - disable learning, AD - packet action drop,
                         LH - MAC limit hit, DN - interface down )
Logical      Vlan       TAG   MAC      STP          Logical         Tagging
interface    members          limit    state        interface flags
ge-0/0/2.0                    65535                                 untagged
             voice-vlan 99
                              65535    Discarding
             data-vlan  77
                              65535    Discarding

Meaning

The field VLAN members shows that the ge-0/0/2.0 interface supports both the data-vlan VLAN and voice-vlan VLAN.

Example: Configuring VoIP on an EX Series Switch with ELS Support Without Including 802.1X Authentication

Note:

This example uses Junos OS for EX Series switches with support for the Enhanced Layer 2 Software (ELS) configuration style. If your switch runs software that does not support ELS, see Example: Configuring VoIP on an EX Series Switch Without Including 802.1X Authentication. For ELS details, see Using the Enhanced Layer 2 Software CLI.

You can configure voice over IP (VoIP) on an EX Series switch to support IP telephones.

This example describes how to configure VoIP on an EX Series switch without 802.1X authentication by using static MAC bypass of authentication:

Requirements
Overview
Configuration
Verification

Requirements

This example uses the following hardware and software components:

Note:

This figure also applies to QFX5100 switches.

One EX Series switch with support for ELS
Junos OS Release 13.2 or later for EX Series switches
An Avaya IP telephone

Before you configure VoIP, be sure you have:

Installed your EX Series switch. See the installation information for your switch.
Performed the initial switch configuration. See Connecting and Configuring an EX Series Switch (CLI Procedure).
Performed basic bridging and VLAN configuration on the switch. See Example: Setting Up Basic Bridging and a VLAN for an EX Series Switch with ELS Support or Example: Setting Up Basic Bridging and a VLAN on Switches.
Configured the RADIUS server for 802.1X authentication and set up the access profile. See Example: Connecting a RADIUS Server for 802.1X to an EX Series Switch.
(Optional) Configured the interface ge-0/0/2 for Power over Ethernet (PoE). The PoE configuration is not necessary if the VoIP supplicant uses a power adapter. For information about configuring PoE, see Configuring PoE Interfaces on EX Series Switches.

Note:

Overview

In this example, the access interface ge-0/0/2 on the EX Series switch is connected to a non-802.1X IP phone.

Configuration

Procedure

CLI Quick Configuration
Step-by-Step Procedure
Results

CLI Quick Configuration

To quickly configure VoIP without using 802.1X authentication, copy the following commands and paste them into the switch terminal window:

content_copy zoom_out_map
[edit]
set vlans data-vlan vlan-id 77 
set vlans voice-vlan vlan-id 99
set interfaces ge-0/0/2 unit 0 family ethernet-switching interface-mode access
set interfaces ge-0/0/2 unit 0 family ethernet-switching vlan members data-vlan
set switch-options voip interface ge-0/0/2.0 vlan voice-vlan
set switch-options voip interface ge-0/0/2.0 forwarding-class assured-forwarding
set protocols lldp-med interface ge-0/0/2 
set protocols dot1x authenticator authentication-profile-name auth-profile
set protocols dot1x authenticator static 00:04:f2:11:aa:a7
set protocols dot1x authenticator interface ge-0/0/2.0 supplicant multiple

Step-by-Step Procedure

To configure VoIP without 802.1X authentication:

Configure the VLANs for voice and data:

content_copy zoom_out_map
[edit vlans]
user@switch# set data-vlan vlan-id 77
user@switch# set voice-vlan vlan-id 99                         

Configure the interface as an access interface, configure support for Ethernet switching, and add the interface as a member of the data-vlan VLAN:
```
[edit interfaces]
user@switch# set ge-0/0/2 unit 0 family ethernet-switching interface-mode access 
user@switch# set ge-0/0/2 unit 0 family ethernet-switching vlan members data-vlan
```
Note:
You must not configure both data and voice on the same VLAN. If you configure data and voice on the same VLAN, the configuration will not be accepted.

Configure VoIP on the interface and specify the assured-forwarding forwarding class to provide the most dependable class of service:

content_copy zoom_out_map
[edit switch-options]
user@switch# set voip interface ge-0/0/2.0 vlan voice-vlan
user@switch# set voip interface ge-0/0/2.0 forwarding-class assured-forwarding

Configure LLDP-MED protocol support:

content_copy zoom_out_map
[edit protocols]
user@switch# set lldp-med interface ge-0/0/2

Set the authentication profile with the name auth-profile (see Configuring 802.1X Interface Settings (CLI Procedure) and Configuring 802.1X RADIUS Accounting (CLI Procedure)):
```
[edit protocols]
user@switch# set dot1x authenticator authentication-profile-name auth-profile
```
Add the MAC address of the phone to the static MAC bypass list:
```
[edit protocols]
user@switch# set dot1x authenticator static 00:04:f2:11:aa:a7
```

Set the supplicant mode to multiple:

content_copy zoom_out_map
[edit protocols]
user@switch# set dot1x authenticator interface ge-0/0/2.0 supplicant multiple

Results

Display the results of the configuration:

content_copy zoom_out_map
[edit]
user@switch# show configuration                     
interfaces {
    ge-0/0/2 {
        unit 0 {
            family ethernet-switching {
                interface-mode access;
                vlan {
                    members data-vlan;
                }
            }
        }
    }
}
protocols {
    lldp-med {
        interface ge-0/0/2;
    }
    dot1x {
        authenticator {
            authentication-profile-name auth-profile;
                static {
                    00:04:f2:11:aa:a7;
                }
            }
            interface {
                ge-0/0/2.0 {
                    supplicant multiple;
                }
        }
    }
}
vlans {
    data-vlan {
        vlan-id 77;
        switch-options {
            interface ge-0/0/2.0;
        }
    }
    voice-vlan {
        vlan-id 99;
    }
}
switch-options {
    voip {
        interface ge-0/0/2.0 {
            vlan voice-vlan;
            forwarding-class assured-forwarding;
        }
    }
}

Verification

To confirm that the configuration is working properly, perform these tasks:

Verifying LLDP-MED Configuration
Verifying Authentication for the Desktop PC
Verifying the VLAN Association with the Interface

Verifying LLDP-MED Configuration

Purpose
Action
Meaning

Purpose

Verify that LLDP-MED is enabled on the interface.

Action

content_copy zoom_out_map
user@switch>                              show lldp detail                     
LLDP                   : Enabled
Advertisement interval : 30 seconds
Transmit delay         : 2 seconds
Hold timer             : 120 seconds
Notification interval  : 0 Second(s)
Config Trap Interval   : 0 seconds
Connection Hold timer  : 300 seconds

LLDP MED               : Enabled
MED fast start count   : 3 Packets

Port ID TLV subtype    : locally-assigned

Interface      Parent Interface    LLDP        LLDP-MED     Power Negotiation
  Neighbor count
all            -                   Enabled     Enabled      Enabled
  0
ge-0/0/2       -                   -           Enabled      -
  0

Interface      Parent Interface    Vlan-id     Vlan-name
ge-0/0/0       -                   1           vlan-1
ge-0/0/1       -                   1           vlan-1
ge-0/0/2       -                   77          vlan-77
ge-0/0/2       -                   99          vlan-99
ge-0/0/3       -                   1           vlan-1
ge-0/0/4       -                   1           vlan-1
ge-0/0/5       -                   1           vlan-1
ge-0/0/6       -                   1           vlan-1
ge-0/0/7       -                   1           vlan-1
ge-0/0/8       -                   1           vlan-1
ge-0/0/9       -                   1           vlan-1
ge-0/0/10      -                   1           vlan-1

Basic Management TLVs supported:
End Of LLDPDU, Chassis ID, Port ID, Time To Live, Port Description, System Name,
 System Description, System Capabilities, Management Address

Organizationally Specific TLVs supported:
MAC/PHY configuration/status, Power via MDI, Link aggregation, Maximum Frame Size,
 Port VLAN tag, Port VLAN name.

Meaning

The show lldp detail command output shows that both LLDP and LLDP-MED are configured on the ge-0/0/2 interface. The end of the output shows the list of supported LLDP basic management TLVs and organizationally specific TLVs that are supported.

Verifying Authentication for the Desktop PC

Purpose
Action
Meaning

Purpose

Display the 802.1X configuration for the desktop PC connected to the VoIP interface through the IP phone.

Action

content_copy zoom_out_map
user@switch>  show dot1x interface ge/0/0/2.0 detail
ge-0/0/2.0
  Role: Authenticator
  Administrative state: Auto
  Supplicant mode: Multiple
  Number of retries: 3
  Quiet period: 60 seconds
  Transmit period: 30 seconds
  Mac Radius: Disabled
  Mac Radius Restrict: Disabled
  Reauthentication: Enabled
  Configured Reauthentication interval: 3600 seconds
  Supplicant timeout: 30 seconds
  Server timeout: 30 seconds
  Maximum EAPOL requests: 2
  Guest VLAN member: <not configured>
  Number of connected supplicants: 1
    Supplicant: user101, 00:04:0f:fd:ac:fe
      Operational state: Authenticated
      Authentication method: Radius
      Authenticated VLAN: vo11
      Dynamic Filter: match source-dot1q-tag 10 action deny
      Session Reauth interval: 60 seconds
      Reauthentication due in 50 seconds

Meaning

The field Role shows that the ge-0/0/2.0 interface is in the authenticator role. The Supplicant Mode field shows that the interface is configured in multiple supplicant mode, permitting multiple supplicants to be authenticated on this interface. The MAC addresses of the supplicants currently connected are displayed at the bottom of the output.

Verifying the VLAN Association with the Interface

Purpose
Action
Meaning

Purpose

Display the interface’s VLAN membership.

Action

content_copy zoom_out_map
user@switch> show ethernet-switching interface ge-0/0/2.0
Routing Instance Name : default-switch
Logical Interface flags (DL - disable learning, AD - packet action drop,
                         LH - MAC limit hit, DN - interface down )
Logical      Vlan       TAG   MAC      STP          Logical         Tagging
interface    members          limit    state        interface flags
ge-0/0/2.0                    65535                                 untagged
             voice-vlan 99
                              65535    Discarding
             data-vlan  77
                              65535    Discarding

Meaning

The Vlan members field shows that the ge-0/0/2.0 interface supports both the data-vlan VLAN and voice-vlan VLAN.

arrow_backward PREVIOUS Dynamic VLAN Assignment for Colorless Ports

NEXT arrow_forward IEEE 802.1x Port-Based Network Access Control Overview

Helped me install or use the product
Accelerated my deployment

Discuss the product with a co-worker
Make a purchase inquiry

User Access and Authentication Administration Guide for Junos OS

ON THIS PAGE

VoIP on EX Series Switches

Understanding 802.1X and VoIP on EX Series Switches

Multi Domain 802.1X Authentication

See Also

Example: Setting Up VoIP with 802.1X and LLDP-MED on an EX Series Switch

Requirements

Overview and Topology

Configuration

Procedure

CLI Quick Configuration

Step-by-Step Procedure

Results

Verification

Verifying LLDP-MED Configuration

Purpose

Action

Meaning

Verifying 802.1X Authentication for IP Phone and Desktop PC

Purpose

Action

Meaning

Verifying the VLAN Association with the Interface

Purpose

Action

Meaning

See Also

Example: Configuring VoIP on an EX Series Switch Without Including LLDP-MED Support

Requirements

Overview

Topology

Configuring VoIP Without LLDP-MED by Using a Voice VLAN on an Access Port

Procedure

CLI Quick Configuration

Step-by-Step Procedure

Results

Configuring VoIP Without LLDP-MED by Using a Trunk Port with Native VLAN Option

Procedure

CLI Quick Configuration

Step-by-Step Procedure

Results

Verification

Verifying the VLAN Association With the Interface

Purpose

Action

Meaning

See Also

Example: Configuring VoIP on an EX Series Switch Without Including LLDP-MED Support

Requirements

Overview

Topology

Configuring VoIP Without LLDP-MED by Using a Voice VLAN on an Access Port

Procedure

CLI Quick Configuration

Step-by-Step Procedure

Results

Configuring VoIP Without LLDP-MED by Using a Trunk Port with Native VLAN Option

Procedure

CLI Quick Configuration

Step-by-Step Procedure

Results

Verification

Verifying the VLAN Association With the Interface

Purpose

Action

Meaning

See Also

Example: Configuring VoIP on an EX Series Switch Without Including 802.1X Authentication

Requirements

Overview

Configuration

Procedure

CLI Quick Configuration

Step-by-Step Procedure

Results

Verification

Verifying LLDP-MED Configuration

Purpose

Action