Cisco phones loosing connectivity with VMPS and IOS upgrade to 15.0(1)SE2
Hi, we have a Cisco C3750E switch stack which had a previous version of IOS on it, 12.2 or so.... I recently performed an upgrade to the latest version that Cisco offer: 15.0(1)SE2 however, after the upgrade took place the phones started loosing connectivity. It seems that the correct VLAN wasn't beeing assigned to the MAC addresses of the phones and therefor the phones acquiring the business vlan and hence the ports getting blocked. I will perform a wireshark and tcpdump packet capture this evening in order to try to debug more clearly what is going on between the devices however, in the mean time I was wondering if there was some sort of interoperability quircks between newer Cisco IOS releases and FreeRADIUS (VMPS)?? Unfortunately I can't give the version of FreeRADIUS being used as I didn't set it up initially and hence the software is not within the package database of the Linux box it's running on; however if there is a command I could use from one of the FreeRADIUS binaries I am happy to provide the information. Can anyone suggest anything? Regards, Kaya
Kaya Saman wrote:
I recently performed an upgrade to the latest version that Cisco offer: 15.0(1)SE2 however, after the upgrade took place the phones started loosing connectivity.
Then the problem is the new firmware.
I will perform a wireshark and tcpdump packet capture this evening in order to try to debug more clearly what is going on between the devices however, in the mean time I was wondering if there was some sort of interoperability quircks between newer Cisco IOS releases and FreeRADIUS (VMPS)??
Not that I know of. Alan DeKok.
Thanks for the response Alan, On Thu, May 31, 2012 at 11:15 AM, Alan DeKok <aland@deployingradius.com> wrote:
Kaya Saman wrote:
I recently performed an upgrade to the latest version that Cisco offer: 15.0(1)SE2 however, after the upgrade took place the phones started loosing connectivity.
Then the problem is the new firmware.
At present we have statically assigned problematic ports and all is up. It seems that the VMPS is assigning some phones to the wrong VLAN. For some reason we need to put the phone's MAC addresses on both the business VLAN and the Voice VLAN. Now the system is not assigning the the voice VLAN. Regards, Kaya
On 31/05/12 11:05, Kaya Saman wrote:
Unfortunately I can't give the version of FreeRADIUS being used as I didn't set it up initially and hence the software is not within the package database of the Linux box it's running on; however if there is a command I could use from one of the FreeRADIUS binaries I am happy to provide the information.
Well, the standard suggestion, documented in the server docs, is to capture the output of: radiusd -X ...on a working and failing system. Read the output, see if you can spot the problem. If not, post it here.
Can anyone suggest anything?
Don't use VMPS. Seriously: the VMPS code in FR is great, but VMPS is ancient. If your switch supports it (and I'm sure it does) you should just use RADIUS and MAC-based VLANS (called MAB in Cisco-land) instead.
Kaya Saman wrote: I will perform a wireshark and tcpdump packet capture this evening in order to try to debug more clearly what is going on between the devices however, in the mean time I was wondering if there was some sort of interoperability quircks between newer Cisco IOS releases and FreeRADIUS (VMPS)??
Likely the CISCO decided to change the way they interpret the tunnel-group-id attribute. There are two ways to pass this attribute (normally, and using a cisco vendor specific attribute.) There are three ways the switch may interpret the string contained therein. 1) numerically 2) vlan name 3) vlan group name
Can anyone suggest anything?
Play with different combinations of the above. Also verify that all the global and interface commands which are applied on a working 12.2 switch remain applied on 15.0. Sometimes command syntax changes and the commands get rejected on upgrade.
On Thu, May 31, 2012 at 3:45 PM, Brian Julin <BJulin@clarku.edu> wrote:
Kaya Saman wrote: I will perform a wireshark and tcpdump packet capture this evening in order to try to debug more clearly what is going on between the devices however, in the mean time I was wondering if there was some sort of interoperability quircks between newer Cisco IOS releases and FreeRADIUS (VMPS)??
Likely the CISCO decided to change the way they interpret the tunnel-group-id attribute.
There are two ways to pass this attribute (normally, and using a cisco vendor specific attribute.)
There are three ways the switch may interpret the string contained therein.
1) numerically 2) vlan name 3) vlan group name
Can anyone suggest anything?
Play with different combinations of the above.
Also verify that all the global and interface commands which are applied on a working 12.2 switch remain applied on 15.0. Sometimes command syntax changes and the commands get rejected on upgrade.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Thanks for the information. I will have a look at the tunnel-group-id attribute. Regards, Kaya
Kaya Saman Sent: Friday, June 01, 2012 10:05 AM To: FreeRadius users mailing list Subject: Re: Cisco phones loosing connectivity with VMPS and IOS upgrade to 15.0(1)SE2
On Thu, May 31, 2012 at 3:45 PM, Brian Julin <BJulin@clarku.edu> wrote:
Kaya Saman wrote: I will perform a wireshark and tcpdump packet capture this evening in order to try to debug more clearly what is going on between the devices however, in the mean time I was wondering if there was some sort of interoperability quircks between newer Cisco IOS releases and FreeRADIUS (VMPS)??
Likely the CISCO decided to change the way they interpret the tunnel-group-id attribute.
There are two ways to pass this attribute (normally, and using a cisco vendor specific attribute.)
There are three ways the switch may interpret the string contained
therein.
1) numerically 2) vlan name 3) vlan group name
Can anyone suggest anything?
Play with different combinations of the above.
Also verify that all the global and interface commands which are applied on a working 12.2 switch remain applied on 15.0. Sometimes command syntax changes and the commands get rejected on upgrade.
- List info/subscribe/unsubscribe? See
http://www.freeradius.org/list/users.html
Thanks for the information.
I will have a look at the tunnel-group-id attribute.
Actually now that I've looked up "VMPS" I doubt it is in use. Also my bad, it's "tunnel-private-group-id". VMPS is widely considered deprecated, in favor of dot1x+mab. If you're having trouble moving forward on upgrades, it might be a good time to consider modernizing. However, if you are also using the more basic non-auth-related first-hop security features such as ip sourceguard+port-security, I would recommend you to steer clear of the 15 release train for now; it has issues.
participants (4)
-
Alan DeKok -
Brian Julin -
Kaya Saman -
Phil Mayers