While reasonable efforts have been made to ensure that the information in this document is complete and accurate at the time of
printing, Avaya assumes no liability for any errors. Avaya reserves the right to make changes and corrections to the information in
this document without the obligation to notify any person or organization of such changes.
Documentation disclaimer
Avaya shall not be responsible for any modifications, additions, or deletions to the original published version of this documentation
unless such modifications, additions, or deletions were performed by Avaya. End User agree to indemnify and hold harmless Avaya,
Avaya’s agents, servants and employees against all claims, lawsuits, demands and judgments arising out of, or in connection with,
subsequent modifications, additions or deletions to this documentation, to the extent made by End User.
Link disclaimer
Avaya is not responsible for the contents or reliability of any linked Web sites referenced within this site or documentation(s)
provided by Avaya. Avaya is not responsible for the accuracy of any information, statement or content provided on these sites and
does not necessarily endorse the products, services, or information described or offered within them. Avaya does not guarantee that
these links will work all the time and has no control over the availability of the linked pages.
Warranty
Avaya provides a limited warranty on this product. Refer to your sales agreement to establish the terms of the limited warranty. In
addition, Avaya’s standard warranty language, as well as information regarding support for this product, while under warranty, is
available to Avaya customers and other parties through the Avaya Support Web site: http://www.avaya.com/support
Please note that if you acquired the product from an authorized reseller, the warranty is provided to you by said reseller and not by Avaya.
Licenses
THE SOFTWARE LICENSE TERMS AVAILABLE ON THE AVAYA WEBSITE, HTTP://SUPPORT.AVAYA.COM/LICENSEINFO/
ARE APPLICABLE TO ANYONE WHO DOWNLOADS, USES AND/OR INSTALLS AVAYA SOFTWARE, PURCHASED FROM
AVAYA INC., ANY AVAYA AFFILIATE, OR AN AUTHORIZED AVAYA RESELLER (AS APPLICABLE) UNDER A COMMERCIAL
AGREEMENT WITH AVAYA OR AN AUTHORIZED AVAYA RESELLER. UNLESS OTHERWISE AGREED TO BY AVAYA IN
WRITING, AVAYA DOES NOT EXTEND THIS LICENSE IF THE SOFTWARE WAS OBTAINED FROM ANYONE OTHER THAN
AVAYA, AN AVAYA AFFILIATE OR AN AVAYA AUTHORIZED RESELLER, AND AVAYA RESERVES THE RIGHT TO TAKE
LEGAL ACTION AGAINST YOU AND ANYONE ELSE USING OR SELLING THE SOFTWARE WITHOUT A LICENSE. BY
INSTALLING, DOWNLOADING OR USING THE SOFTWARE, OR AUTHORIZING OTHERS TO DO SO, YOU, ON BEHALF OF
YOURSELF AND THE ENTITY FOR WHOM YOU ARE INSTALLING, DOWNLOADING OR USING THE SOFTWARE
(HEREINAFTER REFERRED TO INTERCHANGEABLY AS "YOU" AND "END USER"), AGREE TO THESE TERMS AND
CONDITIONS AND CREATE A BINDING CONTRACT BETWEEN YOU AND AVAYA INC. OR THE APPLICABLE AVAYA
AFFILIATE ("AVAYA").
Copyright
Except where expressly stated otherwise, no use should be made of the Documentation(s) and Product(s) provided by Avaya. All
content in this documentation(s) and the product(s) provided by Avaya including the selection, arrangement and design of the
content is owned either by Avaya or its licensors and is protected by copyright and other intellectual property laws including the sui
generis rights relating to the protection of databases. You may not modify, copy, reproduce, republish, upload, post, transmit or
distribute in any way any content, in whole or in part, including any code and software. Unauthorized reproduction, transmission,
dissemination, storage, and or use without the express written consent of Avaya can be a criminal, as well as a civil offense under
the applicable law.
Third Party Components
Certain software programs or portions thereof included in the Product may contain software distributed under third party agreements
("Third Party Components"), which may contain terms that expand or limit rights to use certain portions of the Product ("Third Party
Terms"). Information regarding distributed Linux OS source code (for those Products that have distributed the Linux OS source
code), and identifying the copyright holders of the Third Party Components and the Third Party Terms that apply to them is available
on the Avaya Support Web site: http://support.avaya.com/Copyright.
Trademarks
The trademarks, logos and service marks ("Marks") displayed in this site, the documentation(s) and product(s) provided by Avaya
are the registered or unregistered Marks of Avaya, its affiliates, or other third parties. Users are not permitted to use such Marks
without prior written consent from Avaya or such third party which may own the Mark. Nothing contained in this site, the
documentation(s) and product(s) should be construed as granting, by implication, estoppel, or otherwise, any license or right in and
to the Marks without the express written permission of Avaya or the applicable third party. Avaya is a registered trademark of Avaya
Inc. All non-Avaya trademarks are the property of their respective owners.
Downloading documents
For the most current versions of documentation, see the Avaya Support. Web site: http://www.avaya.com/support
Contact Avaya Support
Avaya provides a telephone number for you to use to report problems or to ask questions about your product. The support
telephone number is 1-800-242-2121 in the United States. For additional support telephone numbers, see the Avaya Web site:
http:// www.avaya.com/support.
Avaya Inc. – External Distribution
3
avaya.com
Aug 2012
Abstract
The purpose of this TCG is to review the many options available on Avaya Ethernet and Ethernet Routing
Switches for interoperability with Avaya’s IP Phone sets.
Acronym Key
Throughout this guide the following acronyms will be used:
AES :Avaya Energy Saver
ADAC :Auto Detect Auto Configuration
DHCP :Dynamic Host Configuration Protocol
DSCP : Differentiated Services Code Point
EAP :Extensible Authentication Protocol, IEEE 802.1X
EAP MHMA :EAP Multiple Host Multiple Authentication
EAP NEAP : non-EAP Client
EDM :Enterprise Device Manager
ERS :Ethernet Routing Switch
LACP :Link Aggregation Control Protocol
LLDP :Link Payer Discovery Protocol, IEEE 802.1AB
MLT :Multilink Trunking
PoE :Power over Ethernet
QoS :Quality of Service
SMLT :Split Multilink Trunking
TOS :Type of Service
UBP :User Based Policies
VLACP : Virtual LACP
VLAN : Virtual LAN
Avaya Inc. – External Distribution
4
avaya.com
Aug 2012
No
Date
Version
Revised By
Remarks
1
07/12/2007
2.2
ESE
Modification to section 4.4.2 on page 45.
2
01/28/2008
3.0
ESE
Modifications
3
02/14/2008
4.0
ESE
Added updates related to ADAC and
EAPOL.
Added ERS2500 and ERS4000 switches.
4
8/4/2009
6.0
JVE
Updates related to auto provisioning and
software updates on various switches
5
8/26/2010
7.0
JVE
Updated based on all Avaya IP Phones and
added features on various Avaya switches.
Added AES (Avaya Energy Savings)
6
1/07/2011
7.1
JVE
Update regarding LLDP-TLVs. LLDP tx-tlv
sys-cap added to interface level in section
2.3.1.1. This is required to support some IP
Phone models
7
2/21/2012
7.2
John Vant
Erve
Add details regarding voice-vlan
provisioning reflected in configuration
examples. Added ERS 4000 PoE+ models
8
7/30/2012
7.3
John Vant
Erve
Added ERS 3500.
8
8/21/2012
7.4
John Vant
Erve
Non-eap-phone support when using Avaya
9600 series IP Phones
2.7.3 RADIUS Server Configuration ................................................................................................................ 60
2.8 Auto Configuration with a Stackable Ethernet Routing Switch using EAP with NEAP and User
Based Policy ............................................................................................................................................ 64
10.5.6 MHMA Last Assigned RADIUS VLAN .............................................................................................. 255
10.5.7 MHMA with Fail Open VLAN ............................................................................................................ 255
10.5.8 VoIP VLAN ....................................................................................................................................... 255
10.7.1 RADIUS Setup for NEAP ................................................................................................................. 265
10.7.2 RADIUS Setup for Dynamic VLAN Assignment ............................................................................... 274
10.7.3 IAS Server ....................................................................................................................................... 275
Tip – Highlights a configuration or technical tip.
Note – Highlights important information to the reader.
Warning – Highlights important information about an action that may result in equipment
damage, configuration or data loss.
Text
Bold text indicates emphasis.
Italic text in a Courier New font indicates text the user must enter or select in a menu item, button or
command:
ERS5520-48T# show running-config
Output examples from Avaya devices are displayed in a Lucida Console font:
ERS5520-48T# show sys-info
Operation Mode: Switch
MAC Address: 00-12-83-93-B0-00
PoE Module FW: 6370.4
Reset Count: 83
Last Reset Type: Management Factory Reset
Power Status: Primary Power
Autotopology: Enabled
Pluggable Port 45: None
Pluggable Port 46: None
Pluggable Port 47: None
Pluggable Port 48: None
Base Unit Selection: Non-base unit using rear-panel switch
sysDescr: Ethernet Routing Switch 5520-48T-PWR
HW:02 FW:6.0.0.10 SW:v6.2.0.009
Mfg Date:12042004 HW Dev:H/W rev.02
Conventions
This section describes the text, image, and command conventions used in this document.
Avaya Inc. – External Distribution
13
avaya.com
Aug 2012
1. Overview
This TCG covers standalone Avaya IP Phone sets and how they can be deployed on various Avaya
switches. It will cover features on Avaya switches related to VoIP with configuration examples. Overall,
topics that will be covered include the following:
Auto configuration via DHCP for VoIP Phone sets
Auto provisioning using tftp or http
Avaya Energy Saver (AES)
Authentication using EAPoL (802.1x)
Auto Detection Auto Configuration (ADAC)
Link Layer Discovery Protocol (LLDP)
Power over Ethernet (PoE)
Quality over Service (QoS)
Avaya Inc. – External Distribution
14
avaya.com
Aug 2012
Section
Item
QoS
Description
2.3
DHCP or
optional LLDPMED
Manually configured1
Switch uses either DHCP or optional LLDP-MED
Network Policy to provision voice VLAN
2.4
ADAC – LLDP
Dectection
Automatically applied
to Voice VLAN2
Switch uses ADAC to automically detect IP Phone
using LLDP
2.5
ADAC – MAC
Detection
Automatically applied
to Voice VLAN
Switch uses ADAC to automatically detect IP
Phone using MAC address of IP Phone
2.6
DHCP
None
Uses DHCP to get VLAN ID for voice VLAN from
data DHCP scope using the ERS 8300
2.7
EAP MHMA
N/A
Optional configuration to enable IP Phones as an
EAP Supplicant using MD5
2.8
EAP NEAP
N/A
Optional configuration using the EAP NEAP
feature on the switch allowing it to authenticate
the IP Phone using its MAC address
2.9
EAP fail open
VLAN, guest
VLAN, and
RADIUS
assigned VLAN
N/A
Optional configuration using the EAP non-eapphone feature and other EAP options such as fail
open VLAN, guest VLAN, and RADIUS assigned
VLANs
2.10
DHCP and
Provisioning
files
N/A
DHCP server settings and provisioning files for
the IP Phones used in this example
2.11
Avaya Energy
Saver
N/A
Optional configuration adding AES to the switch
2.12
DHCP Server
N/A
Windows 2003 DHCP server settings
2. Automatic Provisioning Configuration
Examples
This section will cover various configuration examples to allow for automatic or zero-touch provisioning of
Avaya IP phones using Avaya data switches. The following chart summarizes each configuration
example.
1
QoS can be added in a number of methods such as simply trusting all traffic, applying filters, or enabling
Auto QoS (applies to Avaya 1100, 1200, or 2000 series only)
2
The LLDP-MED Network Policy can also set the QoS DSCP and p-bit priority values
Figure 1: Base setup - Stackable Ethernet Routing Switch Setup
The following are the details for the base configuration:
ERS-Stackable is a stackable Ethernet Routing Switches (ERS 2500, 4000, or 5000 series) setup
as a Layer 2 switch connected to an SMLT Cluster
The SMLT Cluster requires that DHCP Relay be enabled with a DHCP Relay agent for both the
voice and data VLANs
Overall, we will configure the following
o Create Voice VLAN 805 with port members 3 to 11, 23, and 24
o Create Data VLAN 1002 with port members 3 to 11, 23, and 24
o Create Management VLAN 201 with port members 23 and 24
o Configure access ports 3 to 11 to allow untagged Data VLAN 1002 and tagged Voice
VLAN 805
o Configure core ports 23 and 24 using MLT 1 using VLAN tagging and with Spanning
disabled
o Use all the recommended SMLT best practices
Details regarding various Avaya IP Phone DHCP and provisioning file parameters are listed in
Appendix A
Avaya Inc. – External Distribution
16
avaya.com
Aug 2012
2.1.3 Diagram 2 : Ethernet Routing Switch 8300
Figure 2: Base setup - Ethernet Routing Switch 8300 Setup
Overall, we will configure the following:
Create Voice VLAN 220 with port members 1/1 to 1/25
Create Data VLAN 61 with port members 1/1 to 1/25
Create Trunk VLAN 83 with port member 5/5
Enable DHCP relay for VLAN 220 and 61
Enable Spanning Tree Fast-Start on ports 1/1 to 1/25 and disable STP on port 5/5
Configure all voice ports, 1/1 to 1/25, with POE priority of high
Enable RIP on all VLANs
By default, the ERS 8300 passes both the DSCP and p-bit values as-is. The p-bit value
determines the QoS level. For this example, we will not configure QoS as we are using VLAN
tagging for the Voice VLAN
Details regarding various Avaya IP Phone DHCP and provisioning file parameters are listed in
Appendix A
Avaya Inc. – External Distribution
17
avaya.com
Aug 2012
Switch Model
Software Level
Notes
ERS 2500
4.4
Supports LLDP MED Policy via
ADAC
ERS 4000
5.6
Support LLDP MED Policy with
ADAC or without ADAC
ERS 5000
6.2.2.025
Support LLDP MED Policy with
ADAC or without ADAC
2.2 Switch Software levels
For this configuration example, the following software levels are used
Avaya Inc. – External Distribution
18
avaya.com
Aug 2012
ERS-Stackable Step 1 - Enter configuration mode
ERS-Stackable>enable
ERS-Stackable#configure terminal
ERS-Stackable Step 1 – Create VLAN’s 201, 805, and 1002
ERS-Stackable(config)#vlan create 201 name mgmt type port
ERS-Stackable(config)#vlan create 805 name voice type port voice-vlan
ERS-Stackable(config)#vlan create 1002 name data type port
ERS-Stackable Step 2 – Enable VLAN tagging on all appropriate ports
ERS-Stackable(config)#vlan port 23-24 tagging tagall
ERS-Stackable(config)#vlan port 3-11 tagging untagpvidOnly
ERS-Stackable Step 3 – Set VLAN configuration control to automatic and add VLAN port
members
2.3 Auto Configuration with a Stackable Ethernet
Routing Switch – with traffic filters for QoS and
optional LLDP MED Policy
LLDP-MED Policy can be used with our without ADAC. If you choice to not use ADAC, by default, there
will be no QoS for the voice traffic. There are a number of ways to provide QoS for the voice traffic such
as:
Creating a new interface group with a class of trusted and applying this interface group to either
all ports or at minimum the uplink ports, call server ports, and all ports connected to IP phones.
This is simplest method, but, it also trusts all traffic which may or may not be acceptable
o Could create a filter to look for the data VLAN and remark to Standard service
Leave all ports with the default Interface Group with a class of untrusted and add a filter to look
for the voice VLAN and remark traffic to Premium service.
For this configuration example, we will simply create a traffic profile to match the voice VLAN and set the
CoS to Premium (p-bit value of 6 and DSCP value of 46).
This configuration example is in reference to diagram 1.
2.3.1 Stackable Switch Configuration
2.3.1.1 Go to configuration mode.
2.3.1.2 Create VLAN’s
Avaya Inc. – External Distribution
19
avaya.com
Aug 2012
ERS-Stackable(config)#vlan members add 201 23-24
ERS-Stackable(config)#vlan members add 1002 3-11,23-24
ERS-Stackable(config)#vlan members add 805 3-11,23-24
ERS-Stackable(config)#vlan port 3-11 pvid 1002
ERS-Stackable Step 4 – Remove port members from the default VLAN
ERS-Stackable(config)#vlan members remove 1 3-11,23-24
Voice VLAN integration has been added to the various ERS stackable switches
beginning with release 5.6 for the ERS 4000, and 6.2 for the ERS 5000. This feature
offers a unified concept of Voice VLAN though various applications including ADAC,
EAP, and LLDP. Please see section 5.1 for more details.
ERS5698TFD-1 Step 1 – Add MLT with trunk members
ERS-Stackable(config)# mlt 1 enable member 23,24 learning disable
ERS-Stackable Step 1 – Enable VLACP on uplink port member 23 and 24 using the
recommended VLACP MAC and timeout values
ERS-Stackable Step 1 – Set PoE Power level high on all VoIP ports
ERS-Stackable(config)#interface fastEthernet 3-11
ERS-Stackable(config)#poe poe-priority high
ERS-Stackable(config)#exit
2.3.1.6 Configure Management IP address on switch
An IP address can be added in one of two ways. If the switch is strictly used as a Layer 2 switch, then an
IP address can be added via the Layer 2 method using the ACLI command ip address <switch|stack> <IP address> netmask <mask> default-gateway <default GW>.
2.3.1.6.1 Adding Management IP - Layer 2
2.3.1.6.2 Adding Management IP - Layer 3
2.3.1.7 Configure PoE levels - Optional
If you wish, you can change the default PoE level of low to either high or critical.
Avaya Inc. – External Distribution
21
avaya.com
Aug 2012
If you are using an Avaya Ethernet Routing Switch 5000 or Ethernet Routing Switch
4000 (release 5.4 or higher), the default queue set (queue set 2) uses two strict queues
with large buffers. If you wish, you can provision another queue set if 2 queues do not
meet your needs. For example, queue set 4 which will provide three weighted queues
and one strict queue may be more acceptable to handle voice, video, and data. If you
do wish to use queue set 4, enter the ACLI command qos agent queue-set 4. You can
use the ACLI command show qos queue-set to view the make up for each queue set.
The ERS 2500 only supports one queue set, queue set 4, which supports one strict
queue and three weighted-round-robin (WWR) queues.
ERS-Stackable Step 1 – Change from default queue set (queue set 2) to queue set 4 and
reset the switch. Note, this only applies to the ERS 5000 or ERS 4000
ERS-Stackable(config)#qos agent queue-set 4
QoS queue setting isn't effective until after reset.
ERS-Stackable Step 2 – Create a new interface group with a class of trusted
ERS-Stackable(config)#qos if-group name trusted class trusted
ERS-Stackable(config)#qos if-assign port ALL name trusted
2.3.1.8 QoS
There are several options you can deploy to add QoS for the voice traffic.
Assign QoS class of trusted to all ports – easiest to implement and trust’s all traffic including soft
clients
Assign QoS class of trusted to all ports and adding a filter to remark the data traffic if you do not
trust traffic from the data VLAN – note, will will also remark soft clients to best effort
Set all access ports as untrusted (default setting), set uplink ports as trusted, and add a filter to
remark the voice traffic to CoS level of Premium – only provides QoS for the voice VLAN
Enable Auto QoS – only supported on limited Avaya products
o CS1000, CS2100, BCM, and/or SRG call servers
Enable ADAC – automatically provides QoS only to the voice VAN – please see next two sections
regarding ADAC provisioning
For this example, we will simply trust all traffic by setting all ports as trusted ports. This is the easiest
method for applying QoS for both untagged soft clients and tagged hard clients. We will also provision the
switch with queue set 4 providing 1 strict queue and 3 WRR queues which may be more acceptable to
handle voice, data, and video if the switch is either a ERS 4000 or ERS 5000; by default, the ERS 2500
uses queue set 4 while the ERS 4000 and ERS 5000 uses queue set 2. Otherwise, if the switch is only
supporting voice and data, you can use the default queue set 2 in reference to the ERS 4000 and ERS
5000.
Avaya Inc. – External Distribution
22
avaya.com
Aug 2012
ERS-Stackable Step 1 – Traffic Profile Option. Configure either a traffic profile or ACL to
remark the data VLAN with a QoS level of Standard depending on switch model. Assuming
ERS-Stackable is an ERS 4000 or ERS 5000, it is recommend to use traffic profiles
ERS-Stackable(config)#qos traffic-profile classifier name one vlan-min 1002
vlan-max 1002 ethertype 0x800 update-dscp 0 update-1p 0
ERS-Stackable(config)#qos traffic-profile set port 1-13 name one
ERS-Stackable Step 1 – ACL Option. Configure either a traffic profile or ACL to remark the
data VLAN with a QoS level of Standard depending on switch model. ACL’s can be used
on a ERS 2500, ERS 4000, or ERS 5000 where it is recommended to use traffic profiles
over ACL’s if supported on the switch
ERS-Stackable(config)#qos l2-acl name one vlan-min 1002 vlan-max 1002 ethertype
0x800 update-dscp 0 update-1p 0
ERS-Stackable(config)#qos l2-acl name one ethertype 0x800 drop-action disable
ERS-Stackable(config)#qos acl-assign port 1-13 acl-type l2 name one
ERS-Stackable Step 1 – Enable STP Fast-Start and BPDU filtering on port 3 to 11
ERS-Stackable(config)#interface fastEthernet all
ERS-Stackable(config-if)#spanning-tree port 3-11 learning fast
ERS-Stackable(config-if)#spanning-tree port 3-11 bpdu-filtering timeout 0
ERS-Stackable(config-if)#spanning-tree port 3-11 bpdu-filtering enable
ERS-Stackable Step 1 – Add LLDP MED Network Policy
If you wish, you can provision the switch to remark the data traffic to best effort if you do not trust the
traffic from the data VLAN.
2.3.1.9 Spanning Tree Configuration
2.3.1.10 Add LLDP-MED Network Policy – Optional for ERS 3500, ERS
4000 or ERS 5000
As an option, you can enable LLDP-MED with Network Policy to provision the voice VLAN without having
to use DHCP. In addition, you can also provision LLDP vendor specific settings to provision the call
server and file server (only for the Avaya 96xx IP phones as per this configuration example).
Note that the ERS 2500 requires ADAC must be used to enable LLDP MED. The ERS 3500 requires
software release 5.0.1 or higher to use LLDP-MED without ADAC.
ERS-Stackable Step 1 – Enable IP DHCP Snooping for voice VLAN 805 and data VLAN
1002
ERS-Stackable(config)#ip dhcp-snooping vlan 805
ERS-Stackable(config)#ip dhcp-snooping vlan 1002
ERS-Stackable(config)#ip dhcp-snooping enable
ERS-Stackable Step 2 – Enable IP Arp Inspection for voice VLAN 805 and data VLAN 1002
ERS-Stackable(config)#ip arp-inspection vlan 805
2.3.1.10.1 LLDP Tx-TLVs – Older Software Releases
Depending on the software release used, it may be nessessary to enable LLDP TLVs. This does not
apply to the ERS 4000 as of release 5.5, ERS 3500 as of release 5.0.1, and ERS 5000 as of release 6.3
from a factory default setting, but, to verify if the TLVs are enabled or not, please enter the ACLI
commands show lldp port 3-11 & show lldp tx-tlv.
2.3.1.10.2 Enable LLDP Vendor Specific settings
Up to 8 call-servers and up to 4 file-servers can be defined. Note that, for this configuration example, the
LLDP vendor specific settings only apply to the Avaya IP Phones.
2.3.1.11 Enable IP Anti-Spoofing and IP Source Guard – Optional
To prevent IP spoofing attacks, it is recommended to enabled IP DHCP Snooping and IP Arp Inspection.
In addition, it is recommended to enabled IP Source Guard which prevents a host from spoofing a source
IP other than that assigned by DHCP.
Avaya Inc. – External Distribution
24
avaya.com
Aug 2012
ERS-Stackable(config)#ip arp-inspection vlan 1002
ERS-Stackable Step 3 – Enable core ports 23 and 24 as a trusted port
lldp port 1/3-11,1/13 vendor-specific avaya dot1q-framing tagged
exit
Step 2 – Verify LLDP network policy configuration – note, this only applies to the ERS 4000
or ERS 5000 as this command is not available on the ERS 2500
ERS-Stackable#show lldp med-network-policies port 3-11
or, via some switches
ERS-Stackable#show lldp med-network-policies port 3-11 voice