This ended up being the correct port configuration: interface Gi2/0/1 description "802.1x client port" spanning-tree portfast switchport mode general switchport general pvid 75 switchport general allowed vlan add 75 switchport general allowed vlan add 76 tagged dot1x port-control mac-based dot1x reauthentication dot1x timeout quiet-period 5 dot1x timeout supp-timeout 15 dot1x timeout tx-period 5 dot1x timeout guest-vlan-period 15 dot1x guest-vlan 20 dot1x unauth-vlan 20 voice vlan 76 voice vlan auth disable The most important line here is the "dot1x port-control mac-based". I had "dot1x port-control auto" configured, but that does not work as expected. Also, setting the guest-vlan-period and supp-timeout were necessary. If the port was downed, the switch wouldn't necessarily reauth the port.
Hello, I just received several N3048P switches for our access layer and 2x 4048-ON for our core layer. The N3048P's are VLT'd between the two 4048's. There are 4x N3048P's stacked together. The 4048's own all the gateways via VRRP. I have 802.1x working with my test Windows client, and I can get the phone (Cisco 7941) to acquire a DHCP address if I put it on a "switchport mode access" port. However, if I change the port to a general port with voice vlan enabled and 802.1x, the phone does not get a DHCP address, but the PC attached to the phone still gets a DHCP address in the correct VLAN. I see CDP and LLDP messages being exchanged via Wireshark, and it looks like the phone and the switch are exchanging the Voice VLAN correctly. My question is, why can the phone not get a DHCP address?  Here is the relevant config from the switch below. I realize some of the config may be duplicate for troubleshooting measures: vlan 75name "Test"exitvlan 76name "Test_Phones"exit ip helper-address 1.1.1.3 dhcpip helper-address 1.1.1.4 dhcp interface vlan 75ip address 172.16.75.4 255.255.255.0ip helper-address 1.1.1.3ip helper-address 1.1.1.4exitinterface vlan 76ip address 172.16.76.4 255.255.255.0ip helper-address 1.1.1.3ip helper-address 1.1.1.4 aaa authentication login "defaultList" localaaa accounting dot1x default start-stop radiusdot1x system-auth-controlaaa authentication dot1x default radiusaaa authorization network default radius voice vlan radius-server source-ip 172.16.75.4radius-server key "key"radius-server host auth 1.1.1.1primaryname "rad1"usage 802.1xkey "key"exitradius-server host auth 1.1.1.2name "rad2"usage 802.1xkey "key"exitradius-server host acct 1.1.1.1name "rad1"exitradius-server host acct 1.1.1.2name "rad2"exit interface Gi2/0/1 description "802.1x client port"spanning-tree portfastspanning-tree guard rootswitchport mode generalswitchport general allowed vlan add 75-76 taggeddot1x reauthenticationdot1x timeout quiet-period 5dot1x timeout tx-period 5dot1x guest-vlan 20dot1x unauth-vlan 20lldp transmit-tlv sys-desc sys-caplldp transmit-mgmtlldp notificationlldp med confignotificationvoice vlan 76voice vlan auth disableexit Thank you for any input you may have. Let me know if there is any other information I can provide. -Jason
N3048P voice vlan and DHCP issues