1.Check the configuration initially and did not found abnormal point.
2.Since the IP Phone cannot get IP in voice vlan quickly, capture packet to analyze the DHCP process on the port which is connected to IP Phone.
According to the DHCP process, we could see that:
a. IP Phone get IP in date vlan normally and release data IP successfully
b. After that, IP Phone keeps sending dhcp request and dhcp discover to request new IP address in voice vlan.
However, there is no reply from DHCP server
c. After around 60 minutes, DHCP server responds offer packets and IP Phone could take voice IP.
3.Based on above analysis, we could confirm that DHCP Server did not timely respond the request from IP Phone and it makes the delay.
There are two possible reasons:
a.S5700 did not forward the dhcp request/discover correctly
b.The upper network did not forward the dhcp request/discover correctly
4.Further analyze the packet capture and found one interesting point as following.
After IP Phone released the data IP,there is 802.1x authentication failure record. After three times failure. IP Phone could get voice IP.
Confirmed with customer and they were using MAC authentication for IP Phone. However, dot1x authentication is prioritized than MAC authentication in the configuration
If multiple authentication modes are enabled, the authentication modes take effect in the sequence they are configured.
5.Till now, we could conclude that dot1x authentication delay the DHCP process. since customer need to keep dot1x authentication for PC, below solution is provided.
Decreased dot1x authentication timer as following and the problem is solved.
[HUAWEI]dot1x timer client-timeout 3
[HUAWEI]dot1x timer tx-period 3
Root Cause
