Each analyst desk has an IP phone whose PC port carries a laptop. The phone must be authorized by MAB into the voice domain while the laptop passes 802.1X with EAP-TLS into the data domain, and each device needs its own authorization policy on the same wired port. Which IBNS 2.0 host mode should you enable on the access ports?
Select an answer to reveal the explanation.
Short Explanation
Enable multi-domain authentication so you can authorize the phone with MAB in the voice domain and the laptop with 802.1X in the data domain, each with its own policy on the same port. It’s like two clearly marked lanes sharing one road: each device stays in its own domain.
Full Explanation
Multi-domain authentication is the right host mode because it supports one authorized voice endpoint and one authorized data endpoint on the same access port, while allowing each to be authenticated and assigned its own authorization policy. The phone can use MAB in the voice domain and the laptop can complete EAP-TLS in the data domain, matching both the required domain separation and authentication methods. Multi-auth is a legitimate choice when a port must independently authenticate multiple endpoints and apply per-device policies, but it does not provide the required voice/data domain distinction; its multiple authenticated sessions are in the data domain. Multi-domain with 802.1X for both endpoints preserves the separate domains and policies, but changes the phone’s required MAB method. Multi-domain with MAB for both also preserves the domains and individual policies, but fails the requirement that the laptop use EAP-TLS. Exam caveat: host-mode behavior and supported combinations can vary by platform and software release, so do not infer that multi-auth and multi-domain are interchangeable. Practical check: verify the switch’s session table shows separate phone and laptop sessions, their expected authentication methods, voice/data VLAN assignments, and distinct authorization results.