Cisco 802.1X and MAB Configuration: Step-by-Step CLI Guide

Port security alone cannot tell you who plugged into a wall jack, which is why most enterprises run IEEE 802.1X with MAC Authentication Bypass (MAB) as a fallback. This guide walks through a working Cisco IOS XE configuration: AAA and RADIUS setup, the global dot1x system-auth-control switch, per-port authentication statements, host modes, and the flexible authentication order that lets printers and IP phones without supplicants still get on the network. Every section ends with the verification command you should run before moving to the next switch. The goal is a configuration you can paste into a lab, test with a real supplicant, and then roll out with confidence.

Prerequisites and topology

You need a RADIUS server (Cisco ISE, FreeRADIUS or Windows NPS) reachable from the switch management SVI, a shared secret, and a client device that can run a supplicant (Windows native, Cisco Secure Client or wpa_supplicant on Linux). Layer 2 must be stable first - if you are still fighting spanning tree loops, fix that before adding authentication, or you will debug two problems at once.

Step 1: AAA and RADIUS on the switch

Switch(config)# aaa new-model
Switch(config)# aaa authentication dot1x default group radius
Switch(config)# aaa authorization network default group radius
Switch(config)# aaa accounting dot1x default start-stop group radius
Switch(config)# radius server ISE1
Switch(config-radius-server)# address ipv4 10.10.20.50 auth-port 1812 acct-port 1813
Switch(config-radius-server)# key Str0ngSharedKey
Switch(config)# ip radius source-interface Vlan10
Switch(config)# dot1x system-auth-control

aaa new-model must come first, and never forget the local fallback user before you enable it - if RADIUS is unreachable and you have no local account, you can lock yourself out on a VTY session. The ip radius source-interface line matters: the RADIUS server usually identifies the switch by source IP, so a flapping SVI can break authentication for every port at once.

Step 2: Enable 802.1X on an access port

Switch(config)# interface GigabitEthernet1/0/10
Switch(config-if)# description Access port - 802.1X
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 10
Switch(config-if)# authentication port-control auto
Switch(config-if)# dot1x pae authenticator
Switch(config-if)# spanning-tree portfast

Before the first EAPOL frame is exchanged the port sits in the unauthorized state and only EAPOL, CDP/LLDP and STP traffic passes. authentication port-control auto is the line that makes the port authenticate; dot1x pae authenticator is required on most IOS XE platforms before any authentication method works.

Step 3: Add MAC Authentication Bypass (MAB)

MAB authenticates a device by its MAC address, which the RADIUS server treats as both username and password. It is intended for devices that cannot run a supplicant: printers, badge readers, legacy phones, medical equipment.

Switch(config-if)# mab
Switch(config-if)# authentication host-mode multi-domain
Switch(config-if)# authentication order dot1x mab
Switch(config-if)# authentication priority dot1x mab
Switch(config-if)# authentication violation restrict
Switch# show mab interface GigabitEthernet1/0/10

The difference between order and priority trips people up constantly. Order is the sequence in which methods are attempted; priority decides which method wins if it comes back later. A typical desk port uses dot1x mab for both so the supplicant is tried first - and priority keeps a real 802.1X client ahead of a MAC-cached MAB session.

Host modes for phones and virtual desktops

For voice deployments also add switchport voice vlan 20 and, on some platforms, enable voice-aware 802.1X so the phone can authenticate on the voice domain while the PC behind it authenticates separately. See our Cisco voice VLAN guide for that half of the configuration.

Step 4: Verification and troubleshooting

Switch# show authentication sessions interface GigabitEthernet1/0/10 details
Switch# show dot1x interface GigabitEthernet1/0/10 details
Switch# show authentication session interface gi1/0/10 method mab
Switch# show radius statistics
Switch(config)# authentication display config-mode
Switch# debug dot1x all
Switch# debug radius

Read show authentication sessions from the inside out: the Method field tells you whether dot1x or mab produced the result, the Status field should read Authz Success, and the Domain field tells you which VLAN was assigned. If the state sticks at Running, the switch is not getting a RADIUS reply at all - check reachability and the shared key. If it moves to Fail, the credentials are wrong, the MAC is not in the identity store, or the authorization policy rejected the request. A quick sanity check is test aaa group radius user mac-address password mac-address new-code.

Design notes that save time later

Keep authentication and authorization on the same RADIUS group so the server can push downloadabl ACLs and VLANs. Use authentication violation restrict rather than shutdown on ports where a cheap switch or a VM host might be plugged in, because a shutdown violation requires a manual shutdown / no shutdown to recover. And record the physical port map: the fastest way to onboard hundreds of ports is a spreadsheet that maps MAC address to switchport, fed into the RADIUS MAC database. Our port security and sticky MAC guide covers the complementary Layer 2 protection, and RADIUS vs TACACS+ explains why device administration still belongs on TACACS+.

原文链接：https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst9300/software/release/26-x/configuration_guide/cts/b_26x_cts_9300_cg/configuring_endpoint_admission_control.html