IOS-XE – RADIUS and Wired 802.1X

Before you begin

Confirm each prerequisite before planning changes. Checklist progress is kept for this visit and resets when you reload.

1Overview

Configures RADIUS AAA, accounting, CoA and a wired port with 802.1X and MAC Authentication Bypass.

2Global AAA and CoA

Use this device configuration for global aaa and coa. Replace the example values before applying it.

configure terminal
aaa new-model
radius server FORTINAC
 address ipv4 <FNAC_IP> auth-port 1812 acct-port 1813
 key 0 <RADIUS_SECRET>
aaa group server radius FORTINAC-RADIUS
 server name FORTINAC
aaa authentication dot1x default group FORTINAC-RADIUS
aaa authorization network default group FORTINAC-RADIUS
aaa accounting dot1x default start-stop group FORTINAC-RADIUS
ip radius source-interface <SOURCE_INTERFACE>
radius-server vsa send authentication
radius-server vsa send accounting
aaa server radius dynamic-author
 client <FNAC_IP> server-key <RADIUS_COA_SECRET>
 port 3799
 auth-type any
dot1x system-auth-control

3Access-port template

Use this device configuration for access-port template. Replace the example values before applying it.

interface GigabitEthernet1/0/1
 description 802.1X-MAB-ACCESS
 switchport
 switchport mode access
 switchport access vlan <DEFAULT_VLAN>
 authentication host-mode multi-auth
 authentication order mab dot1x
 authentication priority dot1x mab
 authentication event fail action next-method
 authentication port-control auto
 authentication periodic
 authentication timer reauthenticate 65535
 mab
 dot1x pae authenticator
 spanning-tree portfast
end

4Considerations

The source also includes an interface-range macro. It contains authentication order max dot1x, which appears to be a typo; use validated syntax per software version. Avoid blanket enablement on uplinks and critical infrastructure.

5References

Original configuration source (Notion; access may be required) ↗

The supplied snippets are source-derived, not lab-validated. Confirm exact platform and firmware support before applying them. Original Notion pages may require access; their contents were not independently retrieved.

Verify the result

Use observed results to decide whether the intended outcome has been achieved.

If it isn’t working

If authentication fails, compare peer addresses, source IP, shared secrets and FortiNAC policy results. For authorization failures, check the selected port/WLAN and VLAN or role settings. Test accounting and CoA separately.

Video walkthrough