topic 802.1x Method Status List Empty in Network Access Control

802.1x Method Status List Empty

DM812 — Tue, 02 Apr 2024 09:13:31 GMT

We're seeing an issue on our 9200 series switches where we get the message "Method Status List Empty" when trying to authenticate devices either for the first time, or when a switch is restarted. To resolve, "clear authentication sessions" is required for the devices to then go through authentication again which works but is not a solution, before running this a device will sit as "UNKNOWN Unauth". I did see a bug for this but that is relating to an older IOS version well before ours, anyone have any ideas on how to resolve this?

Re: 802.1x Method Status List Empty

Mark Elsen — Tue, 02 Apr 2024 11:39:10 GMT

- Generally speaking , try latest advisory release for the platform ; if a bug remains persistent and not mentioned as such in bug search then you need to report back to TAC,

Re: 802.1x Method Status List Empty

Arne Bier — Tue, 02 Apr 2024 20:42:17 GMT

In addition to what @Mark Elsen said, when asking a question on these forums, it's also generally a good idea to tell us what version of software you're on, and some configurations that relate to the issue. e.g. you could send us the config output relating to the interface (show derived-config int x/y/z) and your IBNS 1.0/2.0 config. NAC config does tend to sprawl all over the place.

Have you followed the general advice given in Wired Prescriptive Guide?

Re: 802.1x Method Status List Empty

MHM Cisco World — Tue, 02 Apr 2024 20:49:54 GMT

Share the config of port

MHM

Re: 802.1x Method Status List Empty

DM812 — Thu, 04 Apr 2024 09:32:19 GMT

See example port config below, this only affects a chunk of ports at a time and affects both data and voice devices...

The below config is also set on a large number of switches and is working fine.

IOS: 17.6.3

Port Config:

interface GigabitEthernet1/0/1
switchport access vlan 5
switchport mode access
switchport voice vlan 10
authentication control-direction in
authentication event server dead action authorize vlan 5
authentication event server dead action authorize voice
authentication event server alive action reinitialize
authentication host-mode multi-domain
authentication order dot1x mab
authentication priority dot1x mab
authentication port-control auto
authentication periodic
authentication timer reauthenticate 65535
authentication timer restart 10800
authentication violation replace
mab
trust device cisco-phone
dot1x pae authenticator
dot1x timeout quiet-period 30
dot1x timeout tx-period 10
auto qos voip cisco-phone
spanning-tree portfast
service-policy input AutoQos-4.0-CiscoPhone-Input-Policy
service-policy output AutoQos-4.0-Output-Policy

Global Config:

dot1x system-auth-control
!
aaa group server radius Servers
server name Server1
!
aaa authentication dot1x default group Servers
aaa authorization network default group Servers
radius-server vsa send authentication
!
radius server Server1
address ipv4 192.168.5.10 auth-port 1812 acct-port 1813
key [key]
timeout 2
!
aaa server radius dynamic-author
client 192.168.5.10 server-key [key]
port 3799
!
aaa accounting dot1x default start-stop group Servers

Re: 802.1x Method Status List Empty

Arne Bier — Sun, 07 Apr 2024 21:31:38 GMT

@DM812 - I think the config looks good. It appears you're using Aruba Clearpass as your RADIUS server? Do you see the Access-Request come to the server on the initial endpoint connection attempt (where the switch then puts the session in Method Status List Empty)? Curious to know if any RADIUS traffic goes to the server, and what the server responds with.

Re: 802.1x Method Status List Empty

DM812 — Mon, 08 Apr 2024 08:49:04 GMT

I can see the request on our RADIUS server and accepts the device and returns as accepted, authenticated, and sends the correct VLAN, but when looking on the switch it fails the auth.

Re: 802.1x Method Status List Empty

MHM Cisco World — Mon, 08 Apr 2024 09:04:16 GMT

show aaa server <<- share this

thanks

MHM

Re: 802.1x Method Status List Empty

Mukesh-Kumar — Thu, 12 Feb 2026 20:22:39 GMT

@Arne Bier @MHM Cisco World @Mark Elsen

Hello Team, I am facing the issue. The switch is WS-C3560CG-8PC-S . The version is 15.2(2)E10 C3560c405ex-.UNIVERSALK9-M. 802.1x is working on other 8-port but different models WS-C3560CX. The is not CX . It is WS-C3560CG-8PC-S . I want to know, if 802.1x could be configured on this particular modelC3560CG-8PC . Please advise.

CivicCtrDCLEDLightSW#show access-session interface Gi0/1 details
Interface: GigabitEthernet0/1
MAC Address: 70b3.d5ab.d6c6
IPv6 Address: Unknown
IPv4 Address: 172.30.63.221
Status: Unauthorized
Domain: UNKNOWN
Oper host mode: multi-auth
Oper control dir: in
Session timeout: N/A
Restart timeout: N/A
Periodic Acct timeout: N/A
Session Uptime: 316s
Common Session ID: 0000000000000B42296454B4
Acct Session ID: Unknown
Handle: 0x00000001
Current Policy: DOT1X_MAB_POLICY

Method status list: empty

Re: 802.1x Method Status List Empty

Arne Bier — Thu, 12 Feb 2026 20:53:27 GMT

I don't know this level of detail down to sub models of switches. What we need is to see your configuration and take it from there.

Chances are, that it should work.

show run | section radius show run | include aaa show run interface gi 0/1 show run | in dot1x