topic Re: Catalyst 9300 ios 16.9.1 not Recognizing dot1x switch port command in Network Access Control

Catalyst 9300 ios 16.9.1 not Recognizing dot1x switch port commands

Sam Nnamani — Tue, 12 Aug 2025 10:27:07 GMT

Catalyst 9300 ios 16.9.1 not Recognizing dot1x switch port commands.

AAA Commands that start with are not recognized

authentication

mab

dot1x

meanwhile, global aaa config is already in place.

sh run aaa output is below:

aaa authentication login default group tacacs+ local
aaa authentication dot1x default group Bla bla bla
aaa authorization network default group Bla bla bla
aaa accounting commands 15 default start-stop group tacacs+
aaa accounting dot1x default start-stop group Bla bla bla
aaa accounting update periodic 5
username rdxcisco privilege 15 secret Bla bla bla
!
!
!
!
aaa server radius dynamic-author
client Bla bla bla 1
client Bla bla bla 2
server-key 7 Bla bla bla
!
!
radius server Bla bla bla
address ipv4 Bla bla bla auth-port 1812 acct-port 1813
timeout 5
retransmit 3
automate-tester username ISE-RAD-TEST probe-on
key 7 Bla bla bla
!
radius server Bla bla bla
address ipv4 Bla bla bla auth-port 1812 acct-port 1813
timeout 5
retransmit 3
automate-tester username ISE-RAD-TEST probe-on
key 7 Bla bla bla
!
radius-server attribute 6 on-for-login-auth
radius-server attribute 8 include-in-access-req
radius-server attribute 25 access-request include
radius-server dead-criteria time 30 tries 3
tacacs server tacacs+
address ipv4 Bla bla bla
key Bla bla bla
timeout 5
tacacs-server directed-request
tacacs-server key Bla bla bla
!
aaa group server radius ISE-SERVER-GROUP
server name Bla bla bla 1
server name Bla bla bla 2
deadtime 15
!
!
!
!
aaa new-model
aaa session-id common
!

Output for port config below:

interface GigabitEthernet1/0/1
switchport access vlan 2
switchport voice vlan 3
device-tracking attach-policy IPDT_POL
trust device cisco-phone
auto qos voip cisco-phone
spanning-tree portfast
service-policy input AutoQos-4.0-CiscoPhone-Input-Policy
service-policy output AutoQos-4.0-Output-Policy
end

Any idea on what might be going on

Re: Catalyst 9300 ios 16.9.1 not Recognizing dot1x switch port command

MHM Cisco World — Tue, 12 Aug 2025 10:33:11 GMT

dot1x system-auth-control

This command needed

Re: Catalyst 9300 ios 16.9.1 not Recognizing dot1x switch port command

Mark Elsen — Tue, 12 Aug 2025 10:33:30 GMT

- @Sam Nnamani Please post an example command tried and the resulting error.

Re: Catalyst 9300 ios 16.9.1 not Recognizing dot1x switch port command

Sam Nnamani — Tue, 12 Aug 2025 12:09:41 GMT

Thanks for the feedback, but its already present

Re: Catalyst 9300 ios 16.9.1 not Recognizing dot1x switch port command

Sam Nnamani — Tue, 12 Aug 2025 12:09:27 GMT

sample error gotten in console:

Re: Catalyst 9300 ios 16.9.1 not Recognizing dot1x switch port command

MHM Cisco World — Tue, 12 Aug 2025 10:43:24 GMT

Use

Interface x/x

Share option you get

Re: Catalyst 9300 ios 16.9.1 not Recognizing dot1x switch port command

Jens Albrecht — Tue, 12 Aug 2025 10:44:09 GMT

Hello @Sam Nnamani,

looks like someone has enabled IBNS 2.0 on this switch.
If IBNS 2.0 is enabled, interface-level legacy commands will no longer be accepted by the CLI to avoid conflicts.
This means that you need to use the MQC-style policy maps, class maps and service policies.

Details can be found at the Security Configuration Guide, Cisco IOS XE Fuji 16.9.x (Catalyst 9300 Switches).

HTH!

Re: Catalyst 9300 ios 16.9.1 not Recognizing dot1x switch port command

Jens Albrecht — Tue, 12 Aug 2025 10:50:05 GMT

Well, just noticed that your port config does not include the command 'switchport mode access'.

You cannot configure 802.1x if the port is at the default mode auto.

So configure the ports as access ports and try agian.

Re: Catalyst 9300 ios 16.9.1 not Recognizing dot1x switch port command

Sam Nnamani — Tue, 12 Aug 2025 10:50:17 GMT

Oh snap! My worst fear. Is these a way to verify this?

Re: Catalyst 9300 ios 16.9.1 not Recognizing dot1x switch port command

Sam Nnamani — Tue, 12 Aug 2025 10:52:44 GMT

Well Well, IT IS THE LITTLE THINGS.

Thanks so much Jens

Re: Catalyst 9300 ios 16.9.1 not Recognizing dot1x switch port command

Jens Albrecht — Tue, 12 Aug 2025 10:53:42 GMT

Check first whether setting your ports to access mode helps. Then we will see.

Re: Catalyst 9300 ios 16.9.1 not Recognizing dot1x switch port command

Sam Nnamani — Tue, 12 Aug 2025 10:55:12 GMT

Worked like MAGIC

Re: Catalyst 9300 ios 16.9.1 not Recognizing dot1x switch port command

Jens Albrecht — Tue, 12 Aug 2025 10:55:26 GMT

You're welcome!

Yes, it is sometimes these easy to overlook things that cause headache.

Re: Catalyst 9300 ios 16.9.1 not Recognizing dot1x switch port command

MHM Cisco World — Tue, 12 Aug 2025 10:56:15 GMT

switchport access vlan 2 <<- it already access

It can bug

Maybe

MHM

Re: Catalyst 9300 ios 16.9.1 not Recognizing dot1x switch port command

Jens Albrecht — Tue, 12 Aug 2025 11:08:53 GMT

No, this is a common misunderstanding.

This command only tells the switch to use vlan 2 IF the port becomes an access port, e.g. when connecting a pc.
However, the port is still at the default 'dynamic auto'.
This can easily be verified with the command 'show interface <type><num> switchport'.

Just prepared a quick example:

LAN-Switch#sh run int gi0/12 Building configuration... Current configuration : 94 bytes ! interface GigabitEthernet0/12 switchport access vlan 175 spanning-tree portfast edge end LAN-Switch#sh int gi0/12 switchport Name: Gi0/12 Switchport: Enabled Administrative Mode: dynamic auto Operational Mode: down Administrative Trunking Encapsulation: dot1q Negotiation of Trunking: On Access Mode VLAN: 175 (External) Trunking Native Mode VLAN: 1 (default)

As you can see Vlan 175 is assigned as access vlan to this port but the administrative mode is still 'dynamic auto'.
So that you cannot configure 802.1x on this port until you add the 'switchport mode access' command.

HTH!

Re: Catalyst 9300 ios 16.9.1 not Recognizing dot1x switch port command

MHM Cisco World — Tue, 12 Aug 2025 11:19:12 GMT

Admin mode must change with switchport access vlan x

But maybe this behave is change from old to new ios xe SW.

Thanks for details

MHM