topic Re: Configuring a specific method list for Dot1X and RADIUS in Network Access Control

Configuring a specific method list for Dot1X and RADIUS

SMD28316 — Wed, 29 Dec 2021 10:40:13 GMT

In AAA configuration, I can create a new method list to be used for RADIUS:

aaa authentication dot1x TEST_AUTH group ISE
aaa authorization network TEST_AUTHZ group ISE
aaa accounting dot1x TEST_ACC start-stop group ISE

instead of the default one:

aaa authentication dot1x default group ISE
aaa authorization network default group ISE
aaa accounting dot1x default start-stop group ISE

My question is how can I use the methods I created above for interface MAB authentication? I don't want to use the default method list.

For line configuration we have:

aaa authentication <method_name>

what about the other interfaces?

Re: Configuring a specific method list for Dot1X and RADIUS

Rob Ingram — Wed, 29 Dec 2021 11:10:33 GMT

@SMD28316 just by defining your named method lists for AAA, these will override the "default" list (if defined).

https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_usr_aaa/configuration/xe-3s/sec-usr-aaa-xe-3s-book/sec-cfg-authentifcn.html#GUID-3540BC5F-F150-4FAB-9364-7B2FF89123FC

You'd obviously need the MAB configuration defined under the interfaces, if configured they will use the method list configured.

You can refer to the ISE wired guide for more information on the aaa configuration.

https://community.cisco.com/t5/security-documents/ise-secure-wired-access-prescriptive-deployment-guide/ta-p/3641515

Re: Configuring a specific method list for Dot1X and RADIUS

christionFly — Thu, 29 Jan 2026 21:04:38 GMT

Define your range of interfaces;

interface range GigabitEthernetx/x/x-xx

then enter the following commands for the defined interfaces;

authentication order mab

authentication port-control auto

mab