topic Re: cannot see EAPOL frames on the switch for wired 802.1x - open mode in Network Access Control

cannot see EAPOL frames on the switch for wired 802.1x - open mode

atifali.zaidi1 — Mon, 20 Jul 2026 04:42:42 GMT

Hello experts , i have just created my home lab for cisco ISE wired 802.1x , initially i am testing "open" mode , i have the following components

Cisco ISE VM running 3.3 and patch 11

cisco 3750X running IOS 15.4

windows server 2025 configuring for ADDS and ADCS

i followed the wired 802.1x prescriptive guide and using a windows machine ( with USB to ethernet adaptor ) as the physical ethernet port is damaged , have configured all the authentication settings on the machine , for example - PEAP with mschapv2 etc . the machine is domain joined to the local AD server domain . the ports on the switch are configured with 802.1x but when the machine is plugged in to the port , i get the below messages after i enabled - debug dot1x all

ISE is integrated with AD m joined as well , the test connection works

test aaa command from the switch works with a dummy user , as i can see logs on ISE

*Jan 2 00:07:36.692: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/1, changed state to down
*Jan 2 00:07:38.378: %SYS-5-CONFIG_I: Configured from console by lab on vty0 (192.168.1.3)
*Jan 2 00:07:50.189: dot1x-ev:[Gi1/0/1] Interface state changed to UP
*Jan 2 00:07:50.198: dot1x-ev:DOT1X Supplicant not enabled on GigabitEthernet1/0/1
*Jan 2 00:07:52.186: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/1, changed state to up
*Jan 2 00:07:53.192: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/0/1, changed state to up

i dont see any hits on ISE as well, i also tried another non-domain joined windows machine as well but still the same issue

lab-switch#show dot1x interface gigabitEthernet 1/0/1 details

Dot1x Info for GigabitEthernet1/0/1 -----------------------------------

PAE = AUTHENTICATOR QuietPeriod = 60

ServerTimeout = 0 SuppTimeout = 30 ReAuthMax = 3 MaxReq = 2 TxPeriod = 7 Dot1x Authenticator Client List Empty

lab-switch#show access-session interface gigabitEthernet 1/0/1 Interface MAC Address Method Domain Status Fg Session ID ---------------------------------------------------------------------- Gi1/0/1 xxxx.xxxx.xxxx N/A UNKNOWN Unauth C0A8011900000010000EDE3B Key to Session Events Blocked Status Flags: A - Applying Policy (multi-line status for details) D - Awaiting Deletion F - Final Removal in progress I - Awaiting IIF ID allocation N - Waiting for AAA to come up P - Pushed Session R - Removing User Profile (multi-line status for details) U - Applying User Profile (multi-line status for details) X - Unknown Blocker Runnable methods list: Handle Priority Name 6 5 dot1x 21 10 mab 19 15 webauth

Re: cannot see EAPOL frames on the switch for wired 802.1x - open mode

Arne Bier — Mon, 20 Jul 2026 05:16:19 GMT

Have you tested the RADIUS comms to your ISE?

Easiest test

test aaa group <radius_group_name> test test new-code

where <radius_group_name> is your aaa radius group name

If RADIUS is working you will see a PAP request in ISE. Username "test", password "test" - and be rejected. That is expected.

What does your Radius config look like? Please share:

show run | section radius show run | in aaa

Re: cannot see EAPOL frames on the switch for wired 802.1x - open mode

atifali.zaidi1 — Mon, 20 Jul 2026 06:06:26 GMT

thanks for the reply , i did run the above commands on the switch , on the ISE side i could see user rejected , but it also mentioned -PAP is not enabled . i will post all the outputs as you requested soon.

Re: cannot see EAPOL frames on the switch for wired 802.1x - open mode

Arne Bier — Mon, 20 Jul 2026 21:00:09 GMT

I missed that part in your opening post that contained the "test" command. In that case we'd need to see your radius config, as well as the interface config please.

Is the Windows client (supplicant) configured for machine auth, or user or both?

There is another IOS command you can run on the switch to test if the supplicant can respond to EAPOL frames (a handy check to see if the supplicant is running)

dot1x test eapol-capable interface gigabitEthernet 1/0/1

You won't get any response to that command. You must look in the logs

show logging | include 1/0/1

If it worked, you'll see a message that client on gig 1/0/1 is 802.1X capable.

Re: cannot see EAPOL frames on the switch for wired 802.1x - open mode

atifali.zaidi1 — Wed, 22 Jul 2026 06:33:10 GMT

i am attaching some results , please have a look, still no hits on ISE

Re: cannot see EAPOL frames on the switch for wired 802.1x - open mode

atifali.zaidi1 — Wed, 22 Jul 2026 06:41:16 GMT

ISE rules

Re: cannot see EAPOL frames on the switch for wired 802.1x - open mode

Arne Bier — Wed, 22 Jul 2026 07:31:05 GMT

I'm not a big fan of opening Word documents off the internet - perhaps in future just paste the images into these chats - you can copy paste them straight in.

The switch config looks alright.

The ISE AuthZ Rule below is wrong - because with PEAP you will never get User and Computer auth from any Windows client

In your lab, change that to an OR instead.

If you want EAP chaining, look at EAP-TEAP instead. But that's a more advanced topic. Focus on getting a computer auth working. Windows issues a Computer auth during Windows boot up, and user log off.

You have not shared your Windows supplicant config. That might also reveal something,

Re: cannot see EAPOL frames on the switch for wired 802.1x - open mode

hellencharless54 — Wed, 22 Jul 2026 07:51:52 GMT

The key message is this:
dot1x-ev: DOT1X Supplicant not enabled on GigabitEthernet1/0/1
That usually means the switch isn't seeing any EAPOL (802.1X) frames from the connected device, which explains why nothing reaches ISE.
Since test aaa is working and ISE is successfully joined to AD, the RADIUS path looks fine. I'd focus on the endpoint and switch port instead.
A few things I'd check:
Make sure the Wired AutoConfig service is running on the Windows client. Without it, Windows won't start 802.1X.
Verify that IEEE 802.1X authentication is enabled on the Ethernet adapter (including the USB-to-Ethernet adapter). Some USB NICs have limited or inconsistent 802.1X support depending on the driver.
Run a packet capture (Wireshark) on the client and check whether EAPOL packets are being sent when the cable is plugged in.
Double-check the switch interface configuration (authentication port-control auto, dot1x pae authenticator, etc.) to make sure 802.1X is actually enabled on that port.
Could you also post the output of:
show run interface gi1/0/1
show authentication sessions interface gi1/0/1 details
show dot1x all
I suspect the issue is before the authentication even reaches ISE, so those outputs should help narrow it down.

Re: cannot see EAPOL frames on the switch for wired 802.1x - open mode

atifali.zaidi1 — Wed, 22 Jul 2026 13:22:38 GMT

thanks for the valuable feedback , the wired autoconfig is set to automatic on the windows 10 machine , under authentication settings , PEAP is there with validate server cert option checked . the machine is AD joined and has the Root CA cert from AD which is gets once it joins the AD . mschapv2 option is checked with the option "automatically use my windows username and password , also user or machine authentication is checked . i will paste some screenshots for the same.

Re: cannot see EAPOL frames on the switch for wired 802.1x - open mode

atifali.zaidi1 — Wed, 22 Jul 2026 13:27:04 GMT

here are some outputs

lab-switch#test aaa group ISE test-user password new-code

User rejected

lab-switch#test aaa group ISE test-user password legacy

Attempting authentication test to server-group ISE using radius

User authentication request was rejected by server.

lab-switch#show running-config | i aaa

aaa new-model

aaa group server radius ISE

aaa authentication dot1x default group ISE

aaa authorization network default group ISE

aaa accounting update newinfo periodic 2880

aaa accounting identity default start-stop group ISE

aaa server radius dynamic-author

aaa session-id common

lab-switch#show running-config | sec radius

aaa group server radius ISE

server name labise-01

aaa server radius dynamic-author

client 192.168.1.21 server-key Frostbite456@

ip radius source-interface Vlan1

radius-server attribute 6 on-for-login-auth

radius-server attribute 8 include-in-access-req

radius-server attribute 25 access-request include

radius-server attribute 31 mac format ietf upper-case

radius-server attribute 31 send nas-port-detail mac-only

radius-server dead-criteria time 10 tries 3

radius server labise-01

address ipv4 192.168.1.21 auth-port 1812 acct-port 1813

lab-switch#show running-config | i source

ip ssh source-interface Vlan1

ip radius source-interface Vlan1

lab-switch#dot1x test eapol-capable interface gigabitEthernet 1/0/1

lab-switch#

logs from the port

lab-switch(config-if)#

*Jan 2 01:56:49.906: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/1, changed state to down

*Jan 2 01:57:02.581: dot1x-ev:[Gi1/0/1] Interface state changed to UP

*Jan 2 01:57:02.581: dot1x-ev:DOT1X Supplicant not enabled on GigabitEthernet1/0/1

*Jan 2 01:57:03.076: dot1x-packet:[00e0.4c63.5bc8, Gi1/0/1] queuing an EAPOL pkt on Auth Q

*Jan 2 01:57:03.076: dot1x-packet:EAPOL pak rx - Ver: 0x1 type: 0x1

*Jan 2 01:57:03.076: dot1x-packet: length: 0x0000

*Jan 2 01:57:03.076: dot1x-ev:[Gi1/0/1] Dequeued pkt: Int Gi1/0/1 CODE= 0,TYPE= 0,LEN= 0

*Jan 2 01:57:03.076: dot1x-ev:[Gi1/0/1] Received pkt saddr =00e0.4c63.5bc8 , daddr = 0180.c200.0003, pae-ether-type = 888e.0101.0000

*Jan 2 01:57:03.076: dot1x-ev:[Gi1/0/1] Couldn't find the supplicant in the list

*Jan 2 01:57:03.076: dot1x-ev:[00e0.4c63.5bc8, Gi1/0/1] New client detected, sending session start event for 00e0.4c63.5bc8

*Jan 2 01:57:04.569: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/1, changed state to up

*Jan 2 01:57:05.576: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/0/1, changed state to up

*Jan 2 01:57:08.059: dot1x-packet:[00e0.4c63.5bc8, Gi1/0/1] queuing an EAPOL pkt on Auth Q

*Jan 2 01:57:08.059: dot1x-packet:EAPOL pak rx - Ver: 0x1 type: 0x1

*Jan 2 01:57:08.059: dot1x-packet: length: 0x0000

*Jan 2 01:57:08.059: dot1x-ev:[Gi1/0/1] Dequeued pkt: Int Gi1/0/1 CODE= 0,TYPE= 0,LEN= 0

*Jan 2 01:57:08.059: dot1x-ev:[Gi1/0/1] Received pkt saddr =00e0.4c63.5bc8 , daddr = 0180.c200.0003, pae-ether-type = 888e.0101.0000

*Jan 2 01:57:08.059: dot1x-ev:[Gi1/0/1] Couldn't find the supplicant in the list

*Jan 2 01:57:08.059: dot1x-ev:[00e0.4c63.5bc8, Gi1/0/1] New client detected, sending session start event for 00e0.4c63.5bc8

*Jan 2 01:57:13.075: dot1x-packet:[00e0.4c63.5bc8, Gi1/0/1] queuing an EAPOL pkt on Auth Q

*Jan 2 01:57:13.075: dot1x-packet:EAPOL pak rx - Ver: 0x1 type: 0x1

*Jan 2 01:57:13.075: dot1x-packet: length: 0x0000

*Jan 2 01:57:13.075: dot1x-ev:[Gi1/0/1] Dequeued pkt: Int Gi1/0/1 CODE= 0,TYPE= 0,LEN= 0

*Jan 2 01:57:13.075: dot1x-ev:[Gi1/0/1] Received pkt saddr =00e0.4c63.5bc8 , daddr = 0180.c200.0003, pae-ether-type = 888e.0101.0000

*Jan 2 01:57:13.075: dot1x-ev:[Gi1/0/1] Couldn't find the supplicant in the list

*Jan 2 01:57:13.075: dot1x-ev:[00e0.4c63.5bc8, Gi1/0/1] New client detected, sending session start event for 00e0.4c63.5bc8

lab-switch#show dot1x interface gigabitEthernet 1/0/1

Dot1x Info for GigabitEthernet1/0/1

-----------------------------------

PAE = AUTHENTICATOR

QuietPeriod = 60

ServerTimeout = 0

SuppTimeout = 30

ReAuthMax = 3

MaxReq = 2

TxPeriod = 7

lab-switch#show access-session interface gigabitEthernet 1/0/1 details

Interface: GigabitEthernet1/0/1

MAC Address: 00e0.4c63.5bc8

IPv6 Address: Unknown

IPv4 Address: 192.168.1.11

Status: Unauthorized

Domain: UNKNOWN

Oper host mode: single-host

Oper control dir: both

Session timeout: N/A

Restart timeout: N/A

Periodic Acct timeout: N/A

Common Session ID: C0A8011900000021006B4573

Acct Session ID: Unknown

Handle: 0xE3000014

Current Policy: (No Policy)

Method status list: empty

the wired autoconfig is set to automatic on the windows 10 machine , under authentication settings , PEAP is there with validate server cert option checked . the machine is AD joined and has the Root CA cert from AD which is gets once it joins the AD . mschapv2 option is checked with the option "automatically use my windows username and password , also user or machine authentication is checked . i will paste some screenshots for the same.

Re: cannot see EAPOL frames on the switch for wired 802.1x - open mode

Greg Gibbs — Wed, 22 Jul 2026 21:49:21 GMT

If you're using PEAP(MSCHAPv2), this could be a Credential Guard issue. You need to confirm if Credential Guard is enabled and, if so, disable it.
https://learn.microsoft.com/en-us/windows/security/identity-protection/credential-guard/considerations-known-issues

Re: cannot see EAPOL frames on the switch for wired 802.1x - open mode

atifali.zaidi1 — Tue, 11 Aug 2026 10:04:43 GMT

hi Gregg, thanks a lot for commenting on this issue . i managed to get a new lenovo laptop running windows 11 and getting the same issue . i verified the credential guard and i get to see the below on powershell, a value of 0 indicates that credential guard is not enabled .

PS C:\WINDOWS\system32> (Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard).SecurityServicesRunning
0
PS C:\WINDOWS\system32>

Re: cannot see EAPOL frames on the switch for wired 802.1x - open mode

atifali.zaidi1 — Tue, 11 Aug 2026 10:09:10 GMT

also on the 3750X switch port when i see the config as below, i dont see any command related to access-session host-mode multi-auth which was configured on it . i have tried single mode as well but still the same issue

lab-switch#show run int gigabitEthernet 1/0/1
Building configuration...

Current configuration : 226 bytes
!
interface GigabitEthernet1/0/1
switchport mode access
authentication periodic
access-session port-control auto
dot1x pae authenticator
dot1x timeout tx-period 7
dot1x max-reauth-req 3
spanning-tree portfast edge
end