Hello @MHM Cisco World thanks for helping. Here is the data.
Currently Gi0/3 has authentication open. This results in the below. During the session below i was running a pcap within EVE-NG and at no time did G0/3 ever initiate any sort of EPOL message to the windows 11 computer connected to it. Am I correct in that the switch should always attempt to do 802.1x with the endpoint regardless of if authentication open is enabled or not?
show authentication sessions interface G0/3.
Interface Identifier Method Domain Status Fg Session ID
-----------------------------------------------------------------------------
Gi0/3 5000.000b.0000 mab DATA Auth ACFFFE030000000F0064D8B2
Key to Session Events Blocked Status Flags:
A - Applying Policy (multi-line status for details)
D - Awaiting Deletion
F - Final Removal in progress
I - Awaiting IIF ID allocation
N - Waiting for AAA to come up
P - Pushed Session
R - Removing User Profile (multi-line status for details)
U - Applying User Profile (multi-line status for details)
X - Unknown Blocker
Runnable methods list:
Handle Priority Name
7 0 dot1xSupp
6 5 dot1x
11 10 mab
9 15 webauth
With no authentication open on the interface and doing a shut > no shut OR removing the cable and adding it back we again see no epol packets being sent to the device. This results in the below. I did wait ~ 5 minutes before running this command just to ensure all timers had the ability to expire and run again.
#show authentication sessions interface G0/3
No sessions match supplied criteria.
Runnable methods list:
Handle Priority Name
7 0 dot1xSupp
6 5 dot1x
11 10 mab
9 15 webauth
Alot of the video's i see around eve-ng and 802.1x say to put authentication open on the interface. This does seem to result in a valid mab auth however, i believe most of those vides are not digging into what is happening (i.e. you don't see the switch doing the epol message to the endpoint connected to it which it should)
