802.1x Wired - Printers not getting MAB'ed by switch

[Ralphy006]

We have a 3850 running 16.3.5b talking to ISE (2.3.0.298). We have wired 802.1x working with Windows supplicants, MAC supplicants, and MAB for most devices (ie security cameras).

Our general template for MAB is something like this:
interface GigabitEthernet1/0/XX
description dot1x - secvid - camera
switchport access vlan 398
switchport mode access
authentication event fail retry 1 action next-method
authentication event server dead action authorize
authentication event server dead action authorize voice
authentication host-mode multi-domain
authentication order dot1x mab
authentication priority dot1x mab
authentication port-control auto
mab
dot1x pae authenticator
dot1x timeout tx-period 1
dot1x max-reauth-req 1
spanning-tree portfast
spanning-tree bpduguard enable

However, with this doesn't work for some of our printers. The printers don't seem to even get a chance to fail and the switch doesn't try MAB. But If I add "authentication open", the dot1x process kicks off properly, fails, and then switches to MAB.

Is there anything that can be done to fix this? We would expect the "dot1x timeout tx-period 1" to cause dot1x to fail after 1 second and start the MAB process.

[nspasov]

Hi there. A few questions:

1. What is the output from the "show authentication session interface interface_name_number detail" ?

2. Does the affected device obtain an IP address

3. What does ISE show in the "live authentication logs" ?

Thank you for rating helpful posts!

[Ralphy006 · Accepted solution]

I ended up fixing this with this command: " authentication control-direction in" It allows pings to hit the printer and forces the printer to talk back, which initiates the MAB

[nspasov]

Fantastic! Glad you were able to resolve your own issue! And thank you for taking the time to come back and update the thread with the solution!