ISE, NAC, and fail open?

[jmcgrady1]

I am using ISE to provide network access control on a number of switches. The switch uses radius to ISE to authenticate ports using MAB and 802.1X.  Is there a standard way to set a switch to allow all traffic if Radius/ISE is unresponsive?

[Peter Koltl]

Critical VLAN / 802.1x Authentication with Inaccessible Authentication Bypass

or
AAA-DOWN class/event in IBNS2.0 (TECSEC-3416)

[Peter Koltl]

But you definitely don't want a VLAN change at such an event...