Catalyst 9300 ios 16.9.1 not Recognizing dot1x switch port commands

[Sam Nnamani]

Catalyst 9300 ios 16.9.1 not Recognizing dot1x switch port commands. 

AAA Commands that start with are not recognized

authentication

mab

dot1x 

meanwhile, global aaa config is already in place.

sh run aaa output is below:

aaa authentication login default group tacacs+ local
aaa authentication dot1x default group Bla bla bla
aaa authorization network default group Bla bla bla
aaa accounting commands 15 default start-stop group tacacs+
aaa accounting dot1x default start-stop group Bla bla bla
aaa accounting update periodic 5
username rdxcisco privilege 15 secret Bla bla bla
!
!
!
!
aaa server radius dynamic-author
client Bla bla bla 1
client Bla bla bla 2
server-key 7 Bla bla bla
!
!
radius server Bla bla bla
address ipv4 Bla bla bla auth-port 1812 acct-port 1813
timeout 5
retransmit 3
automate-tester username ISE-RAD-TEST probe-on
key 7 Bla bla bla
!
radius server Bla bla bla
address ipv4 Bla bla bla auth-port 1812 acct-port 1813
timeout 5
retransmit 3
automate-tester username ISE-RAD-TEST probe-on
key 7 Bla bla bla
!
radius-server attribute 6 on-for-login-auth
radius-server attribute 8 include-in-access-req
radius-server attribute 25 access-request include
radius-server dead-criteria time 30 tries 3
tacacs server tacacs+
address ipv4 Bla bla bla
key Bla bla bla
timeout 5
tacacs-server directed-request
tacacs-server key Bla bla bla
!
aaa group server radius ISE-SERVER-GROUP
server name Bla bla bla 1
server name Bla bla bla 2
deadtime 15
!
!
!
!
aaa new-model
aaa session-id common
!

Output for port config below:

interface GigabitEthernet1/0/1
switchport access vlan 2
switchport voice vlan 3
device-tracking attach-policy IPDT_POL
trust device cisco-phone
auto qos voip cisco-phone
spanning-tree portfast
service-policy input AutoQos-4.0-CiscoPhone-Input-Policy
service-policy output AutoQos-4.0-Output-Policy
end

Any idea on what might be going on

[MHM Cisco World]

dot1x system-auth-control

This command needed 

[Sam Nnamani]

Thanks for the feedback, but its already present

[MHM Cisco World]

Use 

Interface x/x

? 

Share option you get 

[Mark Elsen]

   - @Sam Nnamani     Please post an example command tried and the resulting error.

  M.

[Sam Nnamani]

sample error gotten in console:

[Jens Albrecht]

Hello @Sam Nnamani,

looks like someone has enabled IBNS 2.0 on this switch.
If IBNS 2.0 is enabled, interface-level legacy commands will no longer be accepted by the CLI to avoid conflicts.
This means that you need to use the MQC-style policy maps, class maps and service policies.

Details can be found at the Security Configuration Guide, Cisco IOS XE Fuji 16.9.x (Catalyst 9300 Switches).

HTH!

[Sam Nnamani]

Oh snap! My worst fear. Is these a way to verify this?

[Jens Albrecht · Accepted solution]

Check first whether setting your ports to access mode helps. Then we will see.

[Sam Nnamani]

Worked like MAGIC

[Jens Albrecht · Accepted solution]

Well, just noticed that your port config does not include the command 'switchport mode access'.

You cannot configure 802.1x if the port is at the default mode auto.

So configure the ports as access ports and try agian.

[Sam Nnamani]

Well Well, IT IS THE LITTLE THINGS.

Thanks so much Jens

[MHM Cisco World]

switchport access vlan 2 <<- it already access

It can bug 

Maybe

MHM

[Jens Albrecht]

No, this is a common misunderstanding.

This command only tells the switch to use vlan 2 IF the port becomes an access port, e.g. when connecting a pc.
However, the port is still at the default 'dynamic auto'.
This can easily be verified with the command 'show interface <type><num> switchport'.

Just prepared a quick example:

LAN-Switch#sh run int gi0/12
Building configuration...

Current configuration : 94 bytes
!
interface GigabitEthernet0/12
 switchport access vlan 175
 spanning-tree portfast edge
end

LAN-Switch#sh int gi0/12 switchport
Name: Gi0/12
Switchport: Enabled
Administrative Mode: dynamic auto
Operational Mode: down
Administrative Trunking Encapsulation: dot1q
Negotiation of Trunking: On
Access Mode VLAN: 175 (External)
Trunking Native Mode VLAN: 1 (default)

As you can see Vlan 175 is assigned as access vlan to this port but the administrative mode is still 'dynamic auto'.
So that you cannot configure 802.1x on this port until you add the 'switchport mode access' command.

HTH!

[MHM Cisco World]

Admin mode must change with switchport access vlan x

But maybe this behave is change from old to new ios xe SW. 

Thanks for details 

MHM