I have another theory. What we know about printers, is that most of the time they don't send any traffic. Therefore, after some time, the authenticated session would become inactive and then session manager might be clearing the session.
Are you using IBNS 2.0? I ran into an issue once with a customer using a certain model of Cisco desk phones. When the phones were idle, they didn't send any packets other than CDP every 60 seconds. And the switch's Inactivity Timer was also 60 seconds. The discrepancy/sync was out by a few micro/milliseconds, but that caused a clearing of the session and re-auth every 60 seconds when the phone was idle. The solution was to decrease the Device-Tracking probe interval to be less than the inactivity timer.
Below is a typical IBNS 2.0 Policy - the important stuff is the last two events
policy-map type control subscriber PORT-AUTH-POLICY
event session-started match-all
10 class always do-until-failure
10 authenticate using dot1x priority 10
event authentication-failure match-first
5 class DOT1X_FAILED do-until-failure
10 terminate dot1x
20 authenticate using mab priority 20
15 class AAA_SVR_DOWN_UNAUTHD_HOST do-until-failure
10 clear-authenticated-data-hosts-on-port
20 activate service-template CRITICAL_DATA_TEMPLATE
30 activate service-template CRITICAL_VOICE_TEMPLATE
40 authorize
50 pause reauthentication
20 class AAA_SVR_DOWN_AUTHD_HOST do-until-failure
10 pause reauthentication
20 authorize
30 class DOT1X_NO_RESP do-until-failure
10 terminate dot1x
20 authenticate using mab priority 20
40 class MAB_FAILED do-until-failure
10 terminate mab
20 authentication-restart 60
60 class always do-until-failure
10 terminate dot1x
20 terminate mab
30 authentication-restart 60
event agent-found match-all
10 class always do-until-failure
10 terminate mab
20 authenticate using dot1x priority 10
event aaa-available match-all
10 class IN_CRITICAL_AUTH do-until-failure
10 clear-session
20 class NOT_IN_CRITICAL_AUTH do-until-failure
10 resume reauthentication
event inactivity-timeout match-all
10 class always do-until-failure
10 clear-session
event authentication-success match-all
10 class always do-until-failure
10 activate service-template IA-TIMER
After any successful authorization, the "authentication-success" event would trigger, and set an IN-TIMER of 60 seconds. If the device does not send any data within 60 seconds, then the "inactivity-timeout" event would clear the session.
In my case, notice the keyword "probe" at the end? It didn't send any ARP probes after 60 seconds. That was part of the problem. We suspected a buggy IOS.
service-template IA-TIMER
inactivity-timer 60 probe
The fix was to make the device-tracking probe more aggressive, by checking every 30 seconds if it gets an ARP response. If it does (because printer is idle, but it's still there and responding to ARP), then it resets the Inactivity-Timer, and session doesn't get cleared.
device-tracking policy IPDT_POLICY
no protocol udp
tracking enable reachable-lifetime 30
In case it's IBNS 1.0 I don't recall if you can achieve the same thing.
Another crucial command, especially for devices that go to sleep, is the "access-session control-direction in" - to support Wake on LAN (WOL)
interface GigabitEthernet1/0/22
description Raspberry Pi
switchport access vlan 200
switchport mode access
switchport nonegotiate
switchport voice vlan 100
device-tracking attach-policy IPDT_POLICY
ip access-group PREAUTH_ACL in
power efficient-ethernet auto
authentication periodic
authentication timer reauthenticate server
access-session control-direction in
access-session port-control auto
mab
dot1x pae authenticator
spanning-tree portfast
spanning-tree bpduguard enable
spanning-tree guard root
service-policy type control subscriber PORT-AUTH-POLICY
Might be worth investigating - do whatever you can to check that the session never goes inactive, and use the ARP probing to keep it alive.
