I've been scratching my head with this issue, thus reaching out for help. I have a 3560G running 2.2(58)SE2 and I want to configure dot1x. Here is the config:
aaa new-model aaa group server radius myradius aaa group server tacacs+ mytacacs aaa authentication login mylocal local aaa authentication login mytacacs group mytacacs local aaa authentication dot1x default group myradius aaa authorization config-commands aaa authorization network default group myradius aaa authorization network myradius group radius aaa server radius dynamic-author aaa session-id common
interface GigabitEthernet0/11 switchport access vlan 500 switchport mode access switchport voice vlan 600 srr-queue bandwidth share 1 30 35 5 priority-queue out authentication host-mode multi-auth authentication order mab dot1x authentication priority mab dot1x authentication port-control auto authentication periodic authentication timer reauthenticate server mab mls qos trust device cisco-phone mls qos trust dscp dot1x pae authenticator dot1x timeout server-timeout 30 dot1x max-req 3 dot1x max-reauth-req 3 spanning-tree portfast spanning-tree bpduguard enable end
The phone authenticates without a problem (looking at the logs on the radius server), but the PC behind it does not. Also (I'm not where this phone & pc are) I was told that the port was showing an amber light. The phone works but the PC doesn't - I can't ping it or can't ping out from the PC either. The odd part is that this was working before, but today we decided to test again before deploying it in prod. All we did is plug back in a phone with a pc (just like a month ago before this pandemic) and it worked. Nothing has been changed on the config since. I noticed the mac address of phone nor pc don't show on the port.
I noticed the mac address of phone nor pc don't show on the port. when not authenticated, the MAC address will only show shortly then "disappear" from the port unless you've got an unauth-vlan to fall back to.
authentication order mab dot1x authentication priority mab dot1x -> commonly the order is the other way around, with DOT1x having precedence over MAB. for phones this will result in a dot1x failed log entry, but that can be neglected.
on the PC check DOT1x supplicant (service) is started