Hello @davidssemanda
Your logs (thanks) reveal that high CPU utilization is primarily caused by 802.1X authentication failures. The errors, such as "No Response from Client" and "Cred Fail," suggest that the connected devices are either unresponsive to authentication requests or incapable of completing the process. This can result in repeated retries, overwhelming the CPU as it attempts to handle numerous authentication sessions...
The "No Response from Client" issue typically indicates that the connected device lacks a configured supplicant or does not support 802.1X. Meanwhile, "Cred Fail" points to authentication failures, possibly due to incorrect or missing credentials. These failures are likely exacerbated by frequent authentication retries or aggressive timers configured on the switch.
So, you should first verify the capabilities of the connected devices. For non-802.1X-capable devices, consider implementing MAB, which allows such devices to be authenticated based on their MAC address instead of 802.1X credentials. This can be configured alongside 802.1X for fallback scenarios. For example, you can set up MAB and 802.1X in a priority order so that the switch first tries 802.1X and falls back to MAB if necessary. Additionally, you can place unauthenticated devices in a critical VLAN to ensure network access for essential services while they await remediation. For devices that do support 802.1X, ensure that their supplicants are correctly configured, with valid credentials or certificates matching the authentication server's requirements.
Another important step is to optimize the authentication settings on the switch to reduce CPU strain. By default, 802.1X settings may aggressively retry failed authentications, contributing to high CPU usage. Adjusting parameters like the transmission period and maximum request count can mitigate this. For instance, increasing the retry interval with dot1x timeout tx-period 30 and limiting retries with dot1x max-req 3 can significantly reduce the authentication load. Additionally, extending the reauthentication timeout with dot1x timeout reauth-period 3600 ensures that successful clients are not repeatedly authenticated within short intervals, further easing the switch's workload.
Best regards
.ı|ı.ı|ı. If This Helps, Please Rate .ı|ı.ı|ı.
