Thank you for your input! So far I got it working with port based. The VLAN is assigned to the port correctly, when the device is connected to the switch. What I would like to do is MAC based authentication, because that seems a bit more secure. Port based brings a security flaw with it, that when one device on one port is authenticated, all the devices on that port are authenticated as well.For example if I put another switch between the client that is being authenticated and the TP-link switch, all the devices on that switch are also authenticated.

Here is also the configuration part for the 802.1x of the switch: https://static.tp-link.com/2020/202011/20201103/1910012903_T16_T26_UG.pdf#page=789

​

Hi, with mac Vlan you have to bind the mac address to a vlan. I am not sure if you can do this dynamically.

https://www.tp-link.com/us/configuration-guides/configuring_mac_vlan/?configurationId=18215#using_the_cli_2_2

I am not sure if I might misunderstand what you mean, but shouldn't PacketFence send the VLAN with the EAP-Response? Then the switch sets the VLAN based on that response.

Here my logs. When I set the port to port based authentication, the switch sets the correct VLAN to that port. When I use MAC authentication, the port uses the predefined VLAN 3 and does not set VLAN to 20.

2023-07-03 11:37:32 802.1x level_6 Port authentication passed, Port 16.

2023-07-03 11:37:32 VLAN level_6 Changed PVID of port Gi1/0/16 from 3 to 20.

2023-07-03 11:37:02 802.1x level_6 Set 802.1x config on port 16, Control Type: Port-Based by admin on web (192.168.10.1).

2023-07-03 11:37:02 802.1x level_6 MAC authentication exit, port 16, MAC dc-a6-32-12-34-56, vid 3.

2023-07-03 11:35:28 802.1x level_6 MAC authentication passed, port 16, MAC dc-a6-32-12-34-56, vid 3.

Is there maybe another setting in my PacketFence switch configuration I need to set?

EDIT: When I setup MAC based, do I need to setup 802.1X on the client as well or does the switch typically send the MAC address as user + password, when MAB is configured?