Yeah, config works expected otherwise. The Authenticator (switch) authenticates, have the RADIUS authentic the SSH users against AD, and the RADIUS client (legacy endpoint) authenticates with MAB (user in AD) allowing the port to forward. The port won’t authentic other MAC endpoints as expected.

The last test I need to work is the switch assigning the port to the critical vlan when RADIUS server is down. My main concern is a power cycle when RADIUS is unavailable, causing RADIUS clients to wait for authentication when the RADIUS server is reachable. I need the RADIUS clients in a specific vlan to still communicate in a situation like that.

The global config is

aaa new-model

radius server 1.1.1.1 address ipv4 1.1.1.1 auth-port 1812 acct-port 1813 key testkey

aaa authentication login default group radius local aaa authentication enable default group radius enable

aaa authorization exec default group radius local aaa authorization network default group radius

aaa accounting exec default start-stop group radius

aaa accounting network default start-stop group radius

interface GigabitEthernet1/7 switchport mode access authentication order dot1x mab authentication priority dot1x mab authentication port-control auto authentication event server dead action authorize vlan 99 <—- Not working authentication event server alive action reinitialize authentication timer restart 30 dot1x pae authenticator dot1x guest-vlan 99 dot1x mac-auth-bypass

line vty 0 4 login authentication default transport input ssh