Solved: 1. When we use Authentication Manager, we need to explicitly set authentication order on a interface: (config)# authentication enable(config)# interface Gi1/0/1(config-if)# dot1x port-control auto(config-if)# authentication order dot1x 2. What is more, to allow switch (NAS) to communicate correctly with RADIUS (NPS) it is necessary to set in the config of Radius server source ip in EAP packets: (config)# radius-server host auth 172.16.0.10(config-rad-serv)# source-ip 10.1.1.5 It is strange, because even having configured switch in RADIUS server as a radius client with its ip address (10.1.1.5), I needed to explicitly configure option for 'source-ip' under radius server configuration mode with the same ip address (10.1.1.5). Anyway to works.
Hi, I am considering enabling 802.1X on N2000 switch on a port with Phone & PC connected and need some clarification on the subject of behavior of this setup. I want to treat the Phone as 802.1X unaware client. So according to N-series User Guide, I should choose 802.1X MAC-based authentication with MAC-bypass (MAB). It is stated that when port is configured with MAB it will check first if connected client responds to EAP Request. If no EAP Response, then it goes with MAC address. Now, let's assume the Phone has booted and is up and running. Now we plug in PC behind the Phone. 1. Will that PC be able to do 802.1X with Active Domain credentials username & password (EAP Request/Reply) or once the port on a switch is set to MAC-based auth it will always need to authenticate with MAC address only? 2. Will Dynamic VLAN Assignment with attributes returned by RADIUS work assuming port in General mode? Thanks, 
802.1X with MAB on Phone+PC port