802.1X Timeout and Failover Mechanisms in Network Authentication

In network authentication, the 802.1X protocol plays an important role in controlling access to the network. However, some devices do not have the capability of authenticating using 802.1X, and use MAC Authentication Bypass (MAB) instead.

802.1X can be configured to fall back to MAB in the event that authentication fails. The following describes this failover mechanism and the parameters that affect it.

The failover mechanism to MAB is triggered by an 802.1X timeout, which is guided by certain parameters and settings.

  1. 802.1X Timeouts: The timeout period and retry attempts for 802.1X authentication are primarily controlled by the following commands:

    • dot1x timeout tx-period: Determines how often EAPOL (Extensible Authentication Protocol over LAN) requests are sent. The default value is 60 seconds
    • dot1x max-reauth-req: Specifies the maximum number of times the authentication will be retried before timing out. The default value is 2.

  2. Fallback Mechanism: Upon failure of the primary 802.1X authentication after the exhaustion of the timeout and the retry requests, if MAB is configured, it will immediately kick in.

https://networklessons.com/cisco/ccna-200-301//aaa-802-1x-authentication