802.1X Works for Laptops, Fails for the New Access Points
Forty new Cisco 9130 APs were installed in a building. They join the 9800 WLC in the data center over CAPWAP, management VLAN 40, AP subnet 10.40.0.0/24. Access switch ports use switchport mode access, switchport access vlan 40, authentication host-mode multi-domain, authentication port-control auto, mab, and dot1x pae authenticator. Laptops on the corporate SSID authenticate with PEAP-MSCHAPv2 against ISE and work. The APs themselves never authenticate; after 90 seconds they fall to VLAN 999, which has no DHCP, and the APs show CAPWAP DTLS errors. The APs are not configured for 802.1X. DHCP option 43 is configured on the VLAN 40 scope. ISE logs show EAP-Request/Identity sent, then EAP-Failure with 12501 for the AP MAC addresses. Other buildings use the same switch template and work.
1. Diagnose why the APs fail while laptops succeed, and identify the config change.
Read the worked answer
The APs are not 802.1X supplicants; the port expects one. authentication host-mode multi-domain allows one data device and one voice device, but the AP is data and never sends EAP. The mab fallback should catch it, so the failure is in the MAB authorization: ISE returns 12501 (EAP authentication failed/unknown identity) because the AP MAC is not in the correct identity group or the MAB service is not enabled for that authorization policy. The port then applies the failure action and moves to VLAN 999.
Check show authentication sessions interface Gi1/0/x details for the method (dot1x vs mab), the ISE live log for the MAC and policy set, and whether the AP MAC is in the endpoint identity group used by the MAB rule. The config fix is either a correct MAB rule for the AP identity group or, more robustly, a static AP port template that does not use user 802.1X.
2. Explain the role of multi-domain and whether multi-auth would fix the problem.
Read the worked answer
multi-domain is for a phone plus PC on one port; it does not help an AP that never authenticates. In multi-domain mode, the switch expects one authentication in the data domain and one in the voice domain. The AP is a single data endpoint, so it is within the mode's capability; the failure is identity/authorization, not host-mode. multi-auth would allow multiple independently authenticated hosts, but the AP still has no supplicant, so it would still depend on MAB. Changing host-mode without fixing the MAB/ISE rule only changes how many failures are tolerated.
3. Design a fail-open/fail-closed policy for AP switch ports.
Read the worked answer
Treat AP ports as infrastructure, not user ports.
- Best: static
switchport access vlan 40, port securitymaximum 1, and no dot1x/MAB; physical access to the closet is the control. - If policy requires authentication, use MAB with a dedicated AP identity group and
authentication event no-response action authorize vlan 40plusauthentication event fail action authorize vlan 40so a RADIUS outage does not strand the AP on VLAN 999. - Add DHCP snooping and dynamic ARP inspection on VLAN 40, and disable unused ports.
VLAN 999 should be a dead-end guest/critical VLAN only, never the fallback for AP management. Test by simulating an ISE outage and confirming the AP stays reachable.