Question

A network engineer is deploying 802.1X on wired access switches for the first time in a large enterprise. Management requires that no legitimate users lose network connectivity during the rollout, even if their supplicant is misconfigured or ISE authorization policies are incomplete. The engineer needs to observe authentication results in ISE and correct policy issues before enforcing access control. Which switchport configuration approach best meets this requirement?

Accepted Answer

Configure the port with 'authentication open' (open authentication / Monitor Mode) so traffic is permitted regardless of the 802.1X result while ISE logs authentications

Answer

Configure 'authentication port-control auto' with a restrictive default deny so unauthenticated endpoints are dropped until policy is fixed

Answer

Configure 'authentication port-control force-authorized' so the port bypasses 802.1X entirely and never sends RADIUS requests

Answer

Enable MAB only and disable dot1x on the ports so endpoints are authorized by MAC address during testing