You must disable 802.1X on FEX and VPC ports, and the unsupported features.
Note
• The Cisco NX-OS software supports 802.1X authentication only on physical ports.
• The Cisco NX-OS software does not support 802.1X authentication on port channels or subinterfaces.
• The Cisco NX-OS software supports 802.1X authentication on member ports of a port channel but not
on the port channel itself.
• When the members are configured for 802.1X, Cisco NX-OS software does not support configuring
single-host mode on port channel members. Only multi-host mode is supported on the member ports.
• Member ports with and without 802.1X configuration can coexist in a port channel. However, you must
ensure the identical 802.1X configuration on all the member ports in order for channeling to operate with
802.1X.
• When you enable 802.1X authentication, supplicants are authenticated before any other Layer 2 or Layer
3 features are enabled on an Ethernet interface.
• On a 802.1X enabled port, the STP BPDUs are permitted only after a successful authentication. We
recommend that you enable the 802.1X functionality only on the STP edge ports to avoid STP disputes.
• The Cisco NX-OS software supports 802.1X authentication only on Ethernet interfaces that are in a port
channel, a trunk, or an access port.
• The Cisco NX-OS software does not work with the CTS or the MACsec features. Global "mac-learn
disable" and dot1x feature are mutually exclusive and cannot be configured together.
• The Cisco NX-OS software does not support single host mode on trunk interfaces or member interfaces
in a port channel.
• The Cisco NX-OS software does not support MAC address authentication bypass on a port channel. The
multi-host mode is the only supported mode on the port-channels.
• In Cisco NX-OS Release 9.2(1), MAC authentication bypass is not supported on the N3K-C3164Q-40GE
switch.
• The Cisco NX-OS software does not support Dot1x on vPC ports and MCT.
• During a switch reload, Dot1x does not generate RADIUS accounting stops.
• The Cisco NX-OS software does not support the following 802.1X protocol enhancements:
• One-to-many logical VLAN name to ID mapping
• Web authorization
• Dynamic domain bridge assignment
• IP telephony
• In order to prevent reauthentication of inactive sessions, use the authentication timer inactivity command
to set the inactivity timer to an interval shorter than the reauthentication interval set with the authentication
timer reauthenticate command.
Cisco Nexus 9000 Series NX-OS Security Configuration Guide, Release 9.x
184
Configuring 802.1X
802.1X Guidelines and Limitations
