What Happens When Both 802.1X and MAB Fail on a Switch Port?
Exhibit
Refer to the exhibit. interface GigabitEthernet0/1 switchport mode access switchport access vlan 10 authentication host-mode multi-auth authentication order mab dot1x authentication priority dot1x mab authentication port-control auto dot1x pae authenticator spanning-tree portfast ! RADIUS server configuration radius server ISE address ipv4 10.1.1.100 auth-port 1812 acct-port 1813 key cisco123 ! Global AAA aaa new-model aaa authentication dot1x default group radius aaa authorization network default group radius aaa accounting dot1x default start-stop group radius
A network administrator has configured the above on a Cisco switch port for a device that supports both MAB and 802.1X. The device sends an EAPOL-start but the switch responds with an EAP-Request/Identity. The device does not respond to the EAP-Request/Identity. After a timeout, the switch attempts MAB. However, MAB also fails because the RADIUS server does not have the MAC address. Which of the following best describes the final port state?
Quick Answer
The answer is that the switch port will remain in an unauthorized state, blocking all traffic. This occurs because when the device fails to respond to the EAP-Request/Identity after sending an EAPOL-start, the 802.1X authentication times out, and the subsequent MAB attempt also fails since the RADIUS server has no record of the MAC address. With both authentication methods exhausted and no fallback action configured, the port defaults to its most secure posture—the 802.1X unauthorized state—denying any Layer 2 or Layer 3 traffic. On the Cisco SCOR 350-701 exam, this scenario tests your understanding of the authentication order and default port behavior when both 802.1X and MAB fail; a common trap is assuming the port will transition to a critical VLAN or an error-disabled state without explicit configuration. Remember the memory tip: “No success, no access”—if neither 802.1X nor MAB succeeds, the port stays shut.
⚠ Common exam trap
Cisco often tests the distinction between authentication failure and RADIUS server unavailability, where candidates mistakenly assume a guest VLAN or critical VLAN is automatically applied, but these require explicit configuration and are not default behaviors.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The port will remain in an unauthorized state, blocking all traffic
When 802.1X authentication fails because the device does not respond to the EAP-Request/Identity, and MAB also fails because the RADIUS server lacks the MAC address, the switch port remains in an unauthorized state. This is the default behavior for a port configured with both authentication methods: if neither succeeds, the port stays in the 802.1X unauthorized state, blocking all traffic until a successful authentication occurs or a fallback action (like a critical VLAN) is explicitly configured.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The port will be placed in a critical authentication VLAN
Why it's wrong here
Critical authentication is not configured.
- ✗
The port will be error-disabled due to authentication failure
Why it's wrong here
Authentication failure does not cause error-disable unless configured.
- ✓
The port will remain in an unauthorized state, blocking all traffic
Why this is correct
With auto port control, failed auth results in unauthorized state.
- ✗
The port will be placed in VLAN 10 with restricted access
Why it's wrong here
VLAN assignment only occurs after successful authentication.
Visual reference
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 350-701 question from scratch — 978 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on 350-701
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A user connected to port Gi1/0/1 cannot access the network. Based on the output, what is the most likely cause?
medium- A.The RADIUS server is unreachable
- ✓ B.The client does not support 802.1X
- C.The switch has a misconfigured AAA command
- D.The port is in errdisable state
Why B: The 'Reason: EAP-timeout' indicates that the client did not respond to 802.1X EAP requests, which typically means the client does not support 802.1X or it is not enabled. Option A is incorrect because if the RADIUS server were unreachable, the switch would likely use a critical VLAN, but the reason is EAP-timeout from the client side. Option C is incorrect because AAA configuration would cause different errors. Option D is incorrect because 'Errdisable' would show a different port state.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.