300-715 · Question #289
Which CLI command must be configured on the switchport to immediately run the MAB process if a non-802 1X capable endpoint connects to the port?
The correct answer is A. authentication order mab dot1x. To ensure that MAC Authentication Bypass (MAB) is attempted immediately if a non-802.1X capable endpoint connects, the authentication order mab dot1x command must be configured on the switchport.
Question
Which CLI command must be configured on the switchport to immediately run the MAB process if a non-802 1X capable endpoint connects to the port?
Options
- Aauthentication order mab dot1x
- Bdot1x pae authenticator
- Cauthentication fallback
- Daccess-session port-control auto
How the community answered
(56 responses)- A89% (50)
- B4% (2)
- C2% (1)
- D5% (3)
Why each option
To ensure that MAC Authentication Bypass (MAB) is attempted immediately if a non-802.1X capable endpoint connects, the `authentication order mab dot1x` command must be configured on the switchport.
The `authentication order mab dot1x` command on a switchport explicitly defines the priority for authentication methods. By placing 'mab' before 'dot1x', the switch is instructed to first attempt MAC Authentication Bypass, which is crucial for authenticating devices without 802.1X supplicants, before falling back to 802.1X if MAB fails.
`dot1x pae authenticator` enables 802.1X on the port but does not define the authentication method order.
`authentication fallback` is not a valid or standard command for setting the authentication order in this context.
`access-session port-control auto` manages the port's unauthorized/authorized state but does not specify the authentication method sequence.
Concept tested: Cisco IOS switchport authentication order (MAB/802.1X)
Source: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3850/software/release/3se/security/configuration_guide/b_sec_3se_3850_cg/b_sec_3se_3850_cg_chapter_0100.html
Topics
Community Discussion
No community discussion yet for this question.