You have configured 802.

In a high-security " Colorless Ports " environment using AOS-CX, we often run both 802.1X (Dot1x) and MAC Authentication (MAC-auth) on the same port to handle a mix of corporate laptops and " dumb " IoT devices (printers, cameras).

The Default Behavior: By default, the switch usually attempts 802.1X first. When a device like a printer is plugged in, it does not have an 802.1X " supplicant " to respond to the switch ' s EAPOL-Request packets. The switch will wait for a series of timeouts and retries (EAPOL timeouts) before it gives up on 802.1X and moves on to the next method (MAC-auth). This waiting period is what causes the " few minutes " delay the user is experiencing.

Auth-Precedence vs. Auth-Priority:

Auth-Precedence: This defines the order in which the switch attempts the authentication methods.

Auth-Priority: This defines which method " wins " if multiple methods succeed (relevant for a PC that might trigger both).

The Solution: By changing the auth-precedence to mac-auth dot1x, the switch immediately captures the device ' s MAC address and sends it to the RADIUS server (like Aruba ClearPass) for authentication.

For a printer, MAC-auth succeeds immediately, and the port is authorized without waiting for 802.1X timeouts.

For a corporate laptop, MAC-auth happens first (granting basic or initial access), and then the 802.1X process can trigger immediately after to provide higher-level " User " access.

Why other options are incorrect:

Option A: Disabling 802.1X removes the security for corporate devices on those ports; it is not a " secure configuration " maintenance.

Option B: Increasing the timeout would make the delay worse , not better.

Option D: There is no specific " MAC auth start value " timer in AOS-CX that would solve a multi-minute delay caused by the 802.1X failure wait.

CLI Example:

Bash

interface 1/1/1

aaa authentication port-access auth-precedence mac-auth dot1x