Introduces RLAN authentication fallback, explaining how client authentication dynamically switches between 802.1X and MAB on OEAP RLAN ports, details prerequisites and operational behavior, and highlights feature availability in Cisco IOS XE Cupertino 17.8.1 and later.

An RLAN authentication fallback is a WLAN authentication mechanism that

enables client authentication to switch between 802.1X and MAC authentication bypass (MAB) when the initial method fails
supports dynamic fallback from 802.1X to MAB and vice versa according to client status and registration, and
requires that both 802.1X and MAB are enabled for fallback support.

Feature history

Table 1. Feature history for RLAN authentication fallback
Feature name	Release information	Feature description
RLAN authentication fallback	Cisco IOS XE 17.8.x	RLAN authentication fallback alternates client authentication between 802.1X and MAC authentication bypass (MAB) when the initial method fails. It dynamically switches based on client status and registration, requiring both 802.1X and MAB to be enabled. From Cisco IOS XE Cupertino 17.8.1, Remote LAN (RLAN) ports on OfficeExtend Access Points (OEAPs) support authentication fallback.

How RLAN authentication fallback works

From Cisco IOS XE Cupertino 17.8.1, Remote LAN (RLAN) ports on OfficeExtend Access Points (OEAPs) support authentication fallback. If a client using IEEE 802.1X fails to authenticate, the system attempts MAC authentication bypass (MAB). Conversely, if the client's MAC address is not registered for MAC authentication bypass, the system falls back to IEEE 802.1X. Enable both methods to ensure successful authentication.

By default, the RLAN fallback mechanism is disabled. You must explicitly enable this mechanism. When both 802.1X and MAB are enabled, the device must succeed in both authentication methods for successful authentication.

Configure RLAN authentication fallback (CLI)

Enable authentication fallback for remote LAN (RLAN) profiles on your device.

Procedure

	1.	Enter global configuration mode. Example: `Device# configure terminal`
	2.	Configure a remote LAN profile. Example: `Device(config)# ap remote-lan profile-name rlan_profile_name rlan-id`
	3.	Enable 802.1X authentication on MAC filter failure. Example: `Device(config-remote-lan)# security {dot1x on-macfilter-failure \| mac-filter on-dot1x-failure}` Note You can either configure 802.1X authentication on MAC filter failure or MAC filter authentication on 802.1X failure. You cannot configure both.
	4.	Return to privileged EXEC mode. Example: `Device(config-remote-lan)# end`

If the primary authentication method fails, the RLAN profile attempts an alternative authentication method."

Device# configure terminal
Device(config)# ap remote-lan profile-name rlan_profile_name 3
Device(config-remote-lan)# security dot1x on-macfilter-failure
Device(config-remote-lan)# end

Modify 802.1X EAP timers for RLAN clients

Adapt 802.1X EAP authentication timers for remote LAN (RLAN) clients to ensure successful endpoint authentication.

To adapt the 802.1X EAP timers for RLAN clients, use this procedure:

Note

When you modify the 802.1X EAP timers, ensure that the timer is long enough to allow 802.1X-capable endpoints to authenticate. A timer that is too short may result in 802.1X-capable endpoints being subject to a fallback authentication or authorization technique.

If 802.1X EAP timers are not configured using this procedure, the timer configuration done using the wireless security dot1x request and wireless security dot1x identity-request commands are applied.

Procedure

	1.	Enter global configuration mode. Example: `Device# configure terminal`
	2.	Configure the remote LAN profile. Example: `Device(config)# ap remote-lan profile-name rlan_profile_name rlan-id`
	3.	Configure the maximum number of EAP ID request retransmissions. Example: `Device(config-remote-lan)# security dot1x identity-request retries retry-num` The valid range is from 1 to 20.
	4.	Configure the EAP ID request-timeout value in seconds. Example: `Device(config-remote-lan)# security dot1x identity-request timeout timeout-value` The valid range is from 1 to 120.
	5.	Configure the maximum number of EAP request retransmissions. Example: `Device(config-remote-lan)# security dot1x request retries retry-num` The valid range is from 0 to 20.
	6.	Configure the EAP request retransmission timeout value in seconds. Example: `Device(config-remote-lan)# security dot1x request timeout timeout-value` The valid range is from 1 to 120.
	7.	Return to privileged EXEC mode. Example: `Device(config-remote-lan)# end`

The EAP authentication timers for RLAN clients are adapted to your specified values, improving authentication reliability for 802.1X-capable endpoints.

Device# configure terminal
Device(config)# ap remote-lan profile-name rlan_profile_name 3
Device(config-remote-lan)# security dot1x identity-request retries 20
Device(config-remote-lan)# security dot1x identity-request timeout 120
Device(config-remote-lan)# security dot1x request retries 20
Device(config-remote-lan)# security dot1x request timeout 120
Device(config-remote-lan)# end

Verify RLAN authentication fallback

Use this command to check the status of the fallback authentication mechanism.

Device# show remote-lan all

Remote-LAN Profile Name     : rlan_profile_name
================================================
Identifier                                     : 3
Status                                         : Disabled
Mac-filtering                                  : Not Configured
Number of Active Clients                       : 0
Security_8021x_dot1x                           : Enabled
8021.x Authentication list name                : Not Configured
Local Auth eap Profile Name                    : Not Configured
Web Auth Security                              : Disabled
Webauth Authentication list name               : Not Configured
Web Auth Parameter Map                         : Not Configured
Client association limit                       : 0
Ipv4 Web Pre Auth Acl                          : Not Configured
Ipv6 Web Pre Auth Acl                          : Not Configured
mDNS Gateway Status                            : Bridge
Authentication Fallback Status                 : MAC-filtering to Dot1X

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

RLAN authentication fallback

Feature history

How RLAN authentication fallback works

Configure RLAN authentication fallback (CLI)

Procedure

Example:

Example:

Example:

Example:

Modify 802.1X EAP timers for RLAN clients

Procedure

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Verify RLAN authentication fallback