This article demonstrates about the 802.1X Authentication Failure of the clients connected in Daisy chain to the switch with Multiple-Supplicant mode & Cisco ISE as the Authentication server.

• Client wouldn't be authenticated & would be stuck in "Connecting" state due to Authentication Failure

User@switch>show dot1x interface <> detail

Supplicant: xxxxexxxx, xx:xx:xx:xx:xx:xx

Operational state: Connecting

Backend Authentication state: Idle

Authentication method: Fail

User@switch> show dot1x interface <> extensive

802.1X Information:

Interface     State         MAC address         Method            Data vlan  Voip vlan  User

<>         Connecting      xx:xx:xx:xx:xx:xx       Fail              -            -       xxxxxxxxxxxxxx

• Configure "dhcp-security" on the Vlan X where the clients are connected :
  • # set vlans X forwarding-options dhcp-security  [ How to configure DHCP snooping on ELS ]
• The uplink interface ge-x/x/x is a trunk . The clients connected on access interfaces are Untrusted & their Mac-IP bindings would be built and maintained in the DHCP snooping database.
• Post enabling DHCP snooping, You would able to see the IP addresses binding with Client Mac and the same was reflected in the Cisco ISE, Later, the authentication was successful.

• How to configure DHCP snooping on ELS
• DHCP Snooping