port dot1x...

see below... this is nice...

dls1(config)#int f0/19
dls1(config-if)#dot1x port-control auto
                  ^
% Invalid input detected at '^' marker.

dls1(config-if)#

omg, what's wrong with my port...  this makes perfect sense...  if you are using radius (sorry) configuring the interface for use is paramount to complete the configuration...

globally:

enable aaa
define the server and key
define the authentication
enable dot1x

dls1(config)#aaa new-model
dls1(config)#radius-server host 192.168.1.102 key 789
dls1(config)#aaa authentication dot1x default group radius
dls1(config)#dot1x system-auth-control
dls1(config)#int f0/20
dls1(config-if)#dot1x port-control force-un
                  ^
% Invalid input detected at '^' marker.

dls1(config-if)#sw mode acc
dls1(config-if)#dot1x port-control force-un
dls1(config-if)#

the point... dot1x on the port won't work if it's not an access port... why?

because we are not men...

we are devo...

radius...

why?

radius = remote authentication dial in user service...

the first question one should ask is, do user's actually dial in anymore?

at any rate...

enable aaa new-model as you would for tacacs

aaa new-model

then the radius server
radius-server  host (hostname) (key)

define the 802.1x authentication method

aaa authentication dot1x default group radius

enable 802.1x on the switch

  dot1x system-auth-control

configure each switchport for usage

(config-if)# dot1x port-control {force-authorized | forceunauthorized
| auto}

then sit back and try to figure out why you'd ever use this garbage...