Troublehooting Tip: Axis cameras unable to authenticate via RADIUS MAB

When port security is applied, some types of cameras are unable to get a correct VLAN. FortiSwitch port status shows 'unauthorized'.

On the other hand, with the same port settings, the port status of the PC shows 'authorized', and the correct VLAN is obtained.

Solution:

This usually happens when the switch tries to authenticate via EAP 802.1x first before switching to MAB.

To prevent the switch from sending EAP packets, set the auth order to MAC authentication bypass (MAB) on the FortiSwitch port:

config switch interface
    edit interface_name
        config port-security
            set port-security-mode {802.1X | 802.1X-mac-based}
            set mac-auth-bypass enable
            set auth-order MAB
        end
    next
end