I have dot1x working with certificate based RADIUS auth against NPS. For some reason, though, when I turn on monitor mode with the command "dot1x system-auth-control monitor" as described on page 293 of the user guide I'm not able to gain access to a port without successful authentication.
My understanding was that monitor mode should mean the port would authorize even if authentication failed? So for instance, I turn on monitor mode, then disable 802.1x wired authentication on a windows supplicant. When I plug in to the port it stays as unuathorized in show dot1x, and I'm never able to pass traffic.
Is there something about monitor mode I've misunderstood or failed to implement correctly?