Hi all, 

I would like to ask about 802.1X and mab authentication on N-series switching running firmware 6.6.0.0. 

My configuration as follows:

authentication enable
authentication dynamic-vlan enable
dot1x system-auth-control
aaa authentication dot1x default radius
aaa authorization network default radius
radius server auth 192.168.10.20
name "RADIUS-Server"
key 7 "bbg34d1bb"

!

interface Gi1/0/1
spanning-tree portfast
switchport mode general
authentication host-mode single-host
authentication max-users 1
authentication event fail action authorize vlan 10
mab auth-type chap
authentication order dot1x mab
authentication priority dot1x mab
exit

My questions:

1) Based on the above configuration, if a device doesn't pass 802.1x it will failover to mab. How do I configure so that if it authenticates only on either 802.1x or mab? If a device has 802.1x enabled, it should authenticate on that method only and if it fails, it should not failover to mab.

2) I am using ClearPass. I am seeing the switch sending RADIUS packet to ClearPass but it is not hitting a policy for 802.1X authentication. The initial service policy is generic for wired 802.1x and seen below:

Appreciate your advise. Thanks