Netlogin for NAC not working on Extreme x440 and x430 Switches

[Sandeep_Sriniva]

We have deployed NAC and applied the rules and enabled Netlogin on x430 and x440 switches with ExtremeXOS version 16.2.1.6. The MAC authentication shows passed in Netsight and in switch however its not applied in reality if the switch doesnt have the ports configured to the repective vlan.
We are lost in this are we missing something in the configuration.

Here is the configuration on the switch.

create vlan NACauth
configure netlogin vlan NACauth
enable netlogin dot1x mac
configure netlogin authentication protocol-order dot1x mac web-based
configure netlogin add mac-list ff:ff:ff:ff:ff:ff 48 password voxmac
enable netlogin ports 1-23 dot1x
enable netlogin ports 1-23 mac
configure netlogin ports 1-23 mode mac-based-vlans
configure netlogin ports 1-23 no-restart

[Keith_Obermeier]

I'm using a 460G2, but the config should be the same. In the end I added the switches to nac mgr as manual switches and did the following config in cli: # Module netLogin configuration. # enable netlogin dot1x mac configure netlogin authentication protocol-order dot1x mac web-based enable netlogin ports 1:1-48 dot1x enable netlogin ports 1:1-48 mac configure netlogin add mac-list ff:ff:ff:ff:ff:ff 48 encrypted configure netlogin mac timers reauth-period 90 configure netlogin mac username format hyphenated # Module aaa configuration. # configure radius netlogin primary server 1812 client-ip vr VR-Default configure radius netlogin primary shared-secret encrypted configure radius netlogin secondary server 1812 client-ip vr VR-Default configure radius netlogin secondary shared-secret encrypted configure radius-accounting netlogin primary server 1813 client-ip vr VR-Default configure radius-accounting netlogin primary shared-secret encrypted configure radius-accounting netlogin secondary server 1813 client-ip configure radius timeout 20 configure radius mgmt-access timeout 20 configure radius netlogin timeout 20 enable radius-accounting disable radius-accounting mgmt-access enable radius-accounting netlogin

[Sandeep_Sriniva]

Yes, we are enabling the authentication on the Ports we have 5 vlans and once the MAC address is reflected on the Netsight we move them to particular group.

Example - I have connected laptop on port 20 and vlan 20 has to assigned after I move it to the group in Netsight, this is not working until the vlan 20 is configured on the switch.

Netsight should override the switch configuration, we have G2 switches which are working perfectly fine.

[Jeremy_Gibbs]

Are you enabling authentication on the ports?

configure netlogin port 1-23 authentication mode optional

[Ilya_Semenov]

There is no such command in EXOS 16.x

Is there any analog for it?

Thanks