At a certain site, S5570S-54S-EI 802.1x fallback does not take effect

Device model and version: S5570S-54S-EI Release 1128

On-site configuration of 802.1x fallback does not take effect. When the server is unreachable, the user (1/0/27) cannot access the fallback VLAN, and the device cannot learn the terminal address.

1. The on-site device version is the latest
2. Interface configuration is as follows
#
interface GigabitEthernet1/0/27
port link-mode bridge
port access vlan 601
stp edged-port
dot1x
undo dot1x handshake
dot1x mandatory-domain carizon-domain
dot1x critical vlan 601
mac-authentication
mac-authentication domain carizon-domain
mac-authentication critical vlan 601
#
3. Server status
  ===============display radius scheme=============== 
Total 2 RADIUS schemes
 
------------------------------------------------------------------
RADIUS scheme name: carizon-radius
  Index: 0
  Primary authentication server:
    Host name: Not Configured
    IP   : x.x.x.44                               Port: 1812 
    VPN  : Not configured                          
    State: Blocked
    Most recent blocked period: 2024/11/02 22:57:39 - now
    Test profile: taosheng
      Probe username: admin
      Probe interval: 1 minutes
    Weight: 0
  Primary accounting server:
    Host name: Not Configured
    IP   :  x.x.x.44                                Port: 1813 
    VPN  : Not configured                         
    State: Active (duration: 0 weeks, 0 days, 1 hours, 12 minutes, 1 seconds)
    Weight: 0
  Accounting-On function                     : Disabled
    extended function                        : Disabled
    retransmission times                     : 50
    retransmission interval(seconds)         : 3
  Timeout Interval(seconds)                  : 3
  Retransmission Times                       : 3
  Retransmission Times for Accounting Update : 5
  Server Quiet Period(minutes)               : 5
  Realtime Accounting Interval(seconds)      : 720
  Stop-accounting packets buffering          : Enabled
    Retransmission times                     : 500
  NAS IP Address                             : x.x.x.2
  VPN                                        : Not configured
  User Name Format                           : without-domain
  Data flow unit                             : Byte
  Packet unit                                : One
  Attribute 15 check-mode                    : Strict
  Attribute 25                               : Standard
  Attribute Remanent-Volume unit             : Kilo
  server-load-sharing                        : Disabled
  Attribute 31 MAC format                    : HH-HH-HH-HH-HH-HH
  Stop-accounting packets send-force         : Disabled
  Reauthentication server selection          : Inherit
  Attribute 218 of vendor ID 25506           : DHCP-Option 61
                                               Format 1 (1-byte Type field)
------------------------------------------------------------------
4. Debug information confirms server unreachable and authentication fail messages exist
 
*RADIUS/7/EVENT: Found request context, dstIP: x.x.x.x; dstPort: 1812; VPN instance: --(public); socketfd: 94; pktID:23.
*RADIUS/7/EVENT: Retransmitting request packet, currentTries: 3, maxTries: 3.
*DOT1X/7/EVENT: User aging timer expired: UserMAC=xxxx-xxxx-xx75, VLANID=601, Interface=GigabitEthernet1/0/27.
*DOT1X/7/EVENT: BE is in Initialize state: UserMAC=xxxx-xxxx-xx75, VLANID=601, Interface=GigabitEthernet1/0/27.
*DOT1X/7/EVENT: Interface GigabitEthernet1/0/27 received Set the port authorization status to unauthorized event.

After product line positioning: Adding 1x critical VLAN requires either mac-vlan enable (needs to be configured as a hybrid port) or port-based mode. For scenarios requiring both MAC and 1x authentication simultaneously, the solution is to change to a hybrid port.
Changing to a hybrid port on-site and configuring mac-vlan enable resolves the issue.