802.1x takes a long time to authenticate

Question

I'm currently testing 802.1x in our evironment and one of the things I want to do is mac-address authentication (basically a machine trying to connect to a port has to come up against our ACS server with these addresses). I can get it to work but for some reason it takes close to 5 minutes for it to authenticate. This seems to be the case whether its a reboot of the same mac address or a new mac-address. I'm thinking this might be something on the switch to ACS side because the ACS server doesn't receive an authentication request until a few minutes after the machine is plugged in. Anyone ever seen something like this?
Here is a sanitized copy of the switch config:
version 12.2
no service pad
service timestamps debug uptime
service timestamps log datetime
service password-encryption
service sequence-numbers
hostname switchA
enable secret 5 blah
enable password 7 blah
username blah password blah
aaa new-model
aaa authentication login default group tacacs+ local
aaa authentication dot1x default group radius
aaa authorization config-commands
aaa authorization exec default group tacacs+ local
aaa authorization commands 15 default group tacacs+ none
aaa authorization network default group tacacs+ local
aaa accounting auth-proxy default start-stop group radius
aaa accounting dot1x default start-stop group radius
aaa accounting system default start-stop group radius
aaa session-id common
clock timezone UTC -5
clock summer-time UTC recurring
ip subnet-zero
ip dhcp snooping vlan 1
ip dhcp snooping
cluster commander-address mem
dot1x system-auth-control
no file verify auto
spanning-tree mode pvst
spanning-tree extend system-id
vlan internal allocation policy ascending
interface FastEthernet0/1
switchport mode access
switchport port-security maximum 2
switchport port-security
switchport port-security aging time 1
switchport port-security violation protect
switchport port-security aging type inactiv
dot1x mac-auth-bypass
dot1x pae authenticator
dot1x port-control auto
dot1x host-mode multi-host
dot1x reauthentication
dot1x guest-vlan 23
spanning-tree portfast
ip dhcp snooping limit rate 100
interface GigabitEthernet0/1
switchport trunk encapsulation dot1q
switchport mode trunk
ip dhcp snooping trust
interface GigabitEthernet0/2
switchport mode dynamic desirable
interface GigabitEthernet0/3
interface GigabitEthernet0/4
interface Vlan1
ip address 10.10.10.1 255.255.252.0
no ip route-cache
ip classless
ip http server
ip http access-class 1
ip http secure-server
snmp-server community
snmp-server community
tacacs-server host 10.10.10.6
tacacs-server directed-request
tacacs-server key 7 blah
radius-server host 10.10.10.6 auth-port 1645 acct-port 1646 key 7 blah
radius-server source-ports 1645-1646
radius-server vsa send accounting
radius-server vsa send authentication
control-plane
alias exec macsh sh mac-address | include
alias exec arpsh sh arp | include
line con 0
line vty 0 4
access-class 1 in
password 7 blah
line vty 5 15
password 7 blah
ntp clock-period 36029099
ntp server 10.10.10.9
end

Answer 1

A couple of things here.
* Not sure about a debug and an DHCP with a debug from your reeference. Suffice it to say though, that if you're running 1X on a port, don't even expect DHCP to work (or anything else for that matter) until 802.1X has authorized the port (and out of the way of the data-plane). And DHCP is completely controleld from the client anyway, that should have predictable timing, expected operation, etc.
The tx-period is a timer written into the 1X spec. An authenticator (switch) has the responsibility of re-transmitting frames it expects an answer to. In this case, it's the very first frame (EAPOL-Id-Request) when the switch is looking for a suppliant. The tx-period (30-sec default) is the period for how often the switch will re-transmit the frames. 30-sec is the recommended timer from the 1X spec (since packet loss should be a null concern). But in your case, bear it in mind, if your wanting a non-1x port to "enable". The Guest-VLAN and MAC-Auth-Bypass can only execute after 802.1X has timed out. So, you may want to consider tweaking the timer down in the interest of giving this non-1X device some "more immediate" access. There's security built-in to trying 1X first, however, so there's no silver bullet recommendation here.
The other value I mentioned before was max-reauth-req. This is how many times 1X will REtransmit the initil EAPOL-Id-Req frame before giving up on the fact that a supplicant is not there.
So effectively, the formula for timing out on 1X for these supplemental techniques is.
[tx-period * (1+max-reuath-req).]
Hope this helps,