Cisco ISE FlexAuth with 802.1X PCs and IP Phones as MAB multi-domain Q?

Question

Cisco ISE FlexAuth with 802.1X PCs and IP Phones as MAB multi-domain Q?
Im trying to follow the trustsec 2.1 guide on IP Phones into LowImpact mode.
I can get a PC on its own to authenticate via dot1x/tls
I can get a Cisco IP Phone on its own to authenticate via MAB.
When the two are on the same switchport, the phone will authenticate but not the PC.  ISE logs EAP timeouts.
The switchport has the LowImpact port ACL of
ip access-group ACL-DEFAULT in
The IP Phone gets a dACL that allows it ok.
I assume MAB phone and dot1x PC is supported?  Any ideas?
Thanks in advance.

Answer 1

The ISE log detailed steps are as follows:
Steps
11001  Received RADIUS Access-Request
11017  RADIUS created a new session
Evaluating Service Selection Policy
15048  Queried PIP
15048  Queried PIP
15004  Matched rule
11507  Extracted EAP-Response/Identity
12300  Prepared EAP-Request proposing PEAP with challenge
12625  Valid EAP-Key-Name attribute received
11006  Returned RADIUS Access-Challenge
11001  Received RADIUS Access-Request
11018  RADIUS is re-using an existing session
12501  Extracted EAP-Response/NAK requesting to use EAP-TLS instead
12500  Prepared EAP-Request proposing EAP-TLS with challenge
12625  Valid EAP-Key-Name attribute received
11006  Returned RADIUS Access-Challenge
11001  Received RADIUS Access-Request
11018  RADIUS is re-using an existing session
12502  Extracted EAP-Response containing EAP-TLS challenge-response and accepting EAP-TLS as negotiated
12800  Extracted first TLS record; TLS handshake started
12805  Extracted TLS ClientHello message
12806  Prepared TLS ServerHello message
12807  Prepared TLS Certificate message
12809  Prepared TLS CertificateRequest message
12505  Prepared EAP-Request with another EAP-TLS challenge
11006  Returned RADIUS Access-Challenge
11001  Received RADIUS Access-Request
11018  RADIUS is re-using an existing session
12504  Extracted EAP-Response containing EAP-TLS challenge-response
12505  Prepared EAP-Request with another EAP-TLS challenge
11006  Returned RADIUS Access-Challenge
11001  Received RADIUS Access-Request
11018  RADIUS is re-using an existing session
12504  Extracted EAP-Response containing EAP-TLS challenge-response
12505  Prepared EAP-Request with another EAP-TLS challenge
11006  Returned RADIUS Access-Challenge
5411  No response received during 120 seconds on last EAP message sent to the client