ISE dot1x and MAB issues

Question

I am trying to set my ISE to attempt dot1x before mab. If I set up the switchport to try mab first, then ISE does its job and assigns the proper vlan. However, when I set the port up to do dot1x first, the port reverts to the default vlan 1. I am able to manually assign the proper vlan on the port and ISE does not interfere, but that kind of defeats the purpose. The port is on a 4506 and below is the port config. Any direction would be greatly appreciated.
interface GigabitEthernet5/7
 description 1-151
 switchport mode access
 switchport block unicast
 switchport voice vlan 68
 ip arp inspection limit rate 60
 ip access-group ACL-ALLOW in
 authentication event fail action next-method
 authentication event server dead action authorize vlan 40
 authentication event server dead action authorize voice
 authentication event server alive action reinitialize
 authentication host-mode multi-auth
 authentication open
 authentication order mab dot1x
 authentication priority dot1x mab
 authentication port-control auto
 authentication periodic
 authentication timer reauthenticate server
 authentication timer inactivity 3600
 authentication violation restrict
 mab
 snmp trap mac-notification change added
 dot1x pae authenticator
 dot1x timeout tx-period 10
 spanning-tree portfast
 spanning-tree bpduguard enable
end

Answer 1

Recently i have implemented in one of our customer, find the below switch configuration.
aaa new-model
aaa authentication dot1x default group radius local
aaa authorization network default group radius local
aaa authorization auth-proxy default group radius
aaa accounting delay-start all
aaa accounting auth-proxy default start-stop group radius
aaa accounting dot1x default start-stop group radius
aaa accounting network default start-stop group radius
aaa server radius dynamic-author
 client <ISE IP ADDRESS> server-key 7 10471A1C25141B1F0F
aaa session-id common
ip device tracking probe use-svi
ip device tracking
ip admission name Testing_ISE proxy http inactivity-time 10 list ISE_ALLOWED
epm logging
dot1x system-auth-control
spanning-tree mode rapid-pvst
spanning-tree loopguard default
spanning-tree portfast bpduguard default
spanning-tree extend system-id
spanning-tree uplinkfast
spanning-tree backbonefast
spanning-tree vlan 1-1005 priority 8192
port-channel load-balance src-dst-ip
vlan internal allocation policy ascending
interface ran GigabitEthernet X/X
 description "Connected to test PC for ISE testing"
 switchport access vlan x
 switchport mode access
 switchport voice vlan x
 authentication event fail action next-method
 authentication event server dead action authorize vlan 107
 authentication event server alive action reinitialize
 authentication host-mode multi-auth
 authentication open
 authentication order dot1x mab
 authentication priority dot1x mab
 authentication port-control auto
 authentication periodic
 authentication timer reauthenticate server
 authentication timer inactivity 180
 authentication violation protect
 mab
 dot1x pae authenticator
 dot1x timeout tx-period 10
 spanning-tree portfast
ip http server
ip http secure-server
ip access-list extended ISE_REDIR
 deny   udp any any eq bootpc
 deny   udp any any eq bootps
 deny   udp any any eq domain
 deny   ip any host <ISE IP ADDRESS> log
 permit tcp any any eq www
 permit tcp any any eq 443
 deny   ip any any log
ip access-list extended ISE_ALLOWED
 permit ip any host <ISE IP ADDRESS>
logging esm config
snmp-server community string RO
snmp-server community public RO
snmp-server community ise RO
snmp-server trap-source Vlan250
snmp-server enable traps mac-notification change move threshold
snmp-server host <ISE IP ADDRESS> version 2c ise  mac-notification
radius-server attribute 6 on-for-login-auth
radius-server attribute 8 include-in-access-req
radius-server attribute 25 access-request include
radius-server dead-criteria time 5 tries 3
radius-server host <ISE IP ADDRESS> auth-port 1812 acct-port 1813 key 7
141E010E2C07233F27
radius-server vsa send accounting
radius-server vsa send authentication
Create a Authentication policy in ISE and allow ISE_REDIR ACL.