configure terminal

! RADIUS server
aaa new-model

radius server FORTINAC
 address ipv4 <NAC IP> auth-port 1812 acct-port 1813
 key 0 ********

aaa group server radius FORTINAC-RADIUS
 server name FORTINAC

aaa authentication dot1x default group FORTINAC-RADIUS
aaa authorization network default group FORTINAC-RADIUS
aaa accounting dot1x default start-stop group FORTINAC-RADIUS

! Source RADIUS
ip radius source-interface <VLAN>

! Allow Cisco vendor-specific attributes if FortiNAC uses them
radius-server vsa send authentication
radius-server vsa send accounting

! FortiNAC CoA Auth / Disconnect request
aaa server radius dynamic-author
 client <NAC IP> server-key <RADIUS_COA_SECRET>
 port 3799
 auth-type any

! Globally enable 802.1X
dot1x system-auth-control

!Pr. Port Config
interface GigabitEthernet1/0/1 (Or range)
 description 802.1X-MAB-ACCESS
 switchport
 switchport mode access
 switchport access vlan 1

 authentication host-mode multi-auth
 authentication order mab dot1x
 authentication priority dot1x mab
 authentication event fail action next-method
 authentication port-control auto

 authentication periodic
 authentication timer reauthenticate 65535

 mab
 dot1x pae authenticator

 spanning-tree portfast

!Config interface range for RADIUS
#If port range already configured run macro again with new port
#no define interface-range ACCESS_PORTS
define interface-range ACCESS_PORTS GigabitEthernet<Range>
interface range macro ACCESS_PORTS
 description 802.1X-MAB-ACCESS
 switchport
 switchport mode access
 switchport access vlan 1
 authentication host-mode multi-auth
 authentication order max dot1x
 authentication priority dot1x mab
 authentication event fail action next-method
 authentication port-control auto
 authentication periodic
 authentication timer reauthenticate 65535
 mab
 dot1x pae authenticator
 spanning-tree portfast

end