Sanitized config here:

!Command: show running-config
!Time: Tue Jan  8 18:40:24 2019

version 7.1(0)N1(1a)
hostname NexusFiveKLab

no feature telnet
feature tacacs+
feature interface-vlan
feature dot1x
feature lacp
feature lldp
feature vtp

username admin password 5 XXXXXX  role network-admin


fips mode enable
no ip domain-lookup
tacacs-server host 172.16.0.11 key 7 "XXXX"
aaa group server tacacs+ SSVR
  server 172.16.0.11
  source-interface Vlan19
radius-server host 192.168.101.11 key 7 "XXXX" authentication accounting
logging event link-status default
policy-map type network-qos jumbo
  class type network-qos class-default
    mtu 9216
    multicast-optimize
system qos
  service-policy type queuing input fcoe-default-in-policy
  service-policy type queuing output fcoe-default-out-policy
  service-policy type qos input fcoe-default-in-policy
  service-policy type network-qos jumbo
snmp-server user admin network-admin auth md5 XXXX priv XXXX localizedkey
snmp-server host 172.16.0.3 traps version 3 auth NET_MONITOR udp-port 30055
snmp-server community 5K_Lab group network-operator
ntp server 192.168.1.1 prefer
ntp source-interface Vlan10
aaa authentication login default group SSVR local
aaa authentication login console group SSVR local
aaa authorization config-commands default group SSVR local
aaa authorization commands default group SSVR local
aaa authentication dot1x default group radius
aaa accounting default group SSVR
aaa authentication login error-enable

spanning-tree vlan 10, 900, 1000 priority 24576
vrf context management
  ip route 0.0.0.0/0 192.168.1.254


interface Vlan1

interface Vlan10
  no shutdown
  ip address 192.168.1.4/25

interface Vlan101
  no shutdown
  ip address 192.168.101.2/24

interface port-channel1
  switchport mode trunk
  switchport trunk allowed vlan 4-5,10,19,119,900,1000
  speed 1000

interface Ethernet1/1
  ***The only port I've configured for dot1x is eth2/16.  All other ports are either access ports or trunk ports.***

interface Ethernet2/16
  description 802.1x Test
  dot1x port-control auto
  dot1x re-authentication
  dot1x max-req 3
  dot1x timeout quiet-period 25
  dot1x timeout re-authperiod 3300
  dot1x timeout tx-period 40
  dot1x timeout server-timeout 60
  dot1x timeout ratelimit-period 10
  dot1x timeout supp-timeout 20
  dot1x pae authenticator
  dot1x mac-auth-bypass 
  no cdp enable
  switchport access vlan 40
  speed 1000

interface mgmt0
  vrf member management
  ip address 192.168.1.2/25
cli alias name w copy system:running-config nvram:startup-config
cli alias name c config t
cli alias name sib show init brief
cli alias name sii show ip int brief
line console
line vty
boot kickstart bootflash:/n5000-uk9-kickstart.7.1.0.N1.1a.bin
boot system bootflash:/n5000-uk9.7.1.0.N1.1a.bin
ip radius source-interface Vlan101

I'm trying to configure a Cisco Nexus 5548 for 802.1x using MAC Authentication Bypass. I'm finding that there isn't an option to configure the guest VLAN in the event that authentication fails. According to this documentation it should be an available feature. But as you can see below it's not an available option.

Switch(config-if)# dot1x ?
  default            Configure Dot1x with default values for this port
  host-mode          Role of 802.1x authenticating entity
  mac-auth-bypass    Configure Mac-Auth-Bypass
  max-reauth-req     Maximum Re-authentication Attempts Before Failing
  max-req            Maximum Retries to Initiate Authentication
  pae                Role of 802.1x authenticating entity
  port-control       Port control
  re-authentication  Enable or Disable Reauthentication for this port
  timeout            Various Timeouts

I've enabled feature dot1x. Configured my radius server and preshared key. I've added the needed aaa statement as well.

I can even run: "test aaa server radius x.x.x.x testuser password" and the user account authenticates successfully. It's just the guest-vlan feature that I can't get working.

I noticed in the linked documentation that is says:

If MAB is configured, and if there is an authentication failure due to MAB, then the guest VLAN (if available), will be assigned as access VLAN.

What does it mean by (if available)? Do I need to define a VLAN and then establish it as a Guest VLAN with some sort of parameter?

I should emphasize that this is on a Nexus 5548 and not a Nexus 9000 series switch. I've read that Nexus 9Ks don't support the guest-vlan feature.

I'm trying to configure a Cisco Nexus 5548 for 802.1x using MAC Authentication Bypass. I'm finding that there isn't an option to configure the guest VLAN in the event that authentication fails. According to this documentation it should be an available feature. But as you can see below it's not an available option.

Switch(config-if)# dot1x ?
  default            Configure Dot1x with default values for this port
  host-mode          Role of 802.1x authenticating entity
  mac-auth-bypass    Configure Mac-Auth-Bypass
  max-reauth-req     Maximum Re-authentication Attempts Before Failing
  max-req            Maximum Retries to Initiate Authentication
  pae                Role of 802.1x authenticating entity
  port-control       Port control
  re-authentication  Enable or Disable Reauthentication for this port
  timeout            Various Timeouts

I've enabled feature dot1x. Configured my radius server and preshared key. I've added the needed aaa statement as well.

I can even run: "test aaa server radius x.x.x.x testuser password" and the user account authenticates successfully. It's just the guest-vlan feature that I can't get working.

I noticed in the linked documentation that is says:

If MAB is configured, and if there is an authentication failure due to MAB, then the guest VLAN (if available), will be assigned as access VLAN.

What does it mean by (if available)? Do I need to define a VLAN and then establish it as a Guest VLAN with some sort of parameter?

I should emphasize that this is on a Nexus 5548 and not a Nexus 9000 series switch. I've read that Nexus 9Ks don't support the guest-vlan feature.