Refer to the exhibit.

The missing command must create the RADIUS server group context before the existingserver name external-radiuscommand can bind the defined RADIUS server into that group. Cisco’s Catalyst 9800 802.1X configuration workflow shows the exact CLI sequence: define the RADIUS server, then enteraaa group server radius < radius-grp-name > , then addserver name < radius-server-name > . The Catalyst 9800 configuration guide likewise states that the RADIUS server-group identification is created withaaa group server radius server-group, followed by the server name assignment.

In this exhibit,external-radiusis already declared underradius server, andaaa authentication dot1x CLIENT_GROUP group RADIUS-GRPalready points the 802.1X method list to the server group namedRADIUS-GRP. Therefore, the box must containaaa group server radius RADIUS-GRPso thatserver name external-radiusis syntactically valid and functionally associates the external server with the group. Cisco also identifies dot1x authentication lists as the AAA method type used for 802.1X SSIDs, with “group” directing authentication to an external RADIUS server. Reference topics:Client Connectivity Configuration — WPA2-Enterprise, 802.1X/EAP, AAA method lists, RADIUS server groups, and Catalyst 9800 WLAN security