I’d like to configure ports in Cisco Catalyst access switches (C9300) so that hosts can access with the following criteria:

• if dot1x is supported, use it (the RADIUS server will dynamically assign a vlan ID)
• if MAB is supported, use it (the RADIUS server will dynamically assign a vlan ID)
• if both dot1x and MAB fail (eg. RADIUS servers are all offline), allow port access for the host and statically assign it a vlan ID

Is this possible? If so, how can this be achieved?

Suppose I have a simple port setup with static vlan assignment such as:

interface GigabitEthernet1/0/1
 description test
 switchport access vlan 15
 switchport mode access
 load-interval 30
 spanning-tree portfast edge
 spanning-tree bpduguard enable
 spanning-tree guard root
end

Suppose I also have a port with dot1x and MAB such as:

interface GigabitEthernet1/0/1
 description test_dot1x_MAB_MultiAuth
 switchport mode access
 load-interval 30
 authentication event fail action next-method
 authentication host-mode multi-auth
 authentication order dot1x mab
 authentication port-control auto
 mab
 dot1x pae authenticator
 dot1x timeout tx-period 5
 dot1x max-reauth-req 1
 spanning-tree bpduguard enable
 spanning-tree guard root
end

How can I do “assign dynamic vlan via dot1x else via MAB else assign static vlan 15”?
Would it be enough to add:

switchport access vlan 15

to the test_dot1x_MAB_MultiAuth interface configuration?

Thanks