AAA is a framework that controls who can enter a network, what they are permitted to do once inside, and keeps a detailed log of their activity. Without it, an enterprise network would be like an office building where anyone could plug in a laptop and roam freely through every department. For the 350‑401 ENCOR exam, understanding how AAA, 802.1X and MAB work together is the foundation for building secure, automated access policies.
Jump to a section
A simple way to picture Network Access Control and AAA
A super‑exclusive nightclub’s entry process is a near‑perfect replica of network access control with AAA. The velvet rope is the switch port; the bouncer behind it is the authenticator. To pass that rope, every person must first prove who they are — that is authentication. A driver’s licence is like an 802.1X certificate, a solid digital identity. Once the bouncer scans a VIP guest list stored on an iPad (the RADIUS server), the guest gets a coloured wristband. That wristband is authorisation: silver gets you into the main dance floor, gold opens the penthouse lounge, to black you keep walking. The club also opens a bar tab against your name, logging every drink — that is accounting.
Some guests arrive without formal ID. Instead they hand over a numbered coat‑check ticket, just a MAC address. The bouncer checks that number against a separate coat‑check list. If it matches, they are waved through with a basic wristband. That is MAC Authentication Bypass (MAB), a fallback for devices that cannot speak the 802.1X language. The entire process — ID check, wristband rules, bar tab — is AAA, and the nightclub cannot survive without it.
AAA stands for Authentication, Authorisation and Accounting. It is a security architecture that replaces the old method of simply allowing any device connected to a switch port to access everything. In traditional networks, physical port security was all that stood between an attacker and the whole corporate LAN. AAA brings identity to the network edge.
Authentication answers ‘Who are you?’ It proves the claimed identity of a user or device. Credentials can be something you know (password), something you have (certificate, smart card), or something you are (biometric). Authorisation answers ‘What are you allowed to do?’ After the identity is verified, the system applies policies: which VLAN you can use, what IP addresses you can reach, even what commands you can run on a router. Accounting answers ‘What did you do?’ It creates an audit trail by recording when a session started, how much data was transferred, and when it ended. This is essential for billing, troubleshooting and compliance.
The most common protocol for putting AAA into action is 802.1X, an IEEE standard for port‑based network access control. It uses a language called EAP (Extensible Authentication Protocol) that rides over LAN frames — hence ‘EAP over LAN’ or EAPoL. In an 802.1X conversation there are three roles:
The supplicant: the client device wanting access, often a laptop running native OS supplicant software or the Cisco AnyConnect NAM module.
The authenticator: the network device that enforces the gate, typically a switch or wireless controller. It does not make the authentication decision itself; it merely passes messages and opens or closes the port.
The authentication server: the brain that holds user credentials, usually a RADIUS server such as Cisco ISE or FreeRADIUS.
When a cable is plugged into a switch port configured for 802.1X, the authenticator immediately sends an EAPoL Identity Request. If the client is 802.1X‑capable, it replies with its identity. The authenticator then encapsulates the EAP messages inside RADIUS Access‑Request packets and forwards them to the authentication server. The server performs a challenge‑response (e.g. EAP‑PEAP, EAP‑TLS) to validate the credential. If successful, it returns a RADIUS Access‑Accept containing authorisation attributes such as a dynamic VLAN ID, a downloadable ACL (Access Control List) or a session timeout. The authenticator uses those attributes to configure the port and finally lifts the gate. An Access‑Reject means the port stays blocked.
What about devices that do not speak EAP? Printers, IP cameras, and many IoT sensors are prime examples. For these, the fallback mechanism is MAB — MAC Authentication Bypass. When the authenticator sends its EAPoL Identity Request and hears nothing for a configurable timeout (typically 30 seconds), it takes the source MAC address it learned from the first frame and packages it as both username and password in a RADIUS Access‑Request. The authentication server checks the MAC address against an internal endpoint database. If found, it returns Access‑Accept just as with 802.1X, often placing the device in a restricted IoT VLAN. MAB is not a type of 802.1X; it is a separate feature that operates on the same port after 802.1X times out.
Two major AAA protocols relay credentials between authenticator and server: RADIUS and TACACS+. RADIUS (Remote Authentication Dial‑In User Service) is the open IETF standard, uses UDP ports 1812 (authentication) and 1813 (accounting), and encrypts only the password attribute in the packet. TACACS+ (Terminal Access Controller Access Control System Plus) is Cisco proprietary, uses TCP port 49, and encrypts the entire payload. RADIUS combines authentication and authorisation in one flow; TACACS+ separates them, making it more granular for device administration AAA. For network access control (802.1X, MAB), RADIUS is the dominant choice.
On a Cisco switch, the AAA journey begins with the global command ‘aaa new‑model’. Then you define the RADIUS server with ‘radius server’ or legacy ‘radius‑server host’, create an authentication method list such as ‘aaa authentication dot1x default group radius’, and enable 802.1X globally with ‘dot1x system‑auth‑control’. Under each interface you apply ‘authentication port‑control auto’ and ‘dot1x pae authenticator’. To enable MAB as a fallback, simply add the word ‘mab’ on the same interface. The switch will then try 802.1X first and, if no response, fall back to MAB. Many real‑world deployments use identical interface templates everywhere so that every port can handle any type of device automatically.
Endpoint connects and link comes up
When an Ethernet cable is plugged in or a client associates to an SSID, the authenticator switch detects the physical link and enters the authentication process. This is the trigger for AAA.
EAPoL identity request
The switch, acting as authenticator, sends an EAPoL Identity Request toward the endpoint. This starts the clock; if a supplicant is present, it will respond with its identity.
Supplicant response or timeout
An 802.1X‑capable client replies with an EAPoL Response containing its username or certificate identity, kicking off mutual EAP challenge. If no reply is received within a configured timeout, the switch falls back to MAB and sends the MAC address as credentials to the RADIUS server.
RADIUS Access‑Request to authentication server
The authenticator encapsulates the EAP messages (or the MAC address) inside a RADIUS Access‑Request and forwards it to the authentication server. The shared secret ensures the message is from a trusted device.
Server authentication and authorisation
The RADIUS server validates credentials against an identity store (Active Directory, Microsoft Entra ID, local database). If successful, it returns a RADIUS Access‑Accept containing authorisation attributes like VLAN, ACL, or session timeout. Failure returns Access‑Reject.
Port authorisation and accounting start
The authenticator applies the received attributes, activates the port, and sends a RADIUS Accounting Start packet. The endpoint now has controlled network access, and every session detail is logged.
A financial services firm moves into a new office and decides that no unknown device should ever touch the internal network. The lead network engineer deploys Cisco Catalyst 9000 switches and a Cisco ISE (Identity Services Engine) cluster as the RADIUS server.
The engineer begins by configuring the switch globally: - ‘aaa new‑model’ to enable the AAA framework. - ‘radius server ISE1’ with the server’s IP address and a shared secret. - ‘aaa group server radius ISE_GROUP’ to group two ISE nodes for high availability. - ‘aaa authentication dot1x default group ISE_GROUP’ to send all 802.1X authentication requests to ISE. - ‘aaa authorisation network default group ISE_GROUP’ to download per‑user permissions. - ‘aaa accounting dot1x default start‑stop group ISE_GROUP’ to log session details. - ‘dot1x system‑auth‑control’ to activate 802.1X globally.
When an employee docks their corporate laptop, the switch port detects link up and starts the 802.1X process. The laptop’s built‑in Windows supplicant responds to the EAPoL Identity Request. ISE, integrated with Microsoft Entra ID, validates the user’s digital certificate via EAP‑TLS. Once the user identity is confirmed, ISE returns a RADIUS Access‑Accept that includes a dynamic VLAN assignment (VLAN 20 for Finance), a downloadable ACL that restricts lateral movement to sensitive servers, and a session timeout. The switch applies these attributes, the port LED goes green, and the employee is on the network with strictly limited permissions.
In the same building, a new network printer is installed. It does not have an 802.1X supplicant. When connected, the switch sends EAPoL messages and hears nothing. After a configured timeout, the switch automatically falls back to MAB. It takes the printer’s MAC address and sends a RADIUS Access‑Request using that MAC as both username and password. ISE looks up the MAC address in its internal endpoints database, where the printer’s MAC was pre‑registered by the IT team. ISE returns Access‑Accept with VLAN 50 (Printers VLAN) and a simple ACL allowing only print traffic to the print server. The printer connects seamlessly without any configuration on the device itself.
Finally, a consultant visits with a personal laptop. The switch tries 802.1X; the laptop replies but fails EAP negotiation because it does not have a trusted certificate. The switch does not attempt MAB because an EAP response was received, so the authentication fails. The port is placed in an unauthorised state, and the consultant receives no network access. The engineer sees an authentication failure log on ISE and can decide to move the port to a guest VLAN or offer a web‑based captive portal. Throughout the day, the accounting records on ISE store details of every session, giving the security team an audit trail that meets regulatory compliance requirements.
The 350‑401 ENCOR exam treats AAA and network access control as a core infrastructure security topic. Questions are usually multiple‑choice or drag‑and‑drop, and they test both conceptual understanding and configuration syntax. Expect to see the following areas heavily represented:
The precise order of AAA processes and what each letter accomplishes. You must know that authentication always comes first, followed by authorisation, and finally accounting.
RADIUS versus TACACS+. The exam loves to ask which protocol encrypts the entire packet (TACACS+), which uses UDP (RADIUS), and which is best suited for device administration versus network access. Memorise: RADIUS – UDP 1812/1813, password encryption only; TACACS+ – TCP 49, full encryption, Cisco proprietary.
The three roles in 802.1X. You are guaranteed to see a question that asks what the authenticator does (forwards EAP frames to the RADIUS server) or what a supplicant is (client software).
Configuration commands. Know that ‘aaa new‑model’ is the global enable for AAA, that ‘dot1x system‑auth‑control’ turns on 802.1X, and that ‘authentication port‑control auto’ under an interface activates it. The MAB command is simply ‘mab’ under the same interface.
MAB behaviour. Traps often present MAB as a type of 802.1X or an EAP method — it is neither. It is a fallback that uses the MAC address as credentials.
Dynamic authorisation attributes. Be aware that a RADIUS Access‑Accept can deliver a VLAN ID, downloadable ACL, or re‑authentication timer, and that the authenticator honours those.
Troubleshooting output. The ‘show authentication sessions interface gig 1/0/1’ command output can show the current method (dot1x or mab) and the authorisation state. The exam might ask you to interpret such output to decide why a port is unauthorised.
Common trap patterns:
A question that says ‘Which EAP method does MAB use?’ — trick, MAB does not use EAP.
Confusing ‘aaa authentication dot1x’ with ‘aaa authorisation network’. They serve different purposes.
Assuming that enabling 802.1X on an interface means MAB is automatically enabled — it is not; you must explicitly add ‘mab’.
Forgetting that TACACS+ is Cisco proprietary and therefore not suitable for multi‑vendor environments.
Key definitions the exam expects you to memorise:
Authentication: verification of identity.
Authorisation: determination of allowed resources.
Accounting: recording of session activity.
802.1X: port‑based access control using EAPoL.
MAB: authentication via MAC address when EAP fails.
Authenticator: the switch or controller that enforces the gate.
Supplicant: the client device requesting access.
AAA is the abbreviation for Authentication, Authorisation and Accounting — the three mandatory steps of identity‑based network access control.
802.1X uses EAP over LAN (EAPoL) to authenticate a supplicant before a switch port is opened.
MAB bypasses 802.1X by using a device’s MAC address as the credential, making it suitable for printers, cameras and IoT endpoints.
RADIUS operates over UDP ports 1812/1813 and encrypts only the password, while TACACS+ uses TCP port 49 and encrypts the entire payload.
The authenticator (switch or wireless controller) never makes the authentication decision; it relays EAP messages to the RADIUS server and enforces the resulting policy.
Enabling AAA on a Cisco switch always starts with the global command ‘aaa new‑model’, and 802.1X is activated with ‘dot1x system‑auth‑control’.
A RADIUS Access‑Accept can include dynamic authorisation attributes like VLAN ID, downloadable ACL and session timeout — this is how role‑based access is enforced at the port.
These come up on the exam all the time. Here's how to tell them apart.
RADIUS
Open standard IETF RFC 2865
Uses UDP ports 1812 (authentication) and 1813 (accounting)
Encrypts only the password attribute in Access‑Request
TACACS+
Cisco proprietary protocol
Uses TCP port 49 (reliable, connection‑oriented)
Encrypts the entire payload between device and server
802.1X
Uses EAPoL to carry Extensible Authentication Protocol
Requires a supplicant (software) on the endpoint
Supports strong mutual authentication with certificates
MAB
Not an EAP method; sends MAC address as username/password
Works with any Ethernet device, no client software needed
Weak security; MAC addresses can be spoofed easily
Authentication
Answers ‘Who are you?’ — proves identity
Happens first in the AAA sequence
Verifies passwords, certificates, or biometrics
Authorisation
Answers ‘What are you allowed to do?’ — sets permissions
Occurs after successful authentication
Delivers VLAN, ACL, session timeout, command privilege level
Local AAA
Credentials stored on the network device itself
Does not scale beyond a few devices; separate database per box
Useful as a fallback when the central server is unreachable
Remote AAA (RADIUS/TACACS+)
Credentials stored on a centralised server
Scales to thousands of network devices, one point of administration
Supports dynamic authorisation and centralised accounting
Mistake
802.1X is only used for securing wireless networks.
Correct
802.1X was originally designed for wired switch ports and is equally critical for wired access control. It is the foundation of both wired and wireless enterprise authentication.
Most people first meet 802.1X on Wi‑Fi as ‘WPA2‑Enterprise’, so they assume it is a wireless technology. The standard name ‘port‑based’ is forgotten.
Mistake
MAB is just another EAP method inside 802.1X.
Correct
MAB is a separate fallback mechanism that does not use EAP at all. It sends the device’s MAC address as a username and password in a standard RADIUS request.
Because MAB is configured on the same switch port and can result in a successful authentication, beginners lump it together with 802.1X. The silent timeout behaviour further blurs the distinction.
Mistake
AAA only means authentication — the other A’s are optional extras.
Correct
AAA must always include all three pillars. Authorisation provides granular access control (VLAN, ACL), and accounting creates the audit trail. A network that only authenticates is wide open after initial login.
The term ‘triple‑A’ makes it sound like one main function with two minor letters. Many introductory resources stop at authentication because it is the most visible step.
Mistake
RADIUS encrypts the entire authentication packet, just like TACACS+.
Correct
RADIUS only encrypts the user‑password attribute using a shared secret and MD5. The rest of the packet, including username and authorisation details, is in clear text. TACACS+ encrypts the full payload.
Both protocols are used for AAA and both require a shared secret, so people assume the encryption scope is identical. In reality, RADIUS was designed in an era when only the password was considered truly sensitive.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
RADIUS is an open standard that uses UDP and encrypts only the password. TACACS+ is Cisco proprietary, uses TCP, encrypts the entire payload, and separates authentication from authorisation. RADIUS is ideal for network access (802.1X); TACACS+ is preferred for device administration.
Technically you can use local authentication on the switch, but this is rarely done in production because it does not scale and cannot deliver dynamic authorisation. A centralised server like Cisco ISE or FreeRADIUS is the standard approach.
MAB provides only basic identification, not strong security. MAC addresses can indeed be spoofed, so MAB is typically combined with endpoint profiling, additional checks, or used for low‑risk devices on restricted VLANs. It is not a substitute for 802.1X where certificates or passwords are used.
By default, the switch will not receive any Access‑Accept and ports will remain unauthorised. However, you can configure a fail‑open policy that grants limited guest access, or add a ‘local’ fallback in the AAA method list to use a local username and password.
The command ‘mab’ enables the feature, but you also need a functioning RADIUS server with the device’s MAC address entered in its endpoints database and the correct AAA method lists set up. The switch must first try 802.1X; only when EAP times out will MAB take over.
Use ‘show authentication sessions interface <interface> details’. The output clearly states the current method (dot1x or mab), the authentication status, and any failure reason. This is the primary troubleshooting command for network access control.
You've finished Network Access Control and AAA. Continue through the 350-401 ENCOR study guide to build a complete picture of the exam.
Done with this chapter?