802.1X Port Authentication

802.1X is an IEEE standard (IEEE 802.1X-2020) for port-based network access control (PNAC). It provides a framework for authenticating devices before granting them access to a network at the data link layer (Layer 2). The primary purpose is to ensure that only authorized devices can connect to a switch port or wireless access point, thereby preventing rogue devices from gaining network access.

Before 802.1X, network access was typically granted based on physical connectivity—if you plugged into a wall jack, you were on the network. This created significant security vulnerabilities. 802.1X solves this by requiring authentication at the port level, using the Extensible Authentication Protocol (EAP) over LAN (EAPoL) for wired networks or EAP over Wireless (EAPoW) for Wi-Fi.

802.1X involves three main components: - Supplicant: The client device seeking network access. It runs 802.1X client software (e.g., built into Windows, macOS, Linux, or third-party). - Authenticator: The network device that enforces access control, typically a switch or wireless access point (AP). It acts as a proxy between the supplicant and the authentication server. - Authentication Server: Usually a RADIUS server (e.g., Cisco ISE, FreeRADIUS, Microsoft NPS) that validates the supplicant's credentials and authorizes access.

The authentication process follows a three-way handshake-like exchange using EAPoL frames (for wired) or EAPoW (for wireless). The authenticator initially places the port in an "unauthorized" state, blocking all traffic except EAPoL frames. The supplicant then initiates authentication by sending an EAPoL-Start frame. The authenticator responds with an EAP-Request Identity, to which the supplicant replies with an EAP-Response Identity containing its identity (e.g., username). The authenticator encapsulates this into a RADIUS Access-Request packet and sends it to the authentication server. The server then challenges the supplicant via the authenticator, using a specific EAP method (e.g., EAP-TLS, PEAP, EAP-FAST). The supplicant and server exchange multiple EAP messages (each encapsulated in RADIUS) until the server either accepts or rejects. If accepted, the server sends a RADIUS Access-Accept, and the authenticator transitions the port to an "authorized" state, allowing normal traffic. If rejected, the port remains unauthorized.

- EAPoL-Start (code 0x01) – sent by supplicant to initiate. - EAPoL-Logoff (code 0x02) – sent by supplicant to terminate session. - EAPoL-Key (code 0x03) – used for key management (e.g., in wireless). - EAPoL-Encapsulated-ASF-Alert (code 0x04) – for alerts. - RADIUS ports: authentication uses UDP 1812 (or 1645 legacy), accounting uses UDP 1813 (or 1646 legacy). - Default timers on Cisco switches: - dot1x timeout tx-period – default 30 seconds (time between retransmission of EAP-Request Identity if no response). - dot1x timeout supp-timeout – default 30 seconds (time to wait for supplicant response to EAP request). - dot1x timeout server-timeout – default 30 seconds (time to wait for RADIUS server response). - dot1x max-reauth-req – default 2 (max number of reauthentication attempts). - Reauthentication: Enabled by default on many switches, with a default period of 3600 seconds (1 hour). - Port states: - Unauthorized: Port blocks all traffic except EAPoL frames. - Authorized: Port allows normal traffic. - Force-authorized: Port always allows traffic (disables 802.1X). - Force-unauthorized: Port always blocks traffic (ignores authentication).

To enable 802.1X on a switch port:

interface GigabitEthernet0/1
 switchport mode access
 authentication port-control auto   ! Enables 802.1X (auto = authenticate)
 dot1x pae authenticator            ! Sets port as authenticator
 dot1x timeout tx-period 10         ! Optional: reduce retransmit timeout

Global RADIUS server configuration:

radius server RAD-SERVER
 address ipv4 192.168.1.100 auth-port 1812 acct-port 1813
 key MySecretKey

Enable AAA authentication for 802.1X:

aaa new-model
aaa authentication dot1x default group radius

Verification commands:

show dot1x all                 ! Summary of all 802.1X interfaces
show dot1x interface gigabitethernet0/1 detail   ! Detailed status
show authentication sessions   ! Active authenticated sessions
show radius server statistics  ! RADIUS server stats

A large enterprise with 10,000 employees uses 802.1X on all access switches to enforce that only company-issued laptops can connect to the internal network. The IT department issues certificates to all laptops via Active Directory Certificate Services. When a laptop is plugged into a cubicle port, the switch (Cisco Catalyst 9300) acts as the authenticator. The laptop's built-in Windows supplicant initiates EAP-TLS authentication. The RADIUS server (Microsoft NPS) validates the laptop's certificate against the CA. If valid, the server returns a VLAN assignment (e.g., VLAN 10 for employees). If a rogue device is plugged in, it cannot authenticate, and the port remains in an unauthorized state. A common issue is misconfigured supplicant settings—if the user selects the wrong EAP method, authentication fails. The network team uses show authentication sessions to troubleshoot failed attempts. Performance is generally not an issue; each authentication takes less than a second. However, during a power outage, many devices reconnecting simultaneously can cause RADIUS server load spikes. To mitigate, the team uses a RADIUS load balancer and sets a reauthentication interval of 12 hours.

A university campus deploys 802.1X for its Wi-Fi network (WPA2-Enterprise). Students and staff authenticate using their university credentials via PEAP-MSCHAPv2. The wireless controllers (Cisco 9800) act as authenticators, forwarding EAP messages to a Cisco ISE server. Each user is placed into a dynamic VLAN based on their role: students get a restricted VLAN with internet-only access, while faculty get full network access. A common problem is that some older devices do not support PEAP; the IT team enables a separate SSID with WPA2-PSK for legacy devices, but this is a security compromise. To improve user experience, the team implements EAP-FAST with anonymous provisioning. The wireless infrastructure must handle thousands of simultaneous authentications during peak hours. The team monitors RADIUS server performance and uses per-AP client limits to prevent overload.

A hospital uses 802.1X for all wired ports, but many medical devices (e.g., infusion pumps, patient monitors) do not support 802.1X. The network team configures MAB as a fallback. When a device connects, the switch first attempts 802.1X. If no EAPoL-Start is received within the tx-period, the switch sends the device's MAC address as a RADIUS Access-Request with username and password both set to the MAC. The RADIUS server checks if the MAC is in an allowed list. If yes, it returns an Access-Accept; if no, the port is blocked. This allows non-802.1X devices to be authenticated by MAC address, but it is less secure because MAC addresses can be spoofed. The team mitigates by using port security in conjunction with MAB. A common misconfiguration is forgetting to add the MAC address to the RADIUS server, causing the device to fail authentication and be placed in a guest VLAN with no access to critical systems.