Course contents

Chapter 12: Security FundamentalsLesson 11 of 18

802.1X port-based authentication

Supplicant, authenticator and RADIUS server, EAPOL, authorised and unauthorised ports, EAP methods and a basic configuration.

Intermediate · 10 min read

Technical definition

802.1X is an IEEE standard for port-based network access control. A device must authenticate to a server before the switch port or wireless association lets it send ordinary traffic.

Three roles

802.1X: three roles, two protocols
802.1X: three roles, two protocolsA supplicant (the device) talks EAPOL to the authenticator (the switch or access point). The authenticator relays the credentials to an authentication server, usually RADIUS, using RADIUS messages. Until the server accepts, the port allows only authentication traffic.SupplicantlaptopAuthenticatorswitch or APServerRADIUS (ISE, NPS)EAPOL (EAP over LAN)RADIUS (EAP inside)Port starts unauthorized: only EAPOL passesAccept: port becomes authorized, all traffic allowed
Before success the port passes only EAPOL. After success it opens fully, and the server can also assign a VLAN. This is port-based network access control.
The 802.1X roles and protocols
The 802.1X roles and protocolsRole; Device; What it does. Supplicant: Laptop, phone, printer Presents credentials using EAP Authenticator: Switch or wireless access point Blocks the port until the server decides; relays EAP Authentication server: RADIUS server such as Cisco ISE or Microsoft NPS Checks credentials and returns accept or rejectRoleDeviceWhat it doesSupplicantLaptop, phone, printerPresents credentials using EAPAuthenticatorSwitch or wireless access pointBlocks the port until the serverdecides; relays EAPAuthentication serverRADIUS server such as Cisco ISE orMicrosoft NPSChecks credentials and returns acceptor reject

On small screens, swipe sideways or focus the diagram and use the arrow keys.

EAPOL is the Layer 2 protocol between supplicant and switch. Between the switch and the server the same EAP data is carried inside RADIUS messages.

What happens when a device connects

  1. The link comes up. The port is unauthorised: it passes only EAPOL, and optionally CDP and STP.
  2. The switch sends an EAP request for the identity, or the supplicant starts with EAPOL-Start.
  3. The switch relays the EAP exchange to the RADIUS server.
  4. The server sends Access-Accept or Access-Reject.
  5. On accept the port becomes authorised. The server can also assign a VLAN or an ACL.

Common EAP methods

EAP methods at CCNA depth
EAP methods at CCNA depthMethod; Credential; Note. EAP-TLS: Client and server certificates Strongest; needs certificate management PEAP: Server certificate, user name and password inside a TLS tunnel Common in enterprises EAP-FAST: Protected access credential Cisco method that avoids certificatesMethodCredentialNoteEAP-TLSClient and server certificatesStrongest; needs certificatemanagementPEAPServer certificate, user name andpassword inside a TLS tunnelCommon in enterprisesEAP-FASTProtected access credentialCisco method that avoids certificates

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Know the idea of each method, not the details, for the CCNA.

Basic IOS configuration

This configuration was written from documentation and has not been run on a device. Commands vary by platform and software version.

aaa new-model aaa authentication dot1x default group radius dot1x system-auth-control radius server ISE1 address ipv4 192.0.2.50 auth-port 1812 acct-port 1813 key ExampleSharedKey interface GigabitEthernet0/5 switchport mode access authentication port-control auto dot1x pae authenticator

authentication port-control auto turns 802.1X on for the port. The server address and key are examples.

Example output · based on Cisco documentation; exact format varies by platform and software version
SW1#show dot1x all
Sysauthcontrol              Enabled
Dot1x Protocol Version      3

Dot1x Info for GigabitEthernet0/5
PAE                       = AUTHENTICATOR
PortControl               = AUTO
ReAuthentication          = Disabled
Example output. Use show authentication sessions to see whether a device is authorised and in which VLAN.

Test yourself

Predict · scenario 1

In 802.1X, which device blocks the port until authentication succeeds?

Predict · scenario 2

Which protocol carries EAP between the supplicant and the switch?

Predict · scenario 3

Before authentication succeeds, which traffic does an unauthorised 802.1X port normally pass?

FAQ

What is EAP?
The Extensible Authentication Protocol is a framework that carries the actual login exchange: a certificate (EAP-TLS), a password inside a tunnel (PEAP), and others. 802.1X is how EAP is carried between the device and the switch.
What happens to a device with no supplicant?
The port stays unauthorised. A network may use MAC authentication bypass to admit known devices such as printers by MAC address, or place them in a guest VLAN.
Is 802.1X for wireless too?
Yes. WPA2-Enterprise and WPA3-Enterprise use 802.1X, with the access point as the authenticator.