On this page
The three rolesEAP methods: PEAP-MSCHAPv2 and EAP-TLSMAC authentication bypass, guest and restricted VLANsDynamic VLAN assignmentSingle-host versus multi-host modesDeployment orderFoundry heritageQuestions01 /The three roles
802.1X splits authentication across three parties. The supplicant is software on the end device, built into every mainstream desktop and phone operating system and most IP phones, that holds the credential. The authenticator is the switch or wireless access point; it owns the port, blocks everything except EAPOL frames until authentication succeeds, and never sees the credential itself. The authentication server is a RADIUS server that validates the credential against a directory and tells the authenticator whether to open the port and with what attributes.
Between supplicant and switch the messages travel as EAPOL (EAP over LAN, EtherType 0x888E), which needs no IP address. Between switch and server the same EAP payload is wrapped in RADIUS Access-Request and Access-Challenge packets over UDP. The switch authenticates itself to the RADIUS server with a shared secret.
02 /EAP methods: PEAP-MSCHAPv2 and EAP-TLS
EAP is a framework; the method inside it does the cryptography. Two dominate wired deployments.
| Method | Credential | Requirements | Trade-off |
|---|---|---|---|
| PEAP-MSCHAPv2 | Username and password inside a TLS tunnel | Server certificate; directory with NT hashes | Easy to deploy; passwords exposed if clients skip server validation |
| EAP-TLS | Client certificate | PKI issuing a certificate to every device | Strongest; the PKI and enrolment are the work |
| EAP-TTLS | Password inside TLS, flexible inner methods | Server certificate | Common on non-Windows clients |
A supplicant that does not validate the RADIUS server certificate will hand its password hash to any rogue switch or access point claiming the right network. Push the trusted CA and the expected server name to clients through management tooling before enforcing 802.1X.
03 /MAC authentication bypass, guest and restricted VLANs
Printers, badge readers, cameras and older IP phones have no supplicant. MAC authentication bypass (MAB) lets the switch, after EAPOL times out, send the device MAC address to RADIUS as both username and password. The server checks it against an allowed list and returns the usual attributes. MAB is weak, since MAC addresses are trivially spoofed, so the assigned VLAN should be tightly filtered.
Two more fallbacks handle failure. A guest VLAN receives devices that never respond to EAPOL at all: visitors, unmanaged laptops. A restricted VLAN receives devices that tried and failed, giving them enough access to reach remediation or a help page without joining the production network.
04 /Dynamic VLAN assignment
The RADIUS Access-Accept can carry three attributes defined in RFC 3580: Tunnel-Type (VLAN), Tunnel-Medium-Type (802) and Tunnel-Private-Group-ID (the VLAN ID or name). The switch moves the port into that VLAN for the session. Policy moves with the user rather than with the patch panel: finance staff land in the finance VLAN at any desk. Vendor-specific attributes can also return an ACL name or a bandwidth limit.
05 /Single-host versus multi-host modes
In single-host mode one MAC address may use the port after authentication; a second MAC triggers a violation. This is correct for a desk with one PC. Multi-host mode opens the port for every MAC once any one device authenticates, which is convenient behind a small unmanaged switch and insecure for the same reason. Multi-auth or per-client modes authenticate each MAC independently and are the right choice for an IP phone with a PC behind it, combined with a voice VLAN on a PoE port.
06 /Deployment order
- Stand up RADIUS against the directory and test with a handful of clients on a lab switch.
- Enable 802.1X in monitor (open) mode on production access ports: authentication runs and logs, but failures are not enforced.
- Review the logs for a few weeks. Build the MAB list from the devices that never authenticate. Fix supplicant configuration on the rest.
- Enable enforcement one closet at a time, with the guest and restricted VLANs in place and the helpdesk briefed.
- Add BPDU guard and edge port settings on the same ports; 802.1X and spanning tree protections belong together.
07 /Foundry heritage
Foundry published an 802.1X port authentication application note for FastIron and EdgeIron switches, along with whitepapers on 802.1X with Active Directory and on MAC authentication using Microsoft Internet Authentication Service (IAS), the RADIUS server bundled with Windows Server 2003. Those documents were widely linked from university IT pages during the mid-2000s campus rollouts of port authentication. The IronWare shape was a RADIUS server definition, a global enable, and per-port enablement.
radius-server host 10.0.0.5 auth-port 1812 acct-port 1813 default key SECRET aaa authentication dot1x default radius dot1x-enable enable ethernet 1/1 to 1/24 ! show dot1x show dot1x mac-session
08 /Questions
Does 802.1X work without Active Directory?
Yes. Any RADIUS server with a user store works: a local file, LDAP, a SQL database or a certificate authority for EAP-TLS. Active Directory is common because Windows clients are pre-configured for PEAP-MSCHAPv2 against it.
What happens to a printer that cannot do 802.1X?
The switch waits for EAPOL, times out, and falls back to MAC authentication bypass, sending the printer MAC to RADIUS. If the MAC is on the allowed list, the port opens in the printer VLAN. If not, the device lands in the guest VLAN or stays blocked.
Is 802.1X the same as NAC?
802.1X is the port authentication mechanism. Network access control (NAC) is the broader system that decides policy, often adding posture checks, device profiling and central logging on top of 802.1X and MAB.
Can a user swap an authenticated PC for another device?
In single-host mode the switch detects link down and closes the port, so the new device must authenticate. The risk is a hub or unmanaged switch that keeps link up while devices swap behind it; multi-auth mode and re-authentication timers address that.
What was Microsoft IAS?
Internet Authentication Service was the RADIUS server shipped with Windows Server 2000 and 2003. It authenticated against Active Directory and was the usual back end for 802.1X in that era. Network Policy Server replaced it in Windows Server 2008.
Sources
- IEEE Std 802.1X-2004 and 802.1X-2010, Port-Based Network Access Control
- IETF RFC 3748, Extensible Authentication Protocol (EAP), 2004
- IETF RFC 3580, IEEE 802.1X Remote Authentication Dial In User Service (RADIUS) Usage Guidelines, 2003
- IETF RFC 5216, The EAP-TLS Authentication Protocol, 2008
- Foundry Networks, 802.1X port authentication application note and IAS/Active Directory whitepapers (original Foundry documentation, historical, around 2004 to 2006)