802.1X

Why it exists

Access ports need a proof of identity before forwarding. Shared VLAN membership alone is not admission control. IEEE 802.1X-2020 §1

802.1X authenticates; it does not encrypt the port. MACsec (802.1AE) is a separate hop-by-hop cipher often paired with it. IEEE 802.1X-2020 §1

EAPoL start to authorized port

The switch is an authenticator. It relays EAP between the supplicant and a RADIUS server; credentials are usually opaque to the switch.

How it works

Supplicant and authenticator exchange EAPoL on the wire. The authenticator relays EAP to an authentication server, commonly via RADIUS. IEEE 802.1X-2020 §1

Access-Accept may assign VLAN or filter attributes. If the switch rejects or cannot apply them, the port may fall back to its static VLAN while still looking “successful”. RFC 2865 §4.2Access-AcceptRFC 2865 · DRAFT STANDARD · June 2000

MAB is a MAC-as-identity fallback for endpoints without a supplicant. It is weaker and must be ordered after 802.1X. Cisco IOS XE — Configuring IEEE 802.1X Port-Based Authentication §MAC Authentication Bypass

On the wire

Constructed examples, encoded from the field table below them — not captured traffic.

Configure it

When it breaks

Symptom first, because that is what you have when it happens.

1. A device with no supplicant is left without network access, and nothing in the logs explains why.

   Narrow it down

   1. Check whether the port is waiting for an EAPOL response that will never come.
   2. Confirm whether MAC authentication bypass is configured as a fallback.
   3. Look at the order and priority of the authentication methods on the port.

   Cause

   Printers, cameras and older equipment have no supplicant. The port times out waiting for one and, without a fallback, denies access — correctly, and unhelpfully.

   Fix

   Configure MAC authentication bypass after dot1x. It is weaker, because a MAC address is trivially spoofed, and it is the difference between a policy that can be deployed and one that cannot.

   Cisco IOS XE — Configuring IEEE 802.1X Port-Based Authentication §MAC Authentication Bypass

2. Authentication succeeds and the device lands in the wrong VLAN.

   Narrow it down

   1. Check which attributes the authentication server returns.
   2. Confirm the switch is configured to accept a dynamic VLAN assignment.
   3. Look at whether the VLAN named in the attribute exists on the switch.

   Cause

   The VLAN comes from the server, and if the switch is not accepting the assignment or the VLAN does not exist locally, the port falls back to its statically configured VLAN — which looks like success.

   Fix

   Verify the attributes on the wire and confirm the VLAN exists everywhere the device might connect.

   RFC 2865 §4.2Access-AcceptRFC 2865 · DRAFT STANDARD · June 2000

3. Devices behind an IP phone lose access when the phone reboots, or gain access they should not have.

   Narrow it down

   1. Check the host mode on the port — single, multi-domain, or multi-host.
   2. Confirm whether the phone and the PC authenticate separately.
   3. Look at what happens to the PC session when the phone drops.

   Cause

   Multi-host authenticates one device and opens the port for everyone behind it. Multi-domain authenticates a voice device and a data device separately, which is what a phone with a PC behind it actually needs.

   Fix

   Use multi-domain on ports with phones. Multi-host is the mode that authenticates one device and trusts whatever else appears.

   Cisco IOS XE — Configuring IEEE 802.1X Port-Based Authentication §Host Mode

4. All access ports fail closed when RADIUS is unreachable.

   Narrow it down

   1. Check AAA method lists and critical/inaccessible VLAN policies.
   2. Confirm server reachability from the switch source address.

   Cause

   Without a deliberate inaccessible-auth or critical VLAN policy, authenticator failure denies the port.

   Fix

   Design and test inaccessible authentication behavior; do not discover it during an AAA outage.

   Cisco IOS XE — Configuring IEEE 802.1X Port-Based Authentication §Inaccessible Authentication Bypass

5. Failed authentications still get full network access.

   Narrow it down

   1. Inspect guest / auth-fail VLAN configuration.
   2. Compare intended fail-closed policy with the applied VLAN and ACL.

   Cause

   An auth-fail or guest VLAN was configured as a broad permit rather than a restricted holding area.

   Fix

   Treat guest/fail VLANs as limited policy, not open access, unless that is the explicit design.

   Cisco IOS XE — Configuring IEEE 802.1X Port-Based Authentication §Guest VLAN

Design notes

Multi-host is not “phone friendly” — it is “trust everything after one success”.

Failed sessions should fail closed. Guest VLAN is a policy choice, not a requirement of the standard.

Misconceptions

“802.1X encrypts the traffic on the port.”

It authenticates before allowing traffic and encrypts nothing. Encryption on a wired port is MACsec, which is a separate standard often deployed alongside it. IEEE 802.1X-2020 §1

“The switch checks the credentials.”

The switch is an authenticator and relays EAP between the supplicant and the authentication server. It usually cannot read the credentials at all — the EAP method is negotiated end to end between the device and the server. IEEE 802.1X-2020 §1

“MAC authentication bypass is a reasonable substitute.”

A MAC address is asserted by the device and trivially changed. It is a fallback for equipment that cannot do better, not an equivalent, and a port that falls back to it accepts anything that can read a label off a printer. Cisco IOS XE — Configuring IEEE 802.1X Port-Based Authentication §MAC Authentication Bypass

More walkthroughs

Check yourself

• A printer with no supplicant is denied access. What is the intended fallback?

  • Open the port
  • MAC authentication bypass, ordered after dot1x
  • A static VLAN
  • Web authentication
• What role does the switch play in the exchange?

  • It validates the credentials
  • It is an authenticator relaying EAP between the device and the server, usually unable to read the credentials
  • It issues certificates
  • It assigns the VLAN independently
• A phone with a PC behind it needs which host mode?

  • Single host
  • Multi-domain, so voice and data authenticate separately
  • Multi-host
  • Open
• Does 802.1X encrypt traffic on the port?

  • Yes, after authentication
  • No — that is MACsec, a separate standard
  • Only broadcast frames
  • Only EAPoL
• Authentication succeeds but the host is in the wrong VLAN. What should you check?

  • Only STP root priority
  • Returned RADIUS attributes and whether the switch applies dynamic VLAN
  • NTP stratum
  • OSPF area ID
• What carries EAP between the supplicant and the authenticator on the wire?

  • EAPoL Ethernet frames
  • Only UDP 1812
  • BGP UPDATEs
  • ICMP redirects
• How does MACsec relate to 802.1X?

  • It is implied by every Access-Accept
  • It is a separate hop-by-hop cipher often deployed alongside 802.1X
  • It replaces RADIUS
  • It is another name for MAB
• Why order 802.1X before MAB?

  • So capable devices prove EAP identity before a spoofable MAC is accepted
  • Because MAB is faster
  • Because RADIUS requires it
  • Because EAPoL cannot carry VLAN

Related

• RADIUS

  Central AAA carried as attributes over UDP, with authorization largely folded into the access response.

• VLANs

  Splits one physical switched network into several independent broadcast domains, and carries them over a shared link with a four-octet tag.

• Port security

  Limits which source MAC addresses may use an access port, and builds a DHCP binding table so untrusted ports cannot answer as servers.