Implements 802.1X port-based network access control using RADIUS authentication, PacketFence NAC, and switch configurations to enforce identity-based access policies, posture assessment, and automatic VLAN assignment for authorized devices.
Implements 802.1X port-based network access control using RADIUS authentication, PacketFence NAC, and switch configurations to enforce identity-based access policies, posture assessment, and automatic VLAN assignment for authorized devices.
Onboarding BYOD devices with automated provisioning and limited network access
Do not use as a standalone security solution without complementary controls, for networks with devices that do not support 802.1X supplicants, or without proper fallback mechanisms for critical infrastructure.
Common Misconfigurations & Verification
No critical-VLAN fallback = outage or open: without authentication event server dead action authorize vlan <x>, a FreeRADIUS outage drops every new device off the network (or, with open auth, lets them all on). Configure and test the dead-server path explicitly.
MAB MAC spoofing & stale entries: MAB authorizes on MAC alone, so a cloned printer MAC reaches the printer VLAN, and stale entries leave decommissioned devices authorized. Scope MAB to specific ports and reconcile the MAC list regularly.
Supplicant skips server-cert validation: PEAP clients configured without "Validate server certificate"/trusted root will auth to a rogue RADIUS, enabling credential theft. Push the corporate CA and enforce validation via GPO.
Host-mode too permissive:multi-host authorizes the whole port after one auth; use multi-auth on data ports and single-host where a single device is expected.
Verification:show authentication sessions interface Gi1/0/x should report Authorized with the role-correct Vlan Policy. Run the matrix: valid 802.1X → corporate VLAN, no supplicant → guest VLAN (40), bad creds → quarantine (999), RADIUS stopped → critical VLAN. Confirm with radtest user pass <radius> 0 <secret> returning Access-Accept plus the expected Tunnel-Private-Group-ID. A device that authorizes while FreeRADIUS is down — with no critical-VLAN rule — is failing open.
Prerequisites
RADIUS server (FreeRADIUS, Microsoft NPS, or Cisco ISE) configured with user/device authentication
# Windows Group Policy for 802.1X configuration# Computer Configuration > Policies > Windows Settings > Security Settings# > System Services > Wired AutoConfig: Automatic# > Network Policies:# Authentication method: Microsoft: Protected EAP (PEAP)# Inner method: EAP-MSCHAPv2# Trusted Root CA: Corporate CA# Linux 802.1X configuration with wpa_supplicantsudotee /etc/wpa_supplicant/wpa_supplicant-wired.conf << 'EOF'
ctrl_interface=/var/run/wpa_supplicant
ap_scan=0
network={
key_mgmt=IEEE8021X
eap=PEAP
identity="testuser@corp.example.com"
password="UserPassword123"
ca_cert="/etc/ssl/certs/corporate-ca.pem"
phase2="auth=MSCHAPV2"
}
EOF
# Start wpa_supplicant for wired 802.1Xsudo wpa_supplicant -i eth0 -D wired -c /etc/wpa_supplicant/wpa_supplicant-wired.conf -B
# Verify authentication status
wpa_cli -i eth0 status
# macOS: System Preferences > Network > Ethernet > 802.1X# Configure with PEAP and corporate credentials
Step 6: Test and Validate NAC Deployment
# Test 1: Authenticated device gets correct VLAN# Connect a corporate laptop with 802.1X configured# Verify VLAN assignment on the switch:# show authentication sessions interface Gi1/0/1# Expected:# Session ID: 0A0A0A01000000010001# Status: Authorized# Domain: DATA# Oper host mode: multi-auth# Oper control dir: both# Authorized By: Authentication Server# Vlan Policy: 10# Test 2: Unauthenticated device goes to guest VLAN# Connect a device without 802.1X supplicant# show authentication sessions interface Gi1/0/2# Expected: Vlan Policy: 40 (Guest)# Test 3: Failed authentication goes to quarantine# Attempt authentication with wrong credentials# Expected: Vlan Policy: 999 (Quarantine)# Test 4: RADIUS server failure - critical VLAN# Stop FreeRADIUS temporarily# Connect a new device# Expected: Vlan Policy: 10 (Critical/failover)# Test 5: MAC Authentication Bypass# Connect a printer (no supplicant)# MAB should authenticate based on MAC address in RADIUS# show authentication sessions interface Gi1/0/25# Generate authentication report# show authentication sessions | include Auth# show dot1x all summary
Key Concepts
Term
Definition
802.1X
IEEE standard for port-based network access control that authenticates devices before granting network access via EAP and RADIUS
RADIUS
Remote Authentication Dial-In User Service protocol used by network devices to authenticate users and receive authorization attributes (VLAN, ACL)
MAB (MAC Authentication Bypass)
Fallback authentication method that uses a device's MAC address as credentials for devices that cannot run an 802.1X supplicant
EAP-PEAP
Protected Extensible Authentication Protocol that wraps EAP in a TLS tunnel, commonly used with MSCHAPv2 for username/password authentication
Posture Assessment
Evaluation of endpoint compliance status (OS patches, antivirus, encryption) before granting full network access
Dynamic VLAN Assignment
RADIUS-driven automatic VLAN placement based on user identity, group membership, or device type, eliminating static port-based VLAN configuration
Tools & Systems
FreeRADIUS: Open-source RADIUS server supporting EAP-TLS, PEAP, LDAP integration, and dynamic VLAN assignment
Cisco ISE: Enterprise NAC platform with profiling, posture, guest management, and TrustSec integration
wpa_supplicant: Open-source 802.1X supplicant for Linux and embedded systems supporting EAP-TLS, PEAP, and TTLS
Microsoft NPS: Windows Server RADIUS implementation integrating natively with Active Directory for 802.1X authentication
Common Scenarios
Scenario: Deploying 802.1X NAC in a Hospital Network
Context: A hospital needs to enforce network access control to meet HIPAA requirements. The network includes clinical workstations (domain-joined), medical devices (no 802.1X support), physician BYOD devices, and guest WiFi. The deployment must not disrupt patient care if the RADIUS server becomes unavailable.
Approach:
Deploy FreeRADIUS integrated with Active Directory for user authentication and group-based VLAN assignment
Configure domain-joined workstations for EAP-PEAP via Group Policy with auto-enrollment
Register medical devices (infusion pumps, monitors) for MAB authentication using their MAC addresses in the RADIUS database
Configure switches with authentication order dot1x then mab, with critical VLAN fallback to the clinical VLAN if RADIUS is unreachable
Deploy PacketFence captive portal for physician BYOD onboarding with limited-access VLAN
Configure posture checks requiring Windows Update compliance and BitLocker encryption for full access
Test failover scenarios by stopping RADIUS and verifying devices remain on critical VLAN without disruption
Pitfalls:
Not configuring critical VLAN fallback, causing devices to lose network access when RADIUS is unavailable
MAB MAC address databases becoming stale as medical devices are replaced or moved
802.1X timeouts causing delays at workstation login, especially with slow RADIUS responses
Not testing multi-host mode on ports with IP phones and workstations daisy-chained
