Support Library

802.1X Explained: Port-Based Access Control

IEEE 802.1X is the standard that keeps a switch port or Wi-Fi network closed until the connecting device proves who it is. The device talks EAP to the switch or access point, which relays it to a RADIUS server that decides whether to let it in.

Author
CategoryZero Trust & Network Access
Length9 minute read
UpdatedOctober 24, 2026

The short answer

Without 802.1X, anything plugged into a live wall jack gets an address and can start talking to the network. With 802.1X, the port only passes authentication traffic until the device has authenticated. The standard, currently IEEE 802.1X-2020, defines three roles:

RoleWhat it isWhat it does
SupplicantSoftware on the laptop, phone, printer or IP phonePresents credentials, usually a certificate or a username and password
AuthenticatorThe switch port or Wi-Fi access pointKeeps the port closed, relays the conversation, and applies the result
Authentication serverA RADIUS server, often part of a network access control (NAC) productChecks the credentials against a directory or certificate authority and returns accept or reject, plus policy

The same mechanism secures wired ports and WPA2-Enterprise or WPA3-Enterprise Wi-Fi. It is one of the main ways a network enforces Zero Trust policy at the point where a device first connects.

How a device authenticates, step by step

Two protocols carry the conversation. Between the device and the switch it is EAP over LAN (EAPOL), a Layer 2 protocol that works before the device has an IP address. Between the switch and the server it is RADIUS with EAP support. The switch is a relay: it never sees the password or private key inside the EAP method.

The 802.1X authentication exchange between supplicant, authenticator and authentication server The supplicant may send EAPOL-Start. The authenticator sends EAP-Request Identity and the supplicant answers with EAP-Response Identity, often an anonymous outer identity. The authenticator wraps that answer in a RADIUS Access-Request to the authentication server. The supplicant and the server then run the EAP method, such as EAP-TLS or PEAP, through several rounds, which the authenticator relays as EAPOL on one side and RADIUS Access-Challenge and Access-Request on the other. The server returns Access-Accept with VLAN, access list and key material, and the authenticator sends EAP-Success and authorizes the port. Before authentication only EAPOL frames pass. If the server rejects the device, it sends Access-Reject, the authenticator sends EAP-Failure, and the port stays closed or falls back to MAB or a guest VLAN if configured. Supplicant Laptop, phone or printer with an 802.1X client Authenticator Switch port or Wi-Fi access point Auth server RADIUS, backed by a directory or CA EAPOL · Layer 2 RADIUS · UDP 1812 EAPOL-Start Optional: the device asks to begin EAP-Request / Identity Who is connecting? EAP-Response / Identity Outer identity, often anonymous@example.com Access-Request (EAP-Message) The same EAP data, wrapped in RADIUS EAP method rounds: EAP-TLS, PEAP, EAP-TTLS or TEAP EAPOL frames Access-Challenge ⇄ Access-Request The switch only relays. The credential check is between the device and the server. Access-Accept Plus VLAN, access list and key material EAP-Success Wi-Fi then runs the 4-way key handshake Port authorized: normal traffic flows Before authentication Only EAPOL frames pass the port. DHCP, DNS and all other traffic is dropped. If the server rejects Access-Reject, then EAP-Failure. The port stays closed, or falls back to MAB or a guest VLAN. The 802.1X authentication exchange between device, switch and RADIUS server Seven steps. The device may send EAPOL-Start. The switch sends EAP-Request Identity, and the device answers with an outer identity. The switch wraps it in a RADIUS Access-Request to the server. The device and server run the EAP method through the switch. The server returns Access-Accept with VLAN, access list and keys, and the switch sends EAP-Success and opens the port. If the server rejects, it sends Access-Reject, the switch sends EAP-Failure, and the port stays closed or falls back to MAB or a guest VLAN. Device → Switch EAPOL-Start Optional: the device asks to begin Switch → Device EAP-Request/Identity The switch asks who is connecting Device → Switch EAP-Response/Identity An outer identity, often anonymous Switch → Server Access-Request The EAP message, wrapped in RADIUS Device ⇄ Server EAP method rounds A TLS handshake, relayed by the switch Server → Switch Access-Accept Plus VLAN, access list and key material Switch → Device EAP-Success The port opens and normal traffic flows If the server rejects Access-Reject, then EAP-Failure. The port stays closed or falls back to MAB or guest.
The authenticator relays EAP between the device and the server. Until the server accepts, the port passes nothing but EAPOL frames.

What "port-based" means

802.1X splits each port into two logical ports. The uncontrolled port always passes EAPOL frames, which use EtherType 0x888E. The controlled port carries everything else, and stays closed until authentication succeeds. On wired networks EAPOL frames are usually sent to the reserved multicast address 01-80-C2-00-00-03, which ordinary switches do not forward, so the conversation stays between the device and the port it is plugged into.

Real ports often carry more than one device. Switch vendors offer host modes for this, under names that vary by vendor:

  • Single host. One authenticated device per port; a second MAC address is treated as a violation.
  • Multi-domain. One data device and one voice device, such as a PC plugged into the back of an IP phone, each authenticated separately.
  • Multi-auth. Every MAC address on the port must authenticate on its own.
  • Multi-host. The first device authenticates and opens the port for every device behind it. This is the weakest mode, because anything plugged into a small switch behind an authenticated PC gets in too.

EAP methods: how the device proves itself

EAP is a framework, not a single method. The method decides what credential is used and how well it is protected. The common ones:

MethodDefined inCredentialNotes
EAP-TLSRFC 5216, with TLS 1.3 in RFC 9190Client certificate and private keyMutual certificate authentication, no password to phish or guess. The usual recommendation for managed devices; see Certificate-Based Authentication
PEAP with MS-CHAPv2Microsoft's [MS-PEAP] specificationUsername and password-derived MS-CHAPv2 challenge-response inside a TLS tunnelWidely supported, but only as safe as the device's check of the server certificate. MS-CHAPv2 itself is weak if captured
EAP-TTLSRFC 5281An inner method such as PAP, CHAP, MS-CHAP or EAP inside a TLS tunnelSimilar to PEAP; common with non-Windows clients and in eduroam
TEAPRFC 9930, which replaced RFC 7170Certificates or passwords, and can chain machine and userLets one session prove both the device and the signed-in user
Validate the server certificate

Without strict server validation, a rogue PEAP or EAP-TTLS server can capture authentication material. PEAP-MS-CHAPv2 exchanges password-derived challenge-response material; EAP-TTLS depends on the inner method and can send a literal password with PAP. Configure both trusted CA and expected server name in the supplicant profile, preferably through device management, instead of asking users to accept a prompt.

Password-based methods are getting harder to run on Windows. Credential Guard, which Microsoft turns on by default on many Windows 11 Enterprise and Education devices from version 22H2, blocks single sign-on with saved credentials for MS-CHAPv2-based methods. That is one more reason many organizations are moving managed devices to EAP-TLS.

What the server sends back

An Access-Accept can carry policy as well as a yes. RFC 3580 describes how RADIUS attributes are used with 802.1X:

AttributeEffect
Tunnel-Type = VLAN, Tunnel-Medium-Type = 802, Tunnel-Private-Group-IDDynamic VLAN assignment: puts the port in the VLAN named or numbered in the last attribute
Filter-Id or a vendor-specific access listApplies a named or downloaded access list to the session
Session-Timeout with Termination-Action = RADIUS-RequestRe-authenticates the device after the given number of seconds

Policy can also change after the device connects. With RADIUS Change of Authorization (CoA), the server can tell the switch to re-authenticate a session, move it to another VLAN or disconnect it, for example when an endpoint security tool reports that the device has been compromised. This is how a network gets the continuous re-evaluation that Zero Trust calls for.

802.1X on Wi-Fi

WPA2-Enterprise and WPA3-Enterprise are 802.1X on a wireless network. The access point is the authenticator, and the EAP method produces key material that the RADIUS server sends to the access point in the Access-Accept. The access point and device then run the 4-way handshake to derive encryption keys for that session.

The practical difference from a shared password (WPA2-Personal or WPA3-Personal) is that every user and device has its own credential and its own keys. Removing one person's access means disabling one account or revoking one certificate, not changing the password on every device. WPA3-Enterprise also has an optional 192-bit mode with stronger cryptographic suites for high-security networks.

Encrypting the wire with MACsec

802.1X on its own authenticates a device but does not encrypt wired traffic. Since the 2010 revision, 802.1X also defines the MACsec Key Agreement protocol (MKA), which uses the result of authentication to key IEEE 802.1AE MACsec. MACsec encrypts and integrity-protects each frame on the link between the device and the switch, which also stops an attacker from slipping a device in between an authenticated PC and its port. It needs MACsec support in both the switch and the device's network adapter, so it is more common between switches than at the access edge.

Rolling it out without locking people out

  1. Start in monitor mode. Most switch vendors offer a mode that runs 802.1X and logs the results but lets traffic through regardless. Run it until you know which devices pass, which fail, and why.
  2. Handle devices that cannot authenticate. Printers, cameras and building systems often have no supplicant. Use MAC Authentication Bypass with profiling for them, and give them a restricted VLAN or access list.
  3. Plan for the server being down. Decide what a port does when no RADIUS server answers. Many switches can put ports in a "critical" VLAN so that a server outage does not take the whole floor offline.
  4. Mind the timers. A switch waits for an answer to its identity requests before falling back to MAB. With some vendors' defaults that is about 90 seconds, long enough for a device to time out on DHCP. Shorter timers or running MAB first are common fixes.
  5. Move to enforcement in stages. A middle "low-impact" stage that allows DHCP, DNS and a few services before authentication is common. Closed mode, where only EAPOL passes until authentication, is the end goal.

Troubleshooting

SymptomLikely cause
Switch shows no EAPOL response from a Windows PCThe Wired AutoConfig service is not running or no wired profile is configured. Windows does not enable wired 802.1X by default
Device fails right after the server sends its certificateThe device does not trust the server's CA, the server name does not match the profile, or the device clock is wrong
Access-Reject for a device that should be allowedCheck the reject reason in the RADIUS server's log: expired or revoked certificate, unknown account, or a policy rule that did not match
Device authenticates but lands in the wrong VLANThe VLAN attributes are missing or misspelled, or the VLAN does not exist on that switch
Connections drop at regular intervalsRe-authentication is failing, often because a user password changed or a certificate expired

Useful commands for checking a session:

CommandWhereWhat it shows
netsh lan show interfacesWindows, wiredWhether 802.1X is enabled on the adapter and the last authentication result
netsh wlan show interfacesWindows, Wi-FiThe connected network, its authentication type and the radio state
wpa_cli statusLinux with wpa_supplicantThe EAP state, method and whether the port is authorized
show access-session interface Gi1/0/1 detailsCisco IOS XE switchWhich method succeeded, the user or MAC, and the VLAN and policy applied

FAQ

Is WPA2-Enterprise the same as 802.1X?

WPA2-Enterprise and WPA3-Enterprise are Wi-Fi security modes that use 802.1X for authentication. The 802.1X exchange proves who the device is, and the Wi-Fi 4-way handshake then turns the resulting key material into encryption keys for that session.

Does 802.1X encrypt traffic on a wired network?

No. On its own it only authenticates the device before the port opens. Wired encryption needs MACsec, which 802.1X can key through the MACsec Key Agreement protocol if both the switch and the device support it.

What happens to users if the RADIUS server goes down?

New connections cannot authenticate, and re-authentication of existing ones fails. Most deployments run at least two RADIUS servers and configure switches with a critical VLAN or similar fallback so that ports still work in a limited way during an outage.

Can someone bypass 802.1X by plugging in a small switch?

In multi-host mode, yes: one authenticated device opens the port for everything behind it. Single-host, multi-domain and multi-auth modes require each MAC address to authenticate, and MACsec goes further by encrypting the link so an inserted device cannot use the authenticated session.

Sources and further reading

Related support articles

Zero Trust Networking ExplainedRADIUS ExplainedCertificate-Based AuthenticationMAC Authentication Bypass (MAB)VLANs vs VXLAN OverlaysThe OSI and TCP/IP Models