How does 802.1X port-based authentication work?

IEEE 802.1X is a port-based network access control protocol that authenticates devices before granting network access.

Components

• Supplicant: Client device seeking access
• Authenticator: The switch enforcing authentication
• Authentication Server: RADIUS or TACACS+ server

Authentication Flow

1. Client connects to port; port is in unauthorized state
2. Switch sends EAPOL-Request-Identity
3. Client responds with identity (username, certificate)
4. Switch relays credentials to RADIUS server
5. RADIUS server authenticates and replies
6. On success, switch opens port for normal traffic

EAP Methods

• EAP-TLS: Certificate-based (most secure)
• PEAP: Username/password inside TLS tunnel
• EAP-TTLS: Similar to PEAP
• EAP-MD5: Legacy, insecure

Deployment Modes

• Single-host: Only one device per port
• Multi-host: Multiple devices, one authenticates
• Multi-domain: Voice + data device separately
• Multi-auth: Each device independently authenticated

Fallback Mechanisms

• MAC Authentication Bypass (MAB): For devices that can't do 802.1X (printers, cameras)
• Guest VLAN: Limited access on failed auth
• Auth-Fail VLAN: Different network for failures

Considerations for Industrial

• Legacy PLCs often lack 802.1X support — use MAB with MAC binding
• Radius server availability is critical — deploy redundantly
• Certificate management can be complex for many devices
• Test failure modes carefully in OT environments