Port security asks "is this the right MAC?" — which a laptop can spoof in seconds. 802.1X asks "who are you, and can you prove it?" before the port forwards a single frame. Real identity-based access control at the wall socket, with RADIUS, MAB fallback for printers, and a rollout that won't lock out the office.
The Switch Security post hardened the access layer with port security — but MAC addresses are trivially spoofed, so that's a speed bump, not a lock. 802.1X is the lock: before a port will forward anything but authentication traffic, the connected device must prove an identity — a certificate or username/password checked against a central server. Fail, and the port stays shut (or drops you in a quarantine VLAN). It's the difference between "the network trusts whoever plugs in" and "the network trusts whoever it can authenticate."
Three roles make it work: the supplicant (the device's 802.1X client), the authenticator (the switch, which relays but never decides), and the authentication server (RADIUS — Cisco ISE in enterprises, FreeRADIUS for the SMB budgets we usually work with). We'll wire all three, add MAB so printers and cameras that can't do 802.1X still get on, use dynamic VLAN assignment so identity decides which VLAN you land in, and — most importantly — roll it out in monitor mode first so you don't lock out the whole office on day one.
01
First, global AAA: tell the switch to use RADIUS for 802.1X, define the server, and enable dot1x system-wide. Nothing authenticates until this scaffolding exists.
SW1(config)# aaa new-model # The RADIUS server (modern "radius server" block) SW1(config)# radius server RAD-1 SW1(config-radius-server)# address ipv4 192.168.1.60 auth-port 1812 acct-port 1813 SW1(config-radius-server)# key R@dius-Shared-Secret SW1(config-radius-server)# exit # Use RADIUS for 802.1X auth and accounting SW1(config)# aaa authentication dot1x default group radius SW1(config)# aaa authorization network default group radius # for dynamic VLAN SW1(config)# aaa accounting dot1x default start-stop group radius # Turn on 802.1X globally, and let RADIUS push VLAN/ACL attributes SW1(config)# dot1x system-auth-control SW1(config)# end SW1# show radius server-group all # confirm the server is reachable
The moment you type aaa new-model, IOS switches to the AAA method for all logins — including your own console and VTY. If you haven't defined a fallback, you can lock yourself out. Before enabling it, ensure a local login path survives: aaa authentication login default group radius local (RADIUS, then local user as fallback) plus a username admin privilege 15 secret … that exists on the box. Test the SSH/console login in a second session before you disconnect the first. This is the same "don't strand yourself" discipline as the ZBF and password-recovery posts.
02
The cardinal rule of NAC deployment: never go straight to enforcement. Open (monitor) mode authenticates and logs, but lets everyone on regardless — so you find the devices that fail before they generate help-desk tickets.
SW1(config)# interface range GigabitEthernet0/2 - 24 SW1(config-if-range)# switchport mode access SW1(config-if-range)# authentication port-control auto SW1(config-if-range)# authentication open # MONITOR: auth, but allow all SW1(config-if-range)# dot1x pae authenticator SW1(config-if-range)# end # Watch who authenticates and who fails — WITHOUT blocking anyone yet SW1# show authentication sessions interface Gi0/4 details Interface: GigabitEthernet0/4 MAC Address: 001a.2b3c.4d5e Status: Authorized ← 802.1X success Method: dot1x # When the logs show everyone authenticating cleanly, remove # "authentication open" to switch to ENFORCEMENT (closed mode).
03
Printers, cameras, badge readers, and old kit have no 802.1X supplicant. MAC Authentication Bypass lets the switch fall back to checking their MAC against RADIUS after 802.1X times out — a managed allow-list, not open access.
SW1(config)# interface GigabitEthernet0/10 SW1(config-if)# switchport mode access SW1(config-if)# authentication port-control auto # Try 802.1X first; if the device is silent, fall back to MAB SW1(config-if)# authentication order dot1x mab SW1(config-if)# authentication priority dot1x mab SW1(config-if)# mab SW1(config-if)# dot1x pae authenticator SW1(config-if)# dot1x timeout tx-period 7 # how long to wait for a supplicant SW1(config-if)# end # The printer's MAC must exist as a user in RADIUS. It's an allow-list you # manage centrally — far better than static port-security MACs on 200 ports.
MAB authenticates by MAC address, which is spoofable — so it's a convenience for dumb devices, not real security. Contain the risk: put MAB-authenticated devices in a restricted VLAN with an ACL that permits only what they need (a printer reaches the print server and nothing else), and use RADIUS device profiling where available so a "printer" MAC that suddenly acts like a laptop gets flagged. The goal is that even if someone clones a printer's MAC, the network they inherit is a dead end. This is defense-in-depth layered on top of the DHCP-snooping/DAI work from the Switch Security post.
04
Identity can decide placement: RADIUS returns a VLAN in its Access-Accept, so staff land in staff VLAN and contractors in a restricted one — from the same port. And every failure mode needs a defined destination, never "wide open."
# RADIUS pushes the success VLAN automatically via the Tunnel-* attributes # (aaa authorization network, set in section 01). For the failure paths: SW1(config)# interface GigabitEthernet0/4 # Authenticated but REJECTED → restricted/quarantine VLAN 900 SW1(config-if)# authentication event fail action authorize vlan 900 # No supplicant AND MAB failed → guest VLAN 800 SW1(config-if)# dot1x auth-fail vlan 900 SW1(config-if)# authentication event no-response action authorize vlan 800 # RADIUS server unreachable → critical VLAN (fail-OPEN to keep working) SW1(config-if)# authentication event server dead action authorize vlan 10 SW1(config-if)# authentication event server alive action reinitialize SW1(config-if)# end
What happens when the RADIUS server dies? Without a critical VLAN (server dead action), every port on every switch that can't reach RADIUS goes closed — a RADIUS outage becomes a total network outage, which is a catastrophic single point of failure. The usual choice is fail-open: if the auth server is unreachable, drop clients into a working VLAN so the business keeps running, and re-authenticate when RADIUS returns (server alive … reinitialize). Security purists prefer fail-closed; for an SMB, an auth-server hiccup taking down the whole office is almost never the right trade. Make the choice consciously and document it — auditors ask.
05
One command shows every port's auth state, method, and assigned VLAN. When a device won't authenticate, the failure is at the supplicant, the switch relay, or RADIUS — these isolate which.
| Command | Shows |
|---|---|
| show authentication sessions | Every authenticating port: MAC, method (dot1x/mab), status, VLAN. |
| show authentication sessions interface Gi0/4 details | The full story for one port — why it's authorized or not. |
| show dot1x interface Gi0/4 details | 802.1X state machine and EAP exchange detail. |
| show radius statistics | Are requests reaching RADIUS and getting answered? |
| test aaa group radius user pass new-code | Prove the switch↔RADIUS path and shared secret work. |
| debug dot1x all / debug radius | Live EAP/RADIUS trace for a stubborn port (turn off after). |
Localize before you dig: if show radius statistics shows requests but no responses, it's the shared secret or server config (the switch and RADIUS disagree on the key, or the switch's IP isn't a defined client on the RADIUS side). If requests get an Access-Reject, it's credentials/policy on RADIUS. If nothing reaches RADIUS at all, it's reachability (routing/ACL to the server). And if the supplicant never starts, it's the client — 802.1X disabled on the NIC, or wrong EAP method. test aaa is the fastest way to cut the problem in half: it proves the switch↔RADIUS leg independently of any real device.
06
802.1X is powerful and operationally heavy. Know when it's worth it and when the lighter access-layer controls are enough.
| Control | Strength / cost |
|---|---|
| Port security (sticky MAC) | Cheap, MAC-spoofable. Good baseline everywhere. |
| MAB | Central MAC allow-list, still spoofable. For dumb devices. |
| 802.1X (user/machine cert) | Real identity, strong. Needs RADIUS + supplicants + operational care. |
Full 802.1X shines where a wrong device on the LAN is a real risk — clinics, finance, anywhere with compliance — and where there's someone to run the RADIUS side. For a small hotel or shop, the combination of VLAN segmentation + DHCP snooping + DAI + port security + a locked-down guest network (the Switch Security post) delivers most of the benefit at a fraction of the operational weight. We deploy 802.1X when the threat model and the staffing both justify it, and we're upfront when it doesn't — a NAC that nobody maintains fails open and gives false confidence, which is worse than not having it.
Takeaways
authentication open to enforce. Never flip straight to closed.aaa new-model changes login for everyone — keep a local fallback and a real username, and test it in a second session.NOCTIS deploys 802.1X with RADIUS — staged in monitor mode, MAB for legacy devices, sane failure paths — where the threat model justifies it, and honest, lighter segmentation where it doesn't. Either way, documented and maintainable.
Book a Discovery Call →