802.1X
acronymStands for: IEEE 802.1X (port-based network access control)
Port-based network access control - the IEEE standard that makes a switch port or access point authenticate before it forwards traffic.
802.1X frames the handshake: a supplicant (the device), an authenticator (the switch or AP), and an authentication server (usually RADIUS) exchange EAP over LAN until the port opens or stays closed. The standard defines that carriage, EAPOL, for wired 802 networks and for 802.11; the authenticator periodically invites a supplicant with an EAP-Request Identity sent to the multicast address 01:80:C2:00:00:03, the supplicant answers with its identity, and from there the switch relays EAP packets to the server inside RADIUS EAP-Message attributes and acts only on the final accept or reject. It is the enforcement layer under enterprise Wi-Fi (WPA2/WPA3-Enterprise) and wired NAC, and pairs naturally with 802.1Q to place authenticated devices into the right VLAN: RFC 3580 specifies the three tunnel attributes a server returns for that, Tunnel-Type VLAN (13), Tunnel-Medium-Type 802 (6) and Tunnel-Private-Group-ID carrying the VLAN number as a string. The method inside the EAP envelope is a separate decision, and the fallbacks for devices without a supplicant, MAB and web authentication, are separate mechanisms that the same port can be configured to try in order.
802.1X authenticates a device before its switch port or wireless association carries any traffic, using EAP to carry the exchange between the supplicant, the switch and a RADIUS server. It moves access control from a physical assumption to an identity check. The standard, part of the IEEE 802.1 family, is described in the encyclopaedia article as "an IEEE Standard for port-based network access control", and its history is short enough to tell: 802.1X-2001 defined the mechanism for Ethernet, Token Ring and FDDI; 802.1X-2004 extended it to 802.11 wireless and added supplicant-side port entities; 802.1X-2010 revised EAPOL to work with 802.1AE MACsec link encryption and 802.1AR device identity certificates. The problem it addressed is sometimes called hardware addition, the plugging of an unauthorised device into a live port, and the article recalls a 2005 incident at a large retailer as the kind of event the standard exists to prevent.
The model has three parties and two ports. The supplicant is the software on the device asking for access; the authenticator is the switch or access point whose port the device is on; the authentication server, typically a RADIUS server speaking EAP, decides. The article puts it in one line: "The authenticator acts like a security guard". On the authenticator, 802.1X-2001 defines a controlled port, which forwards traffic only after authentication, and an uncontrolled port, which always passes the EAPOL frames the authentication itself needs, with a Port Access Entity managing the state. Initiation is simple: the authenticator periodically sends an EAP-Request Identity frame to the group address 01:80:C2:00:00:03, the supplicant answers with an EAP-Response Identity, the authenticator wraps that in a RADIUS Access-Request, and the server replies in an Access-Challenge that proposes the EAP method. From then on the switch relays EAP packets it does not interpret, encapsulated per RFC 3579 in EAP-Message attributes (79) protected by a Message-Authenticator (80), and acts on the final Access-Accept or Access-Reject.
The consequence people underestimate is the shift in what a port means. Without 802.1X, a live wall jack is a trust decision made by whoever ran the cable, and a conference room, a lobby and a printer alcove are all inside the perimeter. With it, the port is nothing until an identity is presented, and the server's answer can carry policy: RFC 3580, the IEEE 802.1X RADIUS Usage Guidelines of September 2003 by Congdon, Aboba, Smith, Zorn and Roese, specifies the attributes that make the port behave. VLAN assignment uses three of them together, Tunnel-Type set to VLAN (13), Tunnel-Medium-Type set to 802 (6) and Tunnel-Private-Group-ID carrying the VLAN identifier as a string, so that the same physical port lands a finance laptop and a visitor's phone in different networks. NAS-Port-Type tells the server whether the request came from Ethernet (15) or Wireless-IEEE 802.11 (19); Calling-Station-Id carries the device's MAC address in upper-case hexadecimal with hyphens, and Called-Station-Id carries the port or access point's MAC with the SSID appended after a colon on wireless; Session-Timeout with Termination-Action set to RADIUS-Request tells the port how many seconds to allow before re-authenticating. Every one of these is a knob a policy engine turns.
The standard's limits were documented early and are still true. The article records Steve Riley's 2005 analysis, drawing on research by Svyatoslav Pidgorny, of a man-in-the-middle attack in which an attacker shares an authenticated port through a hub after the legitimate device has authenticated, since the port, once open, does not re-check per frame; the suggested mitigation was IPsec, and the standard's later answer was 802.1X-2010's integration with MACsec, which encrypts and authenticates every frame on the link. EAPOL-Logoff frames travel in the clear and can be trivially spoofed to knock an authenticated device off a port. And the devices that cannot run a supplicant at all, printers, cameras, badge readers and the long tail of embedded things, need a fallback: MAC Authentication Bypass, in which the switch submits the MAC address as the credential, and web authentication, in which a browser login is forced, both of which the same port can be configured to try after 802.1X times out. Those fallbacks are where most real deployments spend their policy effort, and each has its own entry.
What 802.1X does not decide is the method inside the EAP envelope, and that decision carries most of the security. EAP-TLS with certificates on every device is the strongest and the most administration; TEAP chains machine and user proofs; PEAP and EAP-TTLS protect a password inside a TLS tunnel and are only as safe as the client's validation of the server's certificate; EAP-pwd needs no certificates at all. The article on 802.1X and the EAP methods lays the options side by side, and the RADIUS entry carries the other half of every conversation described here.
Also known as: 802.1x, dot1x, port-based nac, eapol, eap over lan, wpa2-enterprise, wpa3-enterprise
Sources
- IEEE 802.1 Working Group (official)
- Wikipedia, IEEE 802.1X: the 2001, 2004 and 2010 editions, EAPOL, the three parties, controlled and uncontrolled ports, the group address 01:80:C2:00:00:03, MAB, the 2005 Riley analysis of the hub man-in-the-middle and the spoofable EAPOL-Logoff (read 2026-10-06)
- RFC 3580, IEEE 802.1X RADIUS Usage Guidelines, Congdon (HP), Aboba (Microsoft), Smith, Zorn (Cisco), Roese, September 2003: VLAN assignment with Tunnel-Type 13, Tunnel-Medium-Type 6 and Tunnel-Private-Group-ID, NAS-Port-Type 15 and 19, the station identifier formats, Session-Timeout and Termination-Action (read 2026-10-06)
- RFC 3579, RADIUS Support For EAP, September 2003: the EAP-Message and Message-Authenticator attributes the switch relays the conversation in (read 2026-10-06)