802.1X

networkingsecurity

Stands for: IEEE 802.1X (port-based network access control)

Port-based network access control - the IEEE standard that makes a switch port or access point authenticate before it forwards traffic.

802.1X frames the handshake: a supplicant (the device), an authenticator (the switch or AP), and an authentication server (usually RADIUS) exchange EAP over LAN until the port opens or stays closed. It is the enforcement layer under enterprise Wi-Fi (WPA2/WPA3-Enterprise) and wired NAC, and pairs naturally with 802.1Q to place authenticated devices into the right VLAN.

802.1X authenticates a device before its switch port or wireless association carries any traffic, using EAP to carry the exchange between the supplicant, the switch and a RADIUS server. It moves access control from a physical assumption to an identity check.

The consequence people underestimate is that everything must be enrolled. Printers, cameras, badge readers, lab equipment and anything without a supplicant need MAC bypass or a dedicated policy, and the exceptions accumulate until they are the actual policy. Deployments succeed when they start in monitor mode long enough to discover what is on the network, which is usually more and stranger than the inventory suggests.

Also known as: 802.1x, dot1x, port-based nac, eapol

← All glossary entries