What is 802.1X?

IEEE 802.1X is a port-based access control standard that authenticates a device before it can send traffic through a switch port or wireless access point. A supplicant on the endpoint offers credentials, an authenticator relays them, and an authentication server – usually RADIUS – decides whether to open the port and which VLAN to assign.

Key takeaways

• Authenticates devices before they reach a switch port or wireless network.
• Three roles: supplicant, authenticator, and authentication server.
• EAPOL carries credentials; RADIUS commonly validates them centrally.
• MAC Authentication Bypass (MAB) covers devices that can’t speak EAPOL.
• RADIUS can dynamically assign a VLAN once authentication succeeds.

On this page: Why it matters · How it works · Types · 802.1X & Versa · FAQ

Why is 802.1X important?

Unmanaged switch ports and open Wi-Fi networks are an easy way onto a network: plug in a laptop, or a rogue access point, and you’re on the LAN. 802.1X closes that gap by requiring authentication before a port or SSID passes any traffic, extending identity checks down to the physical and link layer.

That matters most where any cable or wireless signal could be reached by an unauthorized device – open-plan offices, campus buildings, retail floors, and branch LANs. Because 802.1X is an IEEE standard, supplicants built into every major operating system interoperate with authenticators and RADIUS servers from any vendor, which is why it remains the default control for Zero Trust LAN and Wi-Fi access decades after ratification.

What is 802.1X?

802.1X defines three cooperating roles. The supplicant is the client software on the endpoint that submits credentials. The authenticator is the network access device – a switch port or access point – that relays those credentials and enforces the resulting access decision, without itself deciding whether to admit the device. The authentication server validates the credentials and decides what access to grant, typically a RADIUS server, though some deployments authenticate locally instead.

Communication between the supplicant and the authenticator runs over EAPOL (Extensible Authentication Protocol over LAN). The authenticator forwards the exchange to the authentication server using RADIUS attributes such as User-Name, NAS-Port, and Framed-IP-Address. Devices that cannot speak EAPOL are identified by MAC address instead, through MAC Authentication Bypass, and are parked on a guest VLAN until authenticated. Once authentication succeeds, the port opens, and the server can return a VLAN assignment with the accept.

Types of 802.1X

802.1X deployments vary along two axes: how credentials are validated, and how many endpoints a port admits. Local authentication validates the supplicant’s certificate against a trusted certificate database on the authenticator itself, using EAP-TLS, with no external server. RADIUS authentication delegates that decision to an external server – the more common choice, since it centralizes policy across many switches.

Supplicant modes control multi-device ports: Single authenticates only the first device and lets others piggyback on that session; Single-secure allows just one device at a time; Multiple authenticates every device individually. Alongside standard EAPOL authentication, MAC Authentication Bypass (MAB) falls back to authenticating printers, cameras, and other supplicant-less devices by MAC address instead of credentials.

802.1X & Versa

VOS devices implement all three 802.1X roles. A VNI interface configured as the authenticator enforces 802.1X on a switch port, either validating supplicants locally against a trusted certificate database or forwarding requests to an external RADIUS server through an authentication profile, as described in Configure IEEE 802.1X Device Authentication. That article also covers MAB, RADIUS fail-open (access keeps working if the server becomes unreachable), and RADIUS tracking to detect when a server returns.

Dynamic VLAN assignment lets a successful 802.1X or MAB authentication move a device off the guest VLAN and onto the VLAN the RADIUS server returns. In SD-LAN deployments, 802.1X is configured through reusable port and authentication profiles – see Configure SD-LAN Using Workflow Templates (Releases 22.1.4 and Later) and Configure SD-LAN Using Workflow Templates (Release 22.1.3), which build an 802.1X port profile – supplicant mode, guest and authentication VLAN – and a profile pointing at one or more RADIUS servers.

Frequently asked questions

What is the difference between 802.1X and MAC Authentication Bypass?

802.1X authenticates a device by validating credentials it actively supplies over EAPOL. MAC Authentication Bypass (MAB) instead authenticates by the device’s MAC address, for printers, cameras, and other endpoints with no 802.1X supplicant. MAB is typically configured as a fallback when EAPOL doesn’t respond.

What are the three roles in 802.1X authentication?

The supplicant is the client requesting access; the authenticator is the switch port or access point enforcing the decision; the authentication server validates credentials and decides the outcome. A device can be validated locally or by an external RADIUS server.

What is dynamic VLAN assignment in 802.1X?

It’s the ability for an authentication server to return a VLAN ID along with a successful authentication, moving the device from a default or guest VLAN onto the VLAN that matches its identity – for example, separating authenticated employee laptops from unauthenticated guests automatically.

Can 802.1X authenticate devices without RADIUS?

Yes. Local 802.1X authentication validates the supplicant’s certificate against a trusted certificate database on the authenticator itself, using EAP-TLS, without contacting an external server. Most large deployments still use RADIUS instead, because it centralizes authentication policy across many switches rather than configuring each one individually.

What is the difference between EAPOL and MAB?

EAPOL (Extensible Authentication Protocol over LAN) is the transport carrying a supplicant’s credentials to the authenticator for standard 802.1X authentication. MAB has no credential exchange at all – it authenticates non-EAPOL devices by sending their MAC address to the authentication server.

More on 802.1X

If you want to learn more, these are sources we trust.

Related terms

If you’re reading about 802.1X, these are worth looking at next.