802.1X and RADIUS: Deploying Network Access Control (NAC)
·2 min read·247 words
802.1X deployment with RADIUS for network access control (NAC). Authenticates users/devices before VLAN assignment. Essential for Zero Trust + NIS2. Deployment guide for FreeRADIUS/Cisco ISE/Aruba ClearPass on access switches + WiFi.
Architecture
- Supplicant: client (PC, smartphone, IoT)
- Authenticator: switch/AP
- Authentication Server: RADIUS
- Backend: AD, LDAP, PKI certificate
EAP Methods
- EAP-TLS: mutual certificates (most secure)
- PEAP-MSCHAPv2: AD username/password
- EAP-FAST: Cisco, similar to PEAP
- EAP-TTLS: alternative used by eduroam
- 2026 recommendation: EAP-TLS for mature enterprises; PEAP otherwise
Cisco Switch Configuration (dot1x)
- aaa new-model
- aaa authentication dot1x default group radius
- aaa authorization network default group radius
- aaa accounting dot1x default start-stop group radius
- radius server ISE
- address ipv4 10.0.0.50 auth-port 1812 acct-port 1813
- key RadiusKey123
- dot1x system-auth-control
- interface GigabitEthernet1/0/1
- switchport mode access
- authentication port-control auto
- authentication order dot1x mab
- authentication priority dot1x mab
- dot1x pae authenticator
- mab
MAB (MAC Authentication Bypass)
- Fallback for devices without an 802.1X supplicant (printers, cameras)
- Authentication via MAC address
- Less secure (spoofing is possible)
- Suitable for IoT, but use a dedicated isolated VLAN
Device Profiling
- ISE / ClearPass analysis: DHCP fingerprints, HTTP User-Agent, SNMP, Nmap
- Automatically classifies devices: Cisco IP Phone, Windows, Linux, Apple, printer, camera
- Dynamic policy based on profile
Posture
- Checks endpoint compliance: antivirus, patches, certificates
- ClearPass OnGuard, Cisco ISE Posture
- Quarantine VLAN for non-compliant endpoints
WiFi WPA3-Enterprise
- SSID configured with WPA3-Enterprise EAP-TLS
- Clients: certificates provisioned via MDM (Intune, Jamf)
- No shared password
Order from OPTINOC
802.1X + NAC deployment. Cisco ISE, Aruba ClearPass, FortiNAC, and FreeRADIUS. AD/MDM integration. Quote within 48 hours.