802.1X and RADIUS: Deploying Network Access Control (NAC)

802.1X deployment with RADIUS for network access control (NAC). Authenticates users/devices before VLAN assignment. Essential for Zero Trust + NIS2. Deployment guide for FreeRADIUS/Cisco ISE/Aruba ClearPass on access switches + WiFi.

Architecture

• Supplicant: client (PC, smartphone, IoT)
• Authenticator: switch/AP
• Authentication Server: RADIUS
• Backend: AD, LDAP, PKI certificate

EAP Methods

• EAP-TLS: mutual certificates (most secure)
• PEAP-MSCHAPv2: AD username/password
• EAP-FAST: Cisco, similar to PEAP
• EAP-TTLS: alternative used by eduroam
• 2026 recommendation: EAP-TLS for mature enterprises; PEAP otherwise

Cisco Switch Configuration (dot1x)

• aaa new-model
• aaa authentication dot1x default group radius
• aaa authorization network default group radius
• aaa accounting dot1x default start-stop group radius
• radius server ISE
• address ipv4 10.0.0.50 auth-port 1812 acct-port 1813
• key RadiusKey123
• dot1x system-auth-control
• interface GigabitEthernet1/0/1
• switchport mode access
• authentication port-control auto
• authentication order dot1x mab
• authentication priority dot1x mab
• dot1x pae authenticator
• mab

MAB (MAC Authentication Bypass)

• Fallback for devices without an 802.1X supplicant (printers, cameras)
• Authentication via MAC address
• Less secure (spoofing is possible)
• Suitable for IoT, but use a dedicated isolated VLAN

Device Profiling

• ISE / ClearPass analysis: DHCP fingerprints, HTTP User-Agent, SNMP, Nmap
• Automatically classifies devices: Cisco IP Phone, Windows, Linux, Apple, printer, camera
• Dynamic policy based on profile

Posture

• Checks endpoint compliance: antivirus, patches, certificates
• ClearPass OnGuard, Cisco ISE Posture
• Quarantine VLAN for non-compliant endpoints

WiFi WPA3-Enterprise

• SSID configured with WPA3-Enterprise EAP-TLS
• Clients: certificates provisioned via MDM (Intune, Jamf)
• No shared password

Order from OPTINOC

802.1X + NAC deployment. Cisco ISE, Aruba ClearPass, FortiNAC, and FreeRADIUS. AD/MDM integration. Quote within 48 hours.