802.1X and MAC Authentication Bypass: controlling who can use a switch port

Why authenticate at the port

Without access control, anyone who plugs a laptop into a spare wall port is on your network. Port security limits MAC addresses but cannot tell who is connecting. IEEE 802.1X makes every device prove its identity before the switch forwards its traffic. It is the foundation of most network access control (NAC) systems and works the same way on wired ports and enterprise Wi-Fi.

The three roles

• Supplicant: software on the device (built into Windows, macOS, Linux and most phones) that answers with a certificate or user credentials.
• Authenticator: the switch. Until authentication succeeds, it only lets EAP messages through on the port. It passes them to the server inside RADIUS.
• Authentication server: a RADIUS server such as Cisco ISE, Aruba ClearPass, Microsoft NPS or FreeRADIUS, which checks the identity against a directory and returns accept or reject.

Between device and switch the messages use EAP over LAN (EAPOL). The EAP method decides how strong the check is: EAP-TLS with device certificates is the strongest, PEAP with user names and passwords is common. With an accept, the server can also send attributes that place the device in a particular VLAN or apply a downloadable ACL.

MAC Authentication Bypass

Printers, IP cameras, badge readers and older medical devices often cannot run a supplicant. MAC Authentication Bypass (MAB) lets the switch send the device's MAC address to the RADIUS server as its identity. The server checks the address against a list of known devices, often with device profiling, and places it in a suitable VLAN.

MAB is weaker than 802.1X because MAC addresses can be copied. Limit what MAB devices can reach, for example by putting printers in a printer VLAN that only talks to the print server, and use profiling to notice if a "printer" starts acting like a laptop.

A basic configuration

aaa new-model
radius server NAC1
 address ipv4 10.0.5.20 auth-port 1812 acct-port 1813
 key Example-Shared-Secret
aaa group server radius NAC
 server name NAC1
aaa authentication dot1x default group NAC
aaa authorization network default group NAC
aaa accounting dot1x default start-stop group NAC
dot1x system-auth-control
!
interface range GigabitEthernet1/0/1 - 44
 switchport mode access
 switchport access vlan 10
 authentication port-control auto
 authentication order dot1x mab
 authentication priority dot1x mab
 authentication open
 mab
 dot1x pae authenticator
 dot1x timeout tx-period 10

Newer IOS XE releases can express the same policy with the more flexible access-session commands and policy maps, but the logic is the same. The authentication open line is monitor mode: the port lets traffic through even if authentication fails, while logging what would have happened. Check sessions with show access-session interface g1/0/5 details.

Rolling out safely

1. Build the RADIUS policy and test on a few lab ports.
2. Run monitor mode on real ports for a few weeks and review the logs for devices that fail.
3. Add MAB entries or profiles for the devices that cannot do 802.1X.
4. Move to low-impact mode (a pre-authentication ACL allowing DHCP, DNS and PXE) and finally to closed mode.
5. Plan for RADIUS outages with redundant servers and a critical VLAN for when no server answers.

Real-world example: a district hospital found an unknown mini-PC plugged into a waiting room wall port. It rolled out 802.1X over three months: staff laptops authenticate with EAP-TLS certificates, infusion pumps and printers use MAB with profiling into restricted VLANs, and unknown devices land in a guest VLAN with internet access only. When a contractor later plugged in a laptop to test a projector, it was placed in the guest VLAN automatically and the helpdesk received an alert.