802.1X (Port-Based Network Access Control)

802.1X is an IEEE standard for port-based network access control. A device that connects to a switch port or a Wi-Fi network cannot send ordinary traffic until it proves its identity; until then only authentication messages pass.

Why it matters

Without it, anyone who plugs a cable into a wall socket gets onto the network. 802.1X ties access to credentials or certificates, and the result can place each user in a suitable VLAN. It involves three roles: the supplicant (the device), the authenticator (the switch or access point) and the authentication server, usually RADIUS. Messages are carried by EAP (Extensible Authentication Protocol), with methods such as EAP-TLS using certificates or PEAP using passwords inside a TLS tunnel.

Example

An employee connects to the corporate SSID using WPA2 or WPA3 Enterprise. The access point relays EAP messages to RADIUS, which validates the laptop's certificate. On success the access point unlocks the connection and applies the VLAN returned by the server.

Common mistakes

• Skipping server certificate validation on clients, which lets a rogue access point steal credentials.
• Forgetting printers, cameras and other devices that cannot do 802.1X, and having no fallback such as MAC-based exceptions.
• Believing it is only for wireless; it works on wired ports too.

Related

• RADIUS
• WPA2 and WPA3
• Network switch
• Access point

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.