TechKnowSurge
CompTIA Security+ 3.2 ISC2 CISSP 5.6 NIST 800-53 IA-3 Cisco CCST Cybersecurity 2.5 ISC2 CISSP 4.2
TechKnowSurge Catalog Videos 802.1x
VideoSecurityFree

802.1x

802.1X is a network access control standard that authenticates devices and users before granting network access, offering stronger security and greater flexibility than MAC address-based port security.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

802.1X is a network access control standard designed to verify the identity of devices or users before allowing them onto a network. It was developed to overcome the fundamental limitations of port security, which relies on MAC addresses to control access. MAC addresses are trivially easy to spoof, and because port security binds a device to a specific physical port, moving hardware requires manual reconfiguration on the switch. 802.1X eliminates both problems by shifting authentication away from hardware identifiers toward more robust and portable credentials. Authentication in an 802.1X environment can be based on the device, the user, or a combination of both, and it supports multiple credential types including digital certificates installed on machines, user account credentials, smart cards, and pre-shared keys. This flexibility allows organizations to enforce access policies at a granular level and ensures that credentials are significantly harder to replicate or steal than a MAC address. The architecture involves three distinct roles: the supplicant is the device seeking network access, the authenticator is the network device it connects through, and the authentication server is the backend system that issues the final access decision using AAA services. The communication between these components is structured around specific protocols. EAP handles authentication between the supplicant and the authenticator, while protocols such as RADIUS, Diameter, or TACACS+ carry that traffic between the authenticator and the authentication server. This layered communication model makes 802.1X more complex to deploy than simple port security, which is one reason it sees less adoption on wired LANs in smaller environments. It is, however, widely implemented on wireless networks, where the additional overhead is justified by the stronger access control it provides over a standard passkey-based approach.

What you'll learn

What's covered

802.1x Network Access Control

Aligned to

CompTIA Security+
3.2 Given a scenario, apply security principles to secure enterprise infrastructure.
ISC2 CISSP
5.6 Implement authentication systems
4.2 Secure network components
NIST 800-53
IA-3 Device Identification and Authentication
Cisco CCST Cybersecurity
2.5 Implement secure access technologies

Key terms

Authentication
The process of verifying the identity of a user, device, or system.
Media Access Control
MAC
A sublayer of the Data Link layer that controls how devices on a network gain access to a medium and transmit data.
Spoofing
An attack where an adversary impersonates a trusted entity by falsifying data such as an IP address or email address.
802.1X
An IEEE standard for port-based network access control that requires devices to authenticate before gaining access to a wired or wireless network, using a supplicant, authenticator, and authentication server (typically RADIUS). It is the foundation of enterprise Wi-Fi security and wired port security using EAP methods.
Supplicant
In the IEEE 802.1X authentication framework, the device or user requesting network access that must prove its identity to the authenticator before being granted access. The supplicant runs an EAP method such as EAP-TLS or PEAP and communicates with the authenticator using EAPoL.
Authenticator
In the IEEE 802.1X framework, the network device (typically a switch or wireless access point) that sits between the supplicant and the authentication server, relaying EAP messages and enforcing whether the port is opened or blocked based on the authentication result. The authenticator does not verify credentials itself; it passes that responsibility to the RADIUS server.
Authentication Server
The server in a network access control framework (such as 802.1X) that validates supplicant credentials and grants or denies network access based on authentication policy. RADIUS is the most common authentication server protocol.
Port Security
A Cisco switch feature that restricts which devices can connect to a port by limiting the number of allowed MAC addresses or requiring specific MAC addresses to be present. When a violation occurs, the port can be configured to shut down, restrict traffic, or send an alert.

Topics

802 1x Network Access Control Authentication Port Security Networking Eap

Transcript

The Problems with Port Security

Port security uses MAC addresses in order to control which devices have access into the network. There's a couple of problems with port security though.

Number one is that MAC address spoofing is very easy. So I could just spoof the MAC address of a machine and then gain connectivity into a network.

The other problem is portability. If I want to move that machine from one location to another location, I have to change that on the switch as well, because that MAC address is associated with a port. So if I move it to another port, then I have to associate that MAC address with another port. So those are some problems with implementing port security.

What 802.1X Gives Us

Instead, there is a better solution. 802.1X is a much better solution. It gives us much more granular control over the environment, and we have much better options that we can implement with 802.1X. We can base it off of a machine, a device that's on the network, or we could base it off of the user, or we could base it off of both a user and a machine. So we've got a lot of options on how we control the access into this network.

Some ways that we can implement 802.1X are with something like certificates, where we install a certificate on the machine and that machine's certificate gives them access to the rest of the network. Or maybe it's some sort of user credentials that the user has. Or maybe something like a smart card reader that gains them access into this network. Or perhaps it's some sort of pre-shared key that's already set up. But we can set these things up either by giving it to the user or onto the machine, setting up the machine to do that.

So now the machine can access any of the ports that we specify, so there's some portability there. Plus, it can't be duplicated, it can't be mimicked, unless somebody were to steal those certificates or they steal the credentials. But other than that, they don't have access into this local area network.

Terminology

Some terminology when it comes to 802.1X. The supplicant is going to be the device that needs the access. The authenticator is going to be the device that's going to be authenticating the supplicant, or that the supplicant is making connection into. And then the authentication server is actually what's going to grant the yay or nay: is this acceptable or is this not acceptable?

The Protocols Involved

There's quite a few mechanisms in place to make this all happen. It is definitely more complicated than implementing port security. One of the things we need is a AAA authentication server — so that's this authentication server over here. We would set up some sort of AAA services on there that would communicate between this switch and the authentication server. And then the supplicant communicates with the authenticator. So we have quite a bit of communication that happens across here.

Since there's quite a bit of communication that happens across here, we do have protocols that help facilitate this. So we have AAA protocols over here on the right side, between the authenticator and the authentication server. And then between the supplicant and the authenticator, we have protocols there as well. We use EAP for the authentication piece of this, and then it gets encapsulated with something like EAPoL, or RADIUS, or Diameter, or TACACS. There are different protocols out there, but there are protocols that go into making all of this communication happen.

Where You See It Used

Now, this can be a more complicated setup, so I quite honestly don't see it as much in the wired networks. Most of the businesses that I've worked with, it just hasn't made sense to implement 802.1X, because of various reasons. And so you don't see it as much on the LAN side, the local area network, on this side of it. But what you do see a lot of times is on the wireless side. I've definitely had a lot of implementations where I've implemented it on the wired side. And there's some advantages over just a simple pass key, and we can do setups like certificates and that type of thing. So there's a lot of advantages to setting this up on the wireless side.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →