TechKnowSurge
CompTIA Security+ 3.2 ISC2 CISSP 5.6 NIST 800-53 IA-3 CompTIA Security+ 4.1 NIST CSF PR.AA-04
TechKnowSurge Catalog Videos 802.1X Summary
VideoSecurityFree

802.1X Summary

802.1X is a network access control standard that uses a three-component model — supplicant, authenticator, and authentication server — to verify identities before granting network access. It supports both wired and wireless environments and replaces weaker methods like pre-shared keys with certificate- or credential-based authentication.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

802.1X is a port-based network access control standard that governs how devices are authenticated before being granted access to a network. It relies on three distinct roles: the supplicant, which is the endpoint device seeking access; the authenticator, which is the network device — typically a switch for wired connections or a wireless access point — that enforces the access decision; and the authentication server, which stores and validates credentials or certificates and determines what access rights apply to a given user or device. Authentication is handled through EAP, the Extensible Authentication Protocol, which functions as a framework rather than a standalone protocol. Within that framework, specific methods can be selected based on organizational needs — EAP-TLS, for example, uses digital certificates for mutual authentication, while other EAP variants support username and password credentials. Because EAP itself is not a transport protocol, 802.1X uses EAPOL to encapsulate and carry EAP messages between the supplicant and the authenticator during the period before the device has any network connectivity, including the ability to request an IP address. On the backend, the authenticator communicates with the authentication server using RADIUS or an alternative AAA protocol such as TACACS+ or Diameter. 802.1X applies equally well to wireless networks, where the authenticator role is filled by a wireless access point instead of a switch. This makes it possible to authenticate wireless clients using certificates or credentials rather than a pre-shared key, which eliminates a significant class of vulnerabilities associated with shared-secret wireless security. The result is a scalable, flexible authentication model suited to enterprise environments across both wired and wireless infrastructure.

What you'll learn

What's covered

802.1X Summary

Aligned to

CompTIA Security+
3.2 Given a scenario, apply security principles to secure enterprise infrastructure.
4.1 Given a scenario, apply common security techniques to computing resources.
ISC2 CISSP
5.6 Implement authentication systems
NIST 800-53
IA-3 Device Identification and Authentication
NIST CSF
PR.AA-04 Identity assertions are protected, conveyed, and verified.

Key terms

Authentication
The process of verifying the identity of a user, device, or system.
802.1X
An IEEE standard for port-based network access control that requires devices to authenticate before gaining access to a wired or wireless network, using a supplicant, authenticator, and authentication server (typically RADIUS). It is the foundation of enterprise Wi-Fi security and wired port security using EAP methods.
Supplicant
In the IEEE 802.1X authentication framework, the device or user requesting network access that must prove its identity to the authenticator before being granted access. The supplicant runs an EAP method such as EAP-TLS or PEAP and communicates with the authenticator using EAPoL.
Authenticator
In the IEEE 802.1X framework, the network device (typically a switch or wireless access point) that sits between the supplicant and the authentication server, relaying EAP messages and enforcing whether the port is opened or blocked based on the authentication result. The authenticator does not verify credentials itself; it passes that responsibility to the RADIUS server.
Authentication Server
The server in a network access control framework (such as 802.1X) that validates supplicant credentials and grants or denies network access based on authentication policy. RADIUS is the most common authentication server protocol.
Extensible Authentication Protocol
EAP
Extensible Authentication Protocol is a flexible authentication framework used in wireless networks and PPP connections that supports multiple authentication methods including certificates, tokens, and passwords.
Extensible Authentication Protocol over LAN
EAPoL
A network access control protocol defined in IEEE 802.1X that encapsulates EAP authentication messages over a local area network before a device is granted access to network resources. EAPoL operates at Layer 2 and is the delivery mechanism for EAP methods such as EAP-TLS and PEAP.
Remote Authentication Dial-In User Service
RADIUS
RADIUS is a client-server networking protocol that provides centralized authentication, authorization, and accounting management for users connecting to network access points or VPN services.
Wireless Access Point
WAP
A device that allows wireless devices to connect to a wired network using Wi-Fi.

Topics

802.1x Network Access Control Eap Radius Networking Wireless Security

Transcript

The three roles

Here's a rundown of 802.1X. First of all, we've got the supplicant. This is the device that's trying to access the network.

Then you've got the authenticator. This is the device that's doing the authentication with that supplicant, but in this case right here it's also the device that's actually giving them access to the local area network. So in this case, it's a switch.

Then we've got the authentication server. This is what's actually storing the credentials. If we're using certificates, this is what's going to do the certificate authentication. Or it could be usernames and passwords, some sort of credentials. So this is storing the credentials of who can log into the system, where they can log in, and what they can have access to.

EAP and how it gets carried

Now what we need is a protocol in order to do the authentication. EAP is actually a framework, but what we can do is choose different protocols within that framework. So the framework of EAP might set up something like EAP-TLS, which would be certificate based, so we're setting up a certificate to do that. Or we could use a method to do the username and password and authenticate off of that. So we're using EAP to do that communication back and forth here.

But EAP is not designed as a communication protocol. It's not designed to carry this data back and forth. It's designed for just doing the authentication piece and making sure authentication is correct. So what we need is some sort of communication protocol. 802.1X has defined e and the way that it's going to communicate between the supplicant and the authenticator, before this machine actually gains access to the network. The machine doesn't really have access at this point. It can't even ask for an IP address. So we have this protocol right here that encapsulates EAP to carry that data back and forth. This is because this machine isn't connected to the rest of the network yet.

Then we've got RADIUS on the back side here. That could be TACACS also, or Diameter. There are other AAA services and AAA protocols that we could use, but in this case we're using RADIUS right there.

Putting it together

So with 802.1X, let's say they're logging in with credentials. They use credentials, they type that into the machine, and the machine then authenticates with the authenticator, and that message gets sent off to the authentication services. Then the authentication services says yes, they have access to this network, and then this machine gets access to that network. So that's how 802.1X works.

802.1X with wireless

802.1X can also be used with wireless. What we can do is set up a similar type of setup, but the authenticator, instead of being a switch, is a wireless access point, which essentially is just like a hub. So we can do the same thing for authentication with wireless, which is great, because now we can use those certificates, or we can use credentials, to log into a wireless system rather than a pre-shared key — and the pre-shared key has a lot of problems to it. So this allows us to be more secure with wireless.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →