TechKnowSurge
Cisco CCNA 5.8 Cisco CCNA 5.7 Cisco CCNA 1.13
TechKnowSurge Catalog Videos 802.1X
VideoNetworkFree

802.1X

802.1X is a network access control standard that ensures only authenticated devices can connect to a network, using certificates or credentials verified through a central authentication server.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

802.1X is a port-based network access control (PNAC) standard widely regarded as one of the most effective methods for ensuring that only authorized devices gain access to a network. It operates on a three-component model: the supplicant, which is the device attempting to connect; the authenticator, which is the switch, wireless access point, or other network device controlling access; and the authentication server, which holds identity information and makes the final access decision. This architecture applies equally to wired and wireless connections, making it a versatile solution across mixed network environments. Authentication between the supplicant and the authenticator is handled through the Extensible Authentication Protocol (EAP), which creates a secure communication channel during the verification process. The authenticator forwards credentials to the authentication server, typically using RADIUS, and access is granted or denied based on the server's response. Supported authentication methods include digital certificates installed on the endpoint device, username and password prompts, or captive portal web interfaces — offering flexibility to match different organizational security policies. While 802.1X delivers significantly stronger access control than MAC address-based port security, it does require upfront planning and infrastructure. Deploying it involves configuring RADIUS server communication, establishing a method for identity verification on each supplicant, and managing credentials or certificates over time. The initial setup carries some complexity, but once in place, 802.1X effectively locks down network access so that only devices meeting defined authentication requirements are permitted to connect.

What you'll learn

What's covered

802.1X Network Security

Aligned to

Cisco CCNA
5.8 Compare authentication, authorization, and accounting concepts
5.7 Configure and verify Layer 2 security features
1.13 Describe switching concepts

Key terms

Authentication
The process of verifying the identity of a user, device, or system.
Media Access Control
MAC
A sublayer of the Data Link layer that controls how devices on a network gain access to a medium and transmit data.
Switch
A network device that connects devices within a LAN and forwards traffic based on MAC addresses.
802.1X
An IEEE standard for port-based network access control that requires devices to authenticate before gaining access to a wired or wireless network, using a supplicant, authenticator, and authentication server (typically RADIUS). It is the foundation of enterprise Wi-Fi security and wired port security using EAP methods.
Supplicant
In the IEEE 802.1X authentication framework, the device or user requesting network access that must prove its identity to the authenticator before being granted access. The supplicant runs an EAP method such as EAP-TLS or PEAP and communicates with the authenticator using EAPoL.
Authenticator
In the IEEE 802.1X framework, the network device (typically a switch or wireless access point) that sits between the supplicant and the authentication server, relaying EAP messages and enforcing whether the port is opened or blocked based on the authentication result. The authenticator does not verify credentials itself; it passes that responsibility to the RADIUS server.
Authentication Server
The server in a network access control framework (such as 802.1X) that validates supplicant credentials and grants or denies network access based on authentication policy. RADIUS is the most common authentication server protocol.
Extensible Authentication Protocol
EAP
Extensible Authentication Protocol is a flexible authentication framework used in wireless networks and PPP connections that supports multiple authentication methods including certificates, tokens, and passwords.
Remote Authentication Dial In User Service
RADIUS
A network protocol that provides centralized authentication, authorization, and accounting (AAA) for users and devices connecting to a network, commonly used with 802.1X and VPN deployments. RADIUS uses UDP and encrypts only the password field in its messages.

Topics

802 1x Network Access Control Authentication Port Based Authentication Radius Networking Supplicant Authenticator Server

Transcript

What 802.1X does

802.1X can eliminate a lot of issues on your network. I consider it the gold standard when it comes to security. It does not eliminate the need for all of the other things that we talked about, but it does make sure that only protected devices are connecting to your network.

The configurations of 802.1X are quite a bit more in-depth and beyond this course, but it is something that is pretty cool to implement on your networks.

802.1X makes sure that the devices connecting to your network should be on your network. Otherwise, it does not allow those devices to connect to your network. It is quite a few steps above and beyond what the standard port security does for us. The standard port security just does things based off of MAC addresses, and is fairly simplistic in its implementation. What this does, though, is make sure that this device, either by certificates or username and passwords, can connect to your network.

Supplicant, authenticator, authentication server

An example of this is, I have my demo laptop here, and this is called the supplicant. The supplicant is the device that is trying to connect to your network. You plug in the supplicant into a port, or perhaps you are connecting it wirelessly. Whatever the case may be, the device that you are connecting to, whether wireless or via some sort of physical port, that is known as the authenticator, and it is authenticating this device right here.

Now, what it will do is, this connection right here is going to be EAP, so it is going to create the secure connection between those devices as it is authenticating this. Then it is going to reach out to the authentication server, which is going to have information on this device.

Now, the way it authenticates could vary. You could have something like a certificate that is on the computer, or it could be a username and password that somebody on the supplicant has to enter in, that information, in order to get onto the network. Maybe it is like a captive portal, where a web page comes up and then you enter the information into that captive portal and that gets sent off to this authentication server.

So this authentication server is the one that gives the thumbs up or thumbs down based on the information that it is given. And then the authenticator, if the authentication server says yes, this device can get on, it will turn that port on and the supplicant is allowed to then be on the network. If the authentication server says no, this is not allowed, then the authenticator will turn off this supplicant's access to the network. So it is pretty secure.

What it takes to set up

The problem with this is that you do have to have usernames and passwords. Well, that is not the only way of doing it. You have to install possibly certificates on the computer. There has to be some sort of mechanism to verify the identity of this supplicant.

The other part of this is setting up this connection between the authenticator and this Demo Pi 2, or whatever device you have. This is going to use something like RADIUS to make that connection, and that type of connection needs to be set up, and there are some little gotchas while you are setting this up to make this all happen.

So there is a little more in-depth into setting this up, but once you have it set up, it really locks down so only certain devices are allowed on.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →