16.5 IEEE 802.1X Port-Based Authentication & MAB
Key Takeaways
- IEEE 802.1X provides port-based network access control across three discrete entities: the Supplicant (client endpoint software), the Authenticator (access switch or WLC), and the Authentication Server (Cisco ISE / RADIUS).
- EAP encapsulation bridges Layer 2 and Layer 3 domains: EAP over LAN (EAPoL, EtherType 0x888E) operates between Supplicant and Authenticator, while the Authenticator de-encapsulates and re-encapsulates EAP inside RADIUS Attributes (Attributes 79 and 80) over UDP to the Authentication Server.
- EAP authentication methods deliver progressive security tiers: EAP-TLS mandates mutual X.509 PKI certificate validation, PEAPv0/MSCHAPv2 secures inner password credentials within a server-authenticated TLS tunnel, and EAP-FAST utilizes Protected Access Credentials (PACs).
- MAC Authentication Bypass (MAB) enables access for headless IoT devices (printers, cameras, environmental sensors) by evaluating the endpoint's MAC address as username and password in RADIUS after 802.1X authentication times out.
- Port host modes govern multi-device connectivity: Single-Host (one MAC), Multi-Domain (one Voice + one Data MAC), Multi-Auth (independent 802.1X/MAB authentication per MAC), and Multi-Host (first authenticated MAC opens the port for all subsequent devices).
16.4 IEEE 802.1X Port-Based Authentication & MAB
Core Blueprint Focus: Cisco 350-401 ENCOR v1.2 removed the standalone network-access-control leaf that v1.1 carried at 5.5.e, but 802.1X remains load-bearing for two surviving topics: 5.1.b (authentication and authorization using AAA) and 5.4.d (TrustSec), whose dynamic SGT classification depends on it. Those topics require candidates to configure and verify 802.1X port-based authentication and understand Extensible Authentication Protocol (EAP) inner/outer methods, MAC Authentication Bypass (MAB), port host modes, and fallback VLAN architectures. Candidates must master the three 802.1X roles, EAPoL frame formats, EAP-TLS vs. PEAP vs. EAP-FAST cryptographic operations, Multi-Domain vs. Multi-Auth host modes, Critical Authentication VLANs, and modern Cisco Common Classification Policy Language (C3PL / IBNS 2.0) deployment syntax.
Traditional switchport security based solely on static MAC addresses is brittle and easily spoofed. IEEE 802.1X establishes an open-standard, cryptographic framework for Port-Based Network Access Control (PNAC). Prior to authentication, an 802.1X-enabled switchport remains in an unauthorized state, blocking all Layer 3 IPv4/IPv6 transit traffic and permitting only Layer 2 control plane frames (EAPoL, CDP, LLDP, and STP). Only after the connecting endpoint successfully validates its cryptographic credentials with a centralized Authentication Server (such as Cisco Identity Services Engine / ISE) does the switchport transition to an authorized state, dynamically applying authorization policies including VLAN assignment, Downloadable ACLs (dACLs), and Scalable Group Tags (SGTs).
+---------------------------------------------------------------------------------------------------+
| IEEE 802.1X PORT-BASED AUTHENTICATION ARCHITECTURE |
+---------------------------------------------------------------------------------------------------+
| |
| +-------------------+ Layer 2 EAPoL +-------------------+ RADIUS / IP |
| | SUPPLICANT | <==========================> | AUTHENTICATOR | <====================> |
| | (Laptop / Phone) | (EtherType 0x888E) | (Catalyst Switch) | (UDP 1812 / EAP Msg) |
| +-------------------+ +-------------------+ |
| ^ | | |
| | | v |
| [ EAP METHOD ] [ PORT STATE ] +---------------------+ |
| - EAP-TLS (Mutual PKI Certs) - Unauthorized (Init)| AUTHENTICATION | |
| - PEAPv0 / MSCHAPv2 (Server Cert) - Authorized (Pass) | SERVER | |
| - EAP-FAST (PAC Tunnel) - MAB (Fallback) | (Cisco ISE) | |
| +---------------------+ |
+---------------------------------------------------------------------------------------------------+
1. IEEE 802.1X Roles & EAP Encapsulation Architecture
The 802.1X framework operates across three distinct functional entities:
- The Supplicant: The software client or hardware endpoint requesting network admission (e.g., Cisco Secure Client / AnyConnect, native Windows/macOS 802.1X supplicants, IP phones).
- The Authenticator: The network access device (Catalyst 9000 switch or Catalyst 9800 WLC) controlling the physical/logical port state. The Authenticator does not process user credentials directly; it acts as an intermediary proxy translating between local Layer 2 frame formats and remote Layer 3 AAA protocols.
- The Authentication Server: The centralized policy decision engine (Cisco ISE) that maintains identity stores (Active Directory, LDAP, Internal PKI), validates EAP credentials, and returns authorization directives.
EAPoL Encapsulation & RADIUS Translation
+---------------------------------------------------------------------------------------------------+
| EAP PROTOCOL CONVERSION & ENCAPSULATION STACK |
+---------------------------------------------------------------------------------------------------+
| |
| [ CLIENT TO SWITCH (Layer 2 Link) ] [ SWITCH TO CISCO ISE (IP Network) ] |
| +---------------------------------------+ +--------------------------------------------+ |
| | Ethernet Header (EtherType: 0x888E) | | IP Header (UDP Port 1812) | |
| +---------------------------------------+ +--------------------------------------------+ |
| | EAPoL Header (Version, Type, Length) | | RADIUS Header (Code, ID, Length, Auth) | |
| +---------------------------------------+ +--------------------------------------------+ |
| | EAP Packet (Code, ID, Length, Data) | ======> | RADIUS Attribute 79 (EAP-Message) | |
| | - EAP-Request / Identity | | RADIUS Attribute 80 (Message-Authenticator)| |
| | - EAP-Response / EAP-TLS Handshake | +--------------------------------------------+ |
| +---------------------------------------+ |
+---------------------------------------------------------------------------------------------------+
- EAPoL Frame Types (EtherType
0x888E):- EAPOL-Start (Type 1): Transmitted by the supplicant to initiate authentication immediately upon link-up without waiting for the switch's periodic query.
- EAPOL-Packet (Type 0): Encapsulates the core EAP messages (Identity, Challenge, Response, Success, Failure).
- EAPOL-Logoff (Type 2): Transmitted by the supplicant when disconnecting to immediately revert the switchport to the unauthorized state.
- EAPOL-Key (Type 3): Used in wireless (802.11i WPA2/WPA3 4-way handshake) and MACsec (802.1AE) for dynamic encryption key distribution.
2. Extensible Authentication Protocol (EAP) Methods
EAP (Extensible Authentication Protocol, RFC 3748) is an authentication framework that supports multiple backend authentication algorithms (EAP methods).
+---------------------------------------------------------------------------------------------------+
| EAP METHODS TECHNICAL COMPARISON MATRIX |
+---------------------------------------------------------------------------------------------------+
| EAP Method | RFC Standard | Client Credential | Server Credential | Cryptographic Security |
| :--------------- | :----------- | :---------------- | :---------------- | :---------------------- |
| **EAP-TLS** | RFC 5216 | **X.509 PKI Cert**| **X.509 PKI Cert**| **Highest / Mutual PKI**|
| | | (Digital Cert) | (Digital Cert) | Zero passwords on wire |
| **PEAPv0** | Cisco / MS | **MS-CHAPv2 User**| **X.509 PKI Cert**| **Strong / Tunneled** |
| **(EAP-MSCHAPv2)**| Proprietary | (Username/Password)| (Server-Side Only)| Client validates server |
| **EAP-FAST** | RFC 4851 | MS-CHAPv2 / Token | **PAC Key** | **Strong / Tunneled** |
| | (Cisco) | or Client Cert | (No PKI Mandate) | Protected Access Cred. |
| **EAP-TTLS** | RFC 5281 | PAP, CHAP, MSCHAP | **X.509 PKI Cert**| **Strong / Tunneled** |
| | | or MS-CHAPv2 | (Server-Side Only)| Supports legacy auth |
+---------------------------------------------------------------------------------------------------+
EAP-TLS (Transport Layer Security - RFC 5216)
- Mutual Authentication: Both the client supplicant and the Cisco ISE authentication server present and cryptographically validate each other's X.509 digital certificates.
- Zero Password Transmission: Impervious to dictionary, brute-force, and credential replay attacks. Requires an enterprise Public Key Infrastructure (PKI) with certificate auto-enrollment (SCEP, EST, or MDM integration).
PEAP (Protected EAP - PEAPv0 / EAP-MSCHAPv2)
- Phase 1 (Outer Tunnel): The Cisco ISE server presents its server certificate to the client. The client validates the server's certificate chain against its trusted root CA store and establishes an encrypted TLS tunnel.
- Phase 2 (Inner Authentication): Inside the encrypted TLS tunnel, the client authenticates using standard Active Directory credentials via MS-CHAPv2 (or EAP-GTC for one-time passwords). Clients do not require digital certificates, simplifying enterprise deployment.
EAP-FAST (Flexible Authentication via Secure Tunneling - RFC 4851)
- Replaces PKI certificate overhead with a symmetric shared secret called a Protected Access Credential (PAC):
- Phase 0 (PAC Provisioning): Dynamic in-band provisioning of the PAC file to the client inside an authenticated Diffie-Hellman tunnel.
- Phase 1 (TLS Tunnel): Client and ISE establish a secure TLS tunnel using the shared PAC key.
- Phase 2 (Inner Authentication): Client authenticates credentials inside the secure tunnel.
3. MAC Authentication Bypass (MAB) for Headless Devices
Many enterprise endpoints—such as network printers, IP security cameras, badge readers, building automation sensors, and medical devices—lack an 802.1X software supplicant and cannot process EAPoL frames. MAC Authentication Bypass (MAB) provides an automated fallback mechanism for onboarding these headless devices.
+---------------------------------------------------------------------------------------------------+
| MAC AUTHENTICATION BYPASS (MAB) OPERATIONAL FLOW |
+---------------------------------------------------------------------------------------------------+
| |
| [ LINK UP EVENT ] ---> Switchport detects link transition to Up (Unauthorized State) |
| | |
| v |
| [ 802.1X INITIATION ] Switch sends 'EAP-Request/Identity' frame to endpoint |
| | |
| v |
| [ EAP TIMEOUT ] -----> Headless endpoint (Printer) ignores EAPoL frame. |
| Switch exhausts 'dot1x max-req' attempts and 'dot1x timeout tx-period'. |
| | |
| v |
| [ MAB ACTIVATION ] --> Switch falls back to MAB. Listens for the first Ethernet frame from device|
| (e.g., DHCP Discover or ARP request) to learn its Source MAC Address. |
| | |
| v |
| [ RADIUS ACCESS-REQ ] Switch constructs a RADIUS Access-Request to Cisco ISE: |
| - **Username:** 005056a12233 (Device Source MAC) |
| - **Password:** 005056a12233 (Device Source MAC) |
| - **Service-Type:** Call-Check (Value 10) |
| | |
| v |
| [ ISE PROFILING ] ---> ISE verifies MAC against internal Endpoint Identity Groups (e.g., |
| 'Printers-Group'), checks profiling telemetry, and returns Access-Accept. |
+---------------------------------------------------------------------------------------------------+
[!WARNING] MAB Security Risks: Because MAC addresses can be easily sniffed and spoofed by an attacker using software tools, MAB should never be deployed in isolation without compensatory controls such as Dynamic ARP Inspection (DAI), IP Source Guard (IPSG), Cisco ISE Device Profiling, and restrictive Downloadable ACLs (dACLs).
4. Port Host Modes & Exception / Fallback VLANs
Switchport Host Modes
The switchport Host Mode defines how many endpoints are permitted to connect to an 802.1X-enabled port and how their authentication states are evaluated:
+---------------------------------------------------------------------------------------------------+
| 802.1X SWITCHPORT HOST MODES COMPARISON |
+---------------------------------------------------------------------------------------------------+
| Host Mode | Max Devices | Authentication Mechanics | Security Profile & Use Case |
| :-------------- | :---------- | :-------------------------------- | :---------------------------- |
| **Single-Host** | **1 Data** | Exactly one MAC address allowed. | **Strict / High Security.** |
| *(Default)* | | Any additional MAC triggers a | Dedicated single PC access |
| | | security violation. | ports. |
| **Multi-Domain**| **1 Voice +**| Permits exactly two devices: one on| **Standard Campus Topology.** |
| **(MDA)** | **1 Data** | Voice VLAN and one on Data VLAN. | IP Phone daisy-chained with a |
| | | Authenticates each independently. | desktop PC. |
| **Multi-Auth** | **Multiple**| Each device must authenticate | **Recommended for Shared.** |
| | **(Data)** | **independently** via 802.1X/MAB. | Hubs, mini-switches, docking |
| | | Separate authorization sessions. | stations, access points. |
| **Multi-Host** | **Multiple**| **First host authenticates.** Once| **Insecure / Deprecated.** |
| | | first host passes, port opens for | Any rogue device behind hub |
| | | ALL subsequent MACs unauthenticated| gains full network access. |
+---------------------------------------------------------------------------------------------------+
Special Exception & Fallback VLANs
| Exception VLAN Type | Activation Trigger | Operational Purpose & Network Behavior |
|---|---|---|
| Critical Auth VLAN<br/>(Inaccessible Auth Bypass) | AAA / RADIUS Server is Dead (Timeout / Unreachable) | Ensures authorized users are not locked out during a total AAA infrastructure failure. Assigns port to a critical emergency production VLAN. |
| Guest VLAN | Supplicant Does Not Respond to 802.1X and MAB is not configured / fails | Placed in an isolated, Internet-only VLAN for corporate visitors and non-corporate personal devices. |
| Auth-Fail / Restricted VLAN | Authentication Rejection (Invalid username, bad password, or expired certificate) | Quarantines unauthorized or compromised endpoints into a restricted remediation VLAN to reset passwords without granting internal network access. |
5. Cisco IOS-XE 802.1X & C3PL (IBNS 2.0) Configuration
Modern Cisco Catalyst switches deploy Identity-Based Networking Services 2.0 (IBNS 2.0) using the Cisco Common Classification Policy Language (C3PL).
! Step 1: Enable AAA and Global 802.1X Control
aaa new-model
dot1x system-auth-control
!
! Configure RADIUS Server Group for Cisco ISE
radius server ISE-NODE-1
address ipv4 10.1.100.21 auth-port 1812 acct-port 1813
key 6 070C285F4D0648
!
aaa group server radius ISE-RADIUS-GROUP
server name ISE-NODE-1
ip radius source-interface Loopback0
!
aaa authentication dot1x default group ISE-RADIUS-GROUP
aaa authorization network default group ISE-RADIUS-GROUP
aaa accounting dot1x default start-stop group ISE-RADIUS-GROUP
!
! Step 2: Define Service-Templates (Authorization Profiles)
service-template CRITICAL-ACCESS-TEMPLATE
vlan 999
service-template GUEST-ACCESS-TEMPLATE
vlan 888
!
! Step 3: Define C3PL Control Subscriber Class-Maps
class-map type control subscriber match-all DOT1X-FAILED
match result-type method dot1x authoritative-failure
class-map type control subscriber match-all AAA-DEAD
match authorization-status server-dead
!
! Step 4: Define C3PL Control Subscriber Policy-Map
policy-map type control subscriber ENTERPRISE-ACCESS-POLICY
event session-started match-all
10 class class-default do-all
10 authenticate using dot1x priority 10
20 authenticate using mab priority 20
event authentication-failure match-first
10 class AAA-DEAD do-all
10 activate service-template CRITICAL-ACCESS-TEMPLATE
20 class DOT1X-FAILED do-all
10 activate service-template GUEST-ACCESS-TEMPLATE
event agent-found match-all
10 class class-default do-all
10 authenticate using dot1x priority 10
!
! Step 5: Apply IBNS 2.0 Policy to Access Switchport
interface GigabitEthernet1/0/1
description ACCESS-PORT-802.1X-MAB
switchport mode access
switchport access vlan 10
switchport voice vlan 100
authentication host-mode multi-domain
access-session host-mode multi-domain
access-session port-control auto
service-policy type control subscriber ENTERPRISE-ACCESS-POLICY
spanning-tree portfast
Operational Verification Commands
Switch# show authentication sessions interface GigabitEthernet1/0/1 details
Interface: GigabitEthernet1/0/1
MAC Address: 0050.56a1.2233
IPv4 Address: 192.168.10.45
User-Name: john.doe@corp.internal
Status: Authorized
Domain: DATA
Oper host mode: multi-domain
URL Redirect ACL: none
Session-Timeout: N/A
Common Session Id: 0A01641500000015A2B9C811
Acct Session Id: 0x00000018
Handle: 0x6C000015
Current Policy: ENTERPRISE-ACCESS-POLICY
Local Policies:
Server Policies:
Vlan Group: 10
SGT Value: 4 (Employees)
Method status list:
Method State
dot1x Authc Success
An enterprise deploys a standard campus desktop environment where an IP phone connects directly to an access switchport, and a user PC daisy-chains into the secondary PC port on the IP phone. The network security policy requires that the IP phone authenticates via MAB into the Voice VLAN while the PC independently authenticates via 802.1X EAP-TLS into the Data VLAN. If an unapproved second laptop is plugged into the phone, the switchport must trigger a violation. Which 802.1X host mode must be configured on the switchport?
A network administrator is troubleshooting an 802.1X deployment on corporate laptops. When users connect, the EAP negotiation begins successfully, but during the credential exchange, the Cisco ISE server rejects authentication and logs a failure code indicating that the client's presented digital certificate has expired. Which EAP method is being utilized in this scenario, and what certificate infrastructure does it require?
During a fiber-cut incident between a branch office and the corporate data center, all local access switches lose IP reachability to the centralized Cisco ISE RADIUS cluster. As employees arrive and connect their workstations to 802.1X-enabled ports, the switches experience a complete RADIUS server timeout. Which feature allows the switches to place these connecting users into a designated local subnet so they can continue working during the AAA outage?
An administrator is connecting 30 new network label printers to an 802.1X-enabled switch infrastructure. The printers do not have an 802.1X software supplicant and cannot process EAPoL frames. Which mechanism allows the switch to automatically discover the printers' MAC addresses and submit them to Cisco ISE as RADIUS credentials after 802.1X queries time out?