802.1X on the wired port: the identity layer segmentation depends on

Our article on segmentation under NIS2 contains a sentence with a precondition in it: a group-based rule ties security to a role assigned at authentication. This article is about the authentication.

Three roles, one closed port

802.1X is not a product but a framework with three parties. The supplicant is the end device that wants onto the network. The authenticator is the switch or access point: it provides the data link and can allow or block traffic. The authentication server — in practice a RADIUS service — receives the request and tells the authenticator whether the connection is permitted.

The decisive difference from an unprotected port is the order of events. Without 802.1X a port is open and security starts afterwards — at the routing, at the firewall, at the server. With 802.1X the port is closed until an independent third party has agreed. What happens next is decided by that same party: the assigned VLAN, a downloadable access list, a group membership.

How a device proves who it is

Supplicant and authentication server agree on an EAP method. Two approaches compete in practice: proof by certificate (EAP-TLS) and proof by username and password inside a protected tunnel (PEAP and relatives).

Certificates are the stronger method and, in a managed device fleet, the more convenient one: the user notices nothing, and there is no password to expire or mistype. The price is a working certificate distribution — and that, not the network configuration, sets the schedule in almost every project. How that distribution changes under shorter lifetimes is covered in the article on certificate lifetimes.

MAB: the exception you have to name

Not every device can identify itself. Printers, cameras, access readers, controllers and older measurement equipment often have no supplicant. That is what MAC Authentication Bypass is for: the port tries 802.1X first, and if no response arrives it authenticates to the server using the connected device's MAC address as username and password.

This is visibly weaker — a MAC address can be spoofed. MAB is therefore no substitute for 802.1X but a documented exception with a counterweight: a narrow VLAN, a hard access list, ideally supported by profiling that checks whether the device behaves like the thing it claims to be. A printer that suddenly opens SMB connections to file servers is not a printer any more.

The path that works without an outage

1. 01

   Survey at the port

   Which devices sit where, and which of them can identify themselves? The list comes from the network — MAC tables, DHCP leases, traffic capture — not from the asset database.

2. 02

   Build RADIUS and the identity source

   The authentication service connected to the directory, deployed redundantly. A failure of this component must not mean nobody gets onto the network — the behaviour when it is unreachable belongs explicitly configured.

3. 03

   Monitor mode

   Ports authenticate but do not block. For weeks. The log shows which devices would fail — and those are always more, and different, than the survey suggested.

4. 04

   Resolve exceptions instead of collecting them

   Every failing device gets a decision: add a supplicant, permit via MAB with a narrow profile, or take it off the network. A growing exception list without decisions is the most common failure pattern.

5. 05

   Enforce in stages

   Area by area, starting where the device fleet is best managed. Not site-wide over a weekend — withdrawing a failed rollout costs more trust than the rollout saves time.

6. 06

   Keep the evidence

   Who authenticated when, on which port, and which role was assigned? Those logs later prove that access control is not merely configured but effective.

Where it fails in practice

• Devices that must talk before the operating system does. Network boot and pre-boot remote management need their own arrangement, or the machine stops booting.
• Phones and computers on the same port. Voice and data on one cable means two authentications on one port — that has to be intended on both sides.
• Small switches under the desk. An unmanaged five-port switch between wall socket and device defeats port-level assignment. You find those only in monitor mode.
• Failure of the authentication service. Without defined behaviour when the server is unreachable, a server problem becomes a network outage. That configuration belongs tested, not assumed.
• Meeting rooms and guest ports. They need their own deliberately designed path — otherwise the first permanent exception appears exactly where visitors sit.

How we plan access control, accompany it through monitor mode and hand it into regular operations is described under network security; its place in the wider architecture under enterprise networks.