Walk me through 802.1X. What are the three roles, and what happens when a laptop plugs in?
Show the answer
Say this first
The supplicant is the client, the 802.1X software on the laptop. The authenticator is the switch or wireless controller. The authentication server is a RADIUS server such as Cisco ISE, Aruba ClearPass, FreeRADIUS or Microsoft NPS. The supplicant speaks EAP over LAN (EAPOL) to the switch, the switch carries the EAP messages inside RADIUS to the server, and until the server sends Access-Accept the port passes only EAPOL. After the accept the port opens, possibly with a VLAN or ACL the server chose.
Go deeper
Step by step on a wired port
- Link comes up. The port is unauthorized: only EAPOL (EtherType 0x888E, sent to 01:80:C2:00:00:03), plus link protocols like CDP, LLDP and STP, are allowed.
- The switch sends EAP-Request/Identity, or the client starts with EAPOL-Start. Cisco switches
resend the request every 30 seconds by default (
dot1x timeout tx-period). - The client answers with EAP-Response/Identity. In tunneled methods this outer identity can be anonymous.
- The switch builds a RADIUS Access-Request with the EAP message plus its own details: NAS IP, port, and the client MAC in Calling-Station-Id.
- The client and server run the EAP method (for example a TLS handshake for EAP-TLS) through several Access-Challenge rounds. The switch only relays and never sees the credentials.
- The server sends Access-Accept with optional policy: VLAN (Tunnel-Private-Group-ID with Tunnel-Type VLAN and Tunnel-Medium-Type 802), a downloadable ACL, a security group tag, a reauthentication timer. The switch sends EAP-Success to the client.
- The port is authorized for that MAC and accounting starts.
Minimum switch configuration
aaa new-model
aaa authentication dot1x default group ISE-RADIUS
aaa authorization network default group ISE-RADIUS
dot1x system-auth-control
!
interface GigabitEthernet1/0/10
switchport mode access
authentication port-control auto
dot1x pae authenticatoraaa authorization network is what lets the switch apply a VLAN or ACL from the server.
They will ask next
What changes on wireless?
The AP or controller is the authenticator, and the EAP method produces keying material that the RADIUS server sends to the controller. The controller then runs the WPA 4-way handshake with the client to derive the encryption keys.
What if the device has no supplicant at all?
MAB, using its MAC address as the identity, or web authentication for guests. On older designs a guest VLAN catches devices that never answer EAPOL.
Traps
- Saying the switch checks the user's password. It relays EAP and never sees the credentials in tunneled methods.
- Forgetting
dot1x system-auth-control. Without it the port commands do nothing.