Configuring and Verifying RADIUS and 802.1X for Network Access Control

The 802.1X Authentication Framework

While our previous lesson on TACACS+ dealt with device administration, 802.1X and RADIUS deal with network access. It's the difference between securing the door to the security office versus having a security guard at the building's main entrance checking everyone's ID.

The 802.1X standard defines three key roles in this process:

1. Supplicant: The end device requesting access (e.g., a user's laptop, an IP phone, a printer). It runs client software that can respond to authentication requests.
2. Authenticator: The network device that guards the network edge, typically a switch or a wireless access point. It acts as an intermediary, blocking or allowing traffic based on the authentication result.
3. Authentication Server: The centralized server that makes the authentication decision. It holds the database of users, devices, and policies. This is almost always a RADIUS server, like Cisco's Identity Services Engine (ISE).

To kick things off, let's watch a video that introduces these concepts and explains how the Extensible Authentication Protocol (EAP) is used to carry the authentication messages.

As the video explained, the authenticator (switch) doesn't understand the user's password. It simply packages the EAP messages from the supplicant into RADIUS packets and forwards them to the authentication server. This process is called EAP over LAN (EAPoL) between the supplicant and authenticator, and EAP over RADIUS between the authenticator and the server.

The image below shows this message flow clearly.

A switch port configured for 802.1X exists in one of two states:

• Unauthorized: This is the default state. The port blocks all user traffic except for specific control plane packets needed for authentication, like EAPoL, CDP, and STP.
• Authorized: After the authentication server validates the supplicant and sends a RADIUS Access-Accept message, the port transitions to this state and allows normal data traffic to pass.

Core Configuration of 802.1X and RADIUS

Now, let's translate these concepts into a Cisco IOS XE configuration. The process involves global settings for AAA and 802.1X, and specific settings on the interfaces where you want to enforce access control.

The following guide provides the definitive commands and steps.

Based on that guide, here is a summary of the essential configuration steps:

1. Enable AAA Globally and Define the RADIUS Server:
   Just like with TACACS+, you must enable aaa new-model. You then define your RADIUS server's IP address and the shared secret key.

   ! Enable the AAA framework
   aaa new-model
   
   ! Define the RADIUS server (e.g., Cisco ISE)
   ! Note: 'key' must match the configuration on the RADIUS server
   radius server MY_ISE_SERVER
    address ipv4 10.10.10.101 auth-port 1812 acct-port 1813
    key MySharedSecretKey123
   exit
   
   ! (Best Practice) Group servers for redundancy and scalability
   aaa group server radius ISE_GROUP
    server name MY_ISE_SERVER
   exit
   

2. Configure AAA Method Lists for 802.1X:
   This tells the switch to use your RADIUS server group for 802.1X authentication requests.

   ! Use the 'ISE_GROUP' for all dot1x authentication requests
   aaa authentication dot1x default group ISE_GROUP
   

3. Enable 802.1X Globally:
   This command activates the 802.1X feature on the switch.

   ! Globally enable the 802.1X protocol
   dot1x system-auth-control
   

4. Configure the Access Interfaces:
   Finally, apply the policy to the physical ports where end-users will connect.

   interface GigabitEthernet1/0/1
    switchport mode access
    ! Set the port to control access based on authentication
    authentication port-control auto
    ! Define this port's role as an authenticator
    dot1x pae authenticator
   exit
   

Adding MAC Authentication Bypass (MAB)

What about devices that don't have an 802.1X supplicant, like printers, cameras, or simple IoT sensors? They can't participate in an EAP exchange. For these devices, we use MAC Authentication Bypass (MAB).

With MAB, the switch waits for the 802.1X process to time out. It then takes the client's source MAC address and uses it as both a username and password in a RADIUS request to the authentication server. The server checks if this MAC address is in a known-device database and responds accordingly.

To add MAB as a fallback to an 802.1X port, you simply add one command to the interface:

interface GigabitEthernet1/0/1
 ! ... (previous dot1x commands) ...
 ! Enable MAB on this interface
 mab

Modern Configuration with IBNS 2.0 Policy Maps

While the basic commands work, modern IOS XE versions use a more flexible and powerful framework called Identity-Based Networking Services (IBNS) 2.0. This uses policy maps—similar to QoS—to define a sophisticated sequence of authentication events.

This approach is highly reflective of real-world enterprise configurations. Let's explore a practical template.

Let's break down the logic from that article's policy map. It's a sequence of event -> class -> action.

policy-map type control subscriber DOT1X_MAB_POLICY
  ! Event: A new device connects and a session starts
  event session-started match-all
   10 class always do-until-failure
    10 authenticate using dot1x priority 10  // Action: First, try 802.1X

  ! Event: An authentication method fails
  event authentication-failure match-first
   5 class DOT1X_FAILED do-until-failure    // Class: If 802.1X fails authoritatively
    10 terminate dot1x                      // Action: Stop trying dot1x
    20 authenticate using mab priority 20   // Action: Now, try MAB

   30 class DOT1X_NO_RESP do-until-failure  // Class: If client doesn't respond to dot1x
    10 terminate dot1x
    20 authenticate using mab priority 20   // Action: Fallback to MAB
    
   50 class MAB_FAILED do-until-failure     // Class: If MAB also fails
    10 terminate mab
    20 authentication-restart 60            // Action: Wait 60s and try again

This policy is then applied to the interface with a single command:
service-policy type control subscriber DOT1X_MAB_POLICY

This policy-based approach provides much more granular control over the authentication sequence compared to the legacy commands.

Verification and Troubleshooting

Once 802.1X is configured, verification is key. You need to confirm that clients are being authenticated correctly and troubleshoot those that are not.

Let's watch a detailed video lab that covers the full process, from server setup to switch configuration and verification.

The single most useful command for verification on the switch CLI is:

show authentication sessions interface <interface-id> detail

This command shows you:

• Interface: Which port the session is on.
• MAC Address: The client's MAC address.
• Method: The authentication method used (e.g., dot1x, mab).
• Status: The current status (Authz Success, Authz Failed).
• VLAN Policy: The VLAN the user was assigned to by the RADIUS server.

As shown in the video, when troubleshooting, your first step is to check show authentication sessions on the switch. Your second, more powerful step, is to check the Live Logs on the RADIUS server (ISE). The server will give you a detailed reason for any failure, such as "User not found" or "Wrong password".

Conclusion

In this lesson, we secured network access at the port level using the 802.1X and RADIUS framework. This is a fundamental security control for any modern enterprise network, preventing unauthorized devices from gaining a foothold.

Key Takeaways:

• 802.1X is a port-based access control framework involving a Supplicant, Authenticator, and Authentication Server.
• EAP is the protocol used to carry credentials, while RADIUS is the protocol used to communicate with the authentication server.
• Basic configuration involves enabling AAA and 802.1X globally, defining the RADIUS server, and setting the port control to auto on access interfaces.
• MAC Authentication Bypass (MAB) serves as a crucial fallback mechanism for devices that do not support 802.1X.
• Modern IBNS 2.0 configurations use flexible policy maps to orchestrate the authentication sequence for 802.1X, MAB, and failure scenarios.
• Verification relies on the show authentication sessions command on the switch and, most importantly, the Live Logs on the RADIUS server.

Preview of the Next Lesson:

We have now covered two major pillars of network access security: device administration (TACACS+) and network admission control (RADIUS/802.1X). In our next lesson, we will pivot to Layer 2 resiliency by exploring a critical protocol for building loop-free, scalable switched networks: Analyze the operation and configuration of Multiple Spanning Tree Protocol (MST).