802.1X: who is allowed on your network, and how do you know?
In most corporate networks one simple rule still applies: plug a cable into a wall socket and you are on the network. A port in a meeting room, a socket behind a reception desk, a spare outlet in a plant room - all of them grant access without anyone having to prove who they are. That is why 802.1X exists.
What it is
802.1X is a standard for access control at port level. The device asking for access (the supplicant) identifies itself to the switch or access point (the authenticator), which puts the question to a central server (the authentication server, in practice almost always RADIUS). Only once that server approves does the port open. Until then the switch passes the login exchange and nothing else.
The question "who are you" is asked using EAP. Which variant you pick determines how strong the whole thing is:
- EAP-TLS uses certificates on both sides. It is the strongest option and the only one where a stolen password buys an attacker nothing. It does require that you can issue and revoke certificates.
- PEAP and EAP-TTLS use a username and password inside a TLS tunnel. Simpler to roll out, but the strength depends on the password and on whether the device actually validates the server certificate. If it does not, a fake network is enough to capture the credentials.
What it is really about: what happens after access is granted
The biggest gain from 802.1X is not turning unknown devices away. It is that on approval the RADIUS server can also say where the device belongs: a dynamic VLAN, an access list, a bandwidth limit. An employee laptop lands in the office network, a camera in the camera network, an unknown device in a guest network with no route to anything else.
That makes 802.1X the hinge between identity and segmentation. Without it, a segmented network means assigning ports by hand, and no organisation keeps that up for years.
Four things that go wrong in practice
Devices that cannot do 802.1X. Printers, cameras, card readers, climate systems: a large share of what hangs on a network has never heard of the standard. MAB exists for those, where the switch treats the MAC address as the identity. That is weak - a MAC address is trivially spoofed - so MAB belongs with a strictly segmented target network and with profiling that checks whether the device behaves like the printer it claims to be.
The order of authentication. Put MAB before 802.1X and a device that does have certificates will still fall back to its MAC address as soon as the first attempt takes a moment. 802.1X first, MAB as the fallback, never the other way around.
Unmanaged switches and IP phones. More than one device can sit behind a single port. If the port opens for everything after one successful authentication (single-host or multi-host), one authenticated device is enough to hang an unmanaged switch behind it. Multi-domain or multi-auth, where every device authenticates separately, prevents that.
The rollout itself. Enforcing 802.1X across an existing network in one go is guaranteed to take something down that nobody had on the list. The workable order is: a monitor mode first, where the switch authenticates but locks nobody out; a few weeks of watching who would have been refused; then enforcement, building by building or floor by floor rather than everywhere at once.
When do you need it?
Not every organisation does. If the whole network sits behind one locked door and nothing on it is reachable by an outsider, the gain is limited. The question becomes urgent as soon as there are network ports in places where the public, suppliers or subcontractors come; as soon as third-party equipment hangs on the network; or as soon as a standard such as IEC 62443, or a tender, sets requirements.
And it is not an all-or-nothing decision. Starting with the buildings that have public areas, and letting the rest follow once the way of working is settled, is nearly always the sensible route.