802.1X NAC for Wired and Wireless Authentication

Introduction

802.1X is the IEEE standard for port-based network access control. It prevents unauthorized devices from connecting to your network by requiring authentication before granting network access — on wired ports (switches) and wireless (Wi-Fi). This guide covers deploying 802.1X authentication using RADIUS (FreeRADIUS or Windows NPS) for both wired and wireless networks.

How 802.1X Works

TEXT

Device (Supplicant)  →  Switch/AP (Authenticator)  →  RADIUS Server (Auth Server)
        │                          │                            │
        │──── EAP Start ──────────►│                            │
        │                          │──── RADIUS Access-Request ►│
        │◄─── EAP Identity ────────│◄─── RADIUS Access-Challenge│
        │──── Username ───────────►│──── RADIUS Access-Request ►│
        │                          │◄─── RADIUS Access-Accept ──│
        │◄─── Network Access ──────│                            │

Setting Up FreeRADIUS

BASH

# Install FreeRADIUS
sudo apt install freeradius freeradius-utils

# Configure clients (authenticators: switches, APs)
sudo nano /etc/freeradius/3.0/clients.conf

TEXT

# /etc/freeradius/3.0/clients.conf
client cisco-switch-01 {
    ipaddr = 192.168.1.1
    secret = SharedSecretKey123!
    shortname = sw01
    nastype = cisco
}

client wifi-ap-01 {
    ipaddr = 192.168.1.2
    secret = WifiSharedSecret456!
    shortname = ap01
    nastype = other
}

Configure users/Active Directory integration:

BASH

# /etc/freeradius/3.0/mods-enabled/ldap
ldap {
    server = "192.168.1.10"
    port = 389
    identity = "CN=radius-svc,OU=Service Accounts,DC=company,DC=local"
    password = "RadiusServicePass!"
    base_dn = "DC=company,DC=local"
    user {
        base_dn = "${..base_dn}"
        filter = "(sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}})"
    }
}

BASH

# Test FreeRADIUS configuration
sudo freeradius -X  # Debug mode - shows all packets

# Test authentication
radtest username password 127.0.0.1 0 testing123

# Check certificate for EAP-TLS
openssl verify -CAfile /etc/freeradius/3.0/certs/ca.pem     /etc/freeradius/3.0/certs/server.pem

Cisco Switch 802.1X Configuration

TEXT

! Enable 802.1X globally
aaa new-model
aaa authentication dot1x default group radius
aaa authorization network default group radius
aaa accounting dot1x default start-stop group radius

! Configure RADIUS server
radius server NPS-01
  address ipv4 192.168.1.10 auth-port 1812 acct-port 1813
  key SharedSecretKey123!

dot1x system-auth-control

! Configure access port
interface GigabitEthernet1/0/1
  switchport mode access
  switchport access vlan 10
  dot1x port-control auto          ! Require 802.1X
  dot1x timeout quiet-period 10
  dot1x max-reauth-req 2
  spanning-tree portfast
  authentication event fail action authorize vlan 99  ! Guest VLAN on failure
  authentication event no-response action authorize vlan 99

Dynamic VLAN Assignment

RADIUS can assign VLANs dynamically based on user/device identity:

TEXT

# FreeRADIUS policy: assign VLAN based on AD group
# /etc/freeradius/3.0/policy.d/vlan-assignment
if (LDAP-Group == "IT-Staff") {
    reply:Tunnel-Type = VLAN
    reply:Tunnel-Medium-Type = IEEE-802
    reply:Tunnel-Private-Group-Id = "20"   # IT VLAN
}
elsif (LDAP-Group == "Finance") {
    reply:Tunnel-Type = VLAN
    reply:Tunnel-Medium-Type = IEEE-802
    reply:Tunnel-Private-Group-Id = "30"   # Finance VLAN
}
else {
    reply:Tunnel-Type = VLAN
    reply:Tunnel-Medium-Type = IEEE-802
    reply:Tunnel-Private-Group-Id = "99"   # Guest VLAN
}

Windows NPS (Network Policy Server)

Windows NPS is the Microsoft RADIUS server, ideal if you use Active Directory:

TEXT

NPS Setup:
1. Server Manager → Add Roles → Network Policy and Access Services
2. NPS Console → RADIUS Clients and Servers → RADIUS Clients
   → New Client:
     Name: cisco-switch-01
     Address: 192.168.1.1
     Shared secret: SharedSecretKey123!

3. Network Policies → New Policy:
   Name: "802.1X Wired Access"
   Conditions:
     - NAS-Port-Type = Ethernet
     - Windows Groups = COMPANYAll Employees
   Settings:
     - Authentication: Protected EAP (PEAP)
     - MS-CHAP v2 (for AD password auth)

Wireless 802.1X (WPA2-Enterprise)

TEXT

# Cisco Wireless LAN Controller configuration
wlan 802.1x-corp 1 Corp-WiFi
  security wpa akm dot1x
  security wpa wpa2 ciphers aes
  radius server auth add 192.168.1.10 1812 key SharedSecret
  no shutdown

# Client configuration (Windows):
# Network Settings → Properties → Security:
# Authentication: WPA2-Enterprise
# Encryption: AES
# EAP method: PEAP
# Inner method: MS-CHAP v2
# Use Windows credentials: Yes (SSO with AD)

Certificate-Based Authentication (EAP-TLS)

BASH

# Create CA and certificates for EAP-TLS
cd /etc/freeradius/3.0/certs

# Generate CA (Certificate Authority)
openssl req -new -x509 -keyout ca.key -out ca.pem -days 3650   -subj "/C=US/O=Company/CN=Company CA"

# Generate server certificate for RADIUS
openssl req -new -keyout server.key -out server.csr   -subj "/C=US/O=Company/CN=radius.company.com"
openssl x509 -req -in server.csr -CA ca.pem -CAkey ca.key   -out server.pem -days 3650

# Generate client certificate for device authentication
openssl req -new -keyout client.key -out client.csr   -subj "/C=US/O=Company/CN=laptop01.company.com"
openssl x509 -req -in client.csr -CA ca.pem -CAkey ca.key   -out client.pem -days 3650

# Install client certificate via GPO on Windows
# Computer Configuration → Windows Settings → Security Settings
# → Public Key Policies → Certificate Services Client - Auto-Enrollment

Troubleshooting 802.1X

BASH

# FreeRADIUS debug mode (shows all authentication attempts)
sudo systemctl stop freeradius
sudo freeradius -X 2>&1 | tee /tmp/radius-debug.log

# Test a specific user
radtest john.smith Password123 127.0.0.1 0 SharedSecret

# Cisco switch: check 802.1X status on port
show dot1x interface GigabitEthernet1/0/1
show authentication sessions interface GigabitEthernet1/0/1

# Common failure reasons:
# 1. Wrong shared secret (client vs server mismatch)
# 2. Certificate not trusted (client doesn't trust RADIUS server cert)
# 3. User not in correct AD group
# 4. Machine account not in correct OU (for machine auth)

802.1X deployment is a significant security improvement but requires coordination between network, identity, and endpoint teams. Start with monitoring mode (don't block, just log), verify everything works, then switch to enforcement mode.