What Is 802.1X Authentication?

802.1X is the protocol that authenticates a device before it is granted network access, and the mechanism most network access control systems are built on. It operates at the point of connection — the switch port or the wireless association — before an address is issued.

Three components

The supplicant is software on the device that presents credentials. The authenticator is the switch or access point controlling the port. The authentication server, almost always RADIUS, makes the decision.

Until authentication succeeds, the port passes only authentication traffic. That is the property that distinguishes it from controls applied after a device is already on the network.

Certificates rather than passwords

The authentication method matters considerably. Password-based methods are simpler to deploy and expose credentials to brute-force and relay attacks, particularly on wireless networks where an attacker can stand a rogue access point nearby.

Certificate-based authentication is materially stronger: the device proves possession of a private key, there is no password to capture, and mutual authentication means the device also verifies the network. It requires a certificate infrastructure and device enrolment, which is the reason it is less common and the reason it is worth the effort in estates where it is feasible.

Where implementations are weakened

Clients configured not to validate the authentication server's certificate, which permits a rogue network to harvest credentials. Fallback to open access when the RADIUS server is unreachable, which turns an availability problem into an access control failure. And MAC-based bypass for devices that cannot authenticate, applied more broadly than necessary.

The fallback behaviour is worth deciding deliberately. Failing open keeps people working during an outage; failing closed preserves the control. Most organisations choose open and should at least know they have.

Wired ports deserve it as much as wireless

Deployment concentrates on wireless because the exposure is obvious. Wired ports in meeting rooms, reception areas, corridors and unoccupied desks are equally reachable by anyone inside the building and are frequently unauthenticated.

The reason is practical: wired deployment touches every switch and every device, including the printers and appliances that cannot authenticate, and the failure mode is a device that will not connect.

Phasing by area addresses this — public and semi-public spaces first, where the exposure is highest and the device population is smallest, then expanding into general office areas once the exceptions are understood.

The RADIUS infrastructure behind it is frequently the overlooked dependency. It authenticates every connection, so its availability determines network access, and its compromise affects authentication decisions across the estate. It deserves redundancy, monitoring and the access controls appropriate to something that sits in front of the network.

A common mistake worth avoiding

Where to start

Check whether your wireless clients validate the RADIUS server certificate. It is a client configuration setting, it is frequently disabled during troubleshooting, and it undermines the whole mechanism when it is.

See wireless security. GuardsArm delivers wireless penetration testing.