802.1X Port-Based Authentication on Access Switches

802.1X is the mechanism behind "the port stays closed until the device proves who it is", and it is the foundation of most network access control deployments. The protocol itself is simple - three roles and EAPOL frames between them - but the deployment has many moving parts: RADIUS reachability, host modes, VLAN assignment, and fallback behaviour when the authentication server is down. This article covers the roles, the configuration shape on Cisco IOS/IOS XE and HPE switches, and the checks that separate an authentication failure from a transport failure.

The Three Roles

• Supplicant: the endpoint (laptop, phone, printer) that sends credentials in EAPOL frames. It only starts when the link comes up, which is why a switchport can look "up" but not forwarding.
• Authenticator: the switch port. It relays EAP between the supplicant and the RADIUS server and enforces the result by controlling the port state.
• Authentication server: RADIUS, usually with a policy engine (for example Cisco ISE) that decides authorisation, VLAN, and ACL.

Configuration Shape on Cisco IOS XE

! 1. AAA plumbing
aaa new-model
aaa authentication dot1x default group radius
aaa authorization network default group radius
aaa accounting dot1x default start-stop group radius
radius server ISE
 address ipv4 10.20.30.40 auth-port 1812 acct-port 1813
 key STRONG_RADIUS_KEY

! 2. device tracking and DHCP snooping help build endpoint identity
ip device tracking
ip dhcp snooping
ip dhcp snooping vlan 10-20

! 3. the port
interface GigabitEthernet1/0/1
 switchport mode access
 switchport access vlan 10
 authentication host-mode multi-auth
 authentication port-control auto
 authentication periodic
 authentication timer reauthenticate server
 dot1x pae authenticator
 spanning-tree portfast
 mab                        ! fallback for devices that cannot do 802.1X

Host mode decides how many devices can share a port: single-host (one MAC, most secure), multi-auth (each MAC authenticates separately, the usual choice for a wall port shared with a phone), and multi-domain (one data plus one voice device). Getting host mode wrong is the most common cause of "only one device works on this port".

Dynamic VLAN and ACL Assignment

RADIUS can return the VLAN and ACL to apply, which is how a single switch configuration serves many user groups:

Tunnel-Type            = VLAN (13)
Tunnel-Medium-Type     = 802 (6)
Tunnel-Private-Group-ID = 20        ! VLAN name or ID

! verify what was applied
show authentication sessions interface GigabitEthernet1/0/1
show authentication sessions interface GigabitEthernet1/0/1 details

The port VLAN cannot equal the voice VLAN on the same port, and 802.1X is supported on Layer 2 access, Layer 2 trunk, voice-VLAN-enabled and Layer 3 routed ports - but voice VLAN plus a dynamically assigned data VLAN needs multi-domain mode, not single-host.

Equivalent on HPE/Aruba Switch OS

aaa authentication port-access eap-radius
aaa port-access authenticator 1-24
aaa port-access authenticator active
radius-server host 10.20.30.40 key STRONG_RADIUS_KEY
show port-access authenticator
show port-access authenticator interface 5

Troubleshooting Order

1. Port state: "unauthorized" plus a healthy link means credentials or RADIUS, not cabling.
2. RADIUS reachability: test from the device (test aaa group radius user pass new-code) - a stale shared secret produces total silence, not an error.
3. NTP: accounting and certificate validation both need accurate time; a clock skew of minutes breaks EAP-TLS before anything else does.
4. Supplicant logs: on Windows, the wired autoconfig service must run - a disabled service looks exactly like a switch problem.
5. Fallback: decide and test what happens if the RADIUS server dies - critical ports should have MAB, a fallback VLAN, or an explicit open policy, and that decision needs to be documented, not discovered.

Related reading: RADIUS vs TACACS+ and Cisco AAA configuration, Cisco DHCP snooping configuration and ArubaOS-CX DHCP snooping.

原文链接：Cisco: 802.1X Authentication Services configuration guide