How 802.1X and RADIUS Work: Network Access Control on Every Port (Animated)

Without 802.1X, anyone who plugs a cable into an office wall socket, or joins Wi-Fi, lands on the network. With it, the switch or access point keeps the port closed until a RADIUS server confirms who the device is. It’s the same system behind WPA2/WPA3-Enterprise Wi-Fi.

1. Knock on the port: eapol: the port only allows authentication

When a device connects, the switch port allows only 802.1X (EAPOL) traffic until the device is approved.

1. EAPOL-Start (Staff laptop → Switch port): The laptop starts authentication.
2. EAP-Request (Switch port → Staff laptop): The switch asks for an identity.

Wireshark filter:

eapol

2. Ask radius: the switch forwards to the radius server

The switch doesn’t decide. It wraps the device’s EAP messages in RADIUS and passes them to the server, which runs a TLS exchange with the device’s certificate (EAP-TLS).

1. EAP-Response (Staff laptop → Switch port): The laptop answers.
2. Access-Request (Switch port → RADIUS server): The switch relays it, adding which port it came from.
3. EAP-TLS (RADIUS server → Staff laptop): The laptop and RADIUS server run a TLS exchange; the laptop’s certificate proves it’s a company device.

Wireshark filter:

radius

3. Accept & vlan: port opens, right network assigned

RADIUS approves and tells the switch which VLAN to put the device in. Only now can normal traffic flow.

1. Access-Accept (RADIUS server → Switch port): Approved, with a VLAN.
2. EAP-Success (Switch port → Staff laptop): The port opens.
3. DHCP / DATA (Staff laptop → Office network): The laptop gets an address and works normally.

Wireshark filter:

radius.code == 2

4. Rogue device: attack: plugging into an open wall port

Without 802.1X the switch lets any device on as soon as it is plugged in: a visitor’s laptop, a hidden mini-computer left behind a printer, or an attacker posing as a contractor. They are instantly inside the network.

1. DHCP (Unknown device → Office network): The unknown device asks for an address, and gets one.
2. DHCP ACK (Office network → Unknown device): It can now reach internal servers like any staff PC.

Wireshark filter:

eth.src == ee:00:00:00:00:66

5. 802.1x everywhere: defence: no approval, no network

Enable 802.1X on every access port and on Wi-Fi (WPA2/WPA3-Enterprise), prefer certificate-based EAP-TLS, put unknown devices in a guest or quarantine VLAN, and alert on repeated failures.

1. DHCP (Unknown device → Switch port): Without a valid certificate the port never opens.

Switch config (cisco):

aaa new-model
dot1x system-auth-control
interface range Gi1/0/1-48
 authentication port-control auto
 dot1x pae authenticator

FAQ