UK What 802.1X does
802.1X is the IEEE standard for port-based network access control. It lets a network check who or what is connected before granting access. Without it, anything plugged into a live Ethernet socket, or any device that knows the Wi-Fi password, joins the network. With it, the switch port or access point stays closed to everything except authentication messages until the device has proved its identity.
The standard was first published in 2001 for wired Ethernet and extended to wireless LANs in 2004. The current edition is IEEE 802.1X-2020. It is the mechanism behind WPA2-Enterprise and WPA3-Enterprise Wi-Fi, and on wired networks it is the main way to stop unauthorised devices at the access switch.
802.1X does not encrypt traffic by itself, and it does not decide which credentials are acceptable. It defines how a device presents credentials and how the switch passes them to a server that makes the decision. Encryption on the wire, where needed, comes from MACsec (IEEE 802.1AE), which 802.1X can key.
How 802.1X authentication works
Three parties take part, and the messages between them use two protocols: EAP over LAN (EAPOL) between the device and the switch, and RADIUS between the switch and the server.
-
//
Supplicant. The device asking for access, or the software on it that holds the credentials. Windows, Linux, macOS, phones and many printers and IP phones include one.
-
//
Authenticator. The managed switch or wireless access point. It blocks the port, relays EAP messages and opens the port when the server says yes.
-
//
Authentication server. Usually a RADIUS server, defined in IETF RFC 2865. It checks the credentials against a directory or certificate authority and can return settings such as a VLAN.
-
//
The exchange. The switch asks the device for its identity, the device answers, and the server and device run an EAP method through the switch. Success opens the port; failure leaves it closed or moves it to a restricted VLAN.
-
//
Re-authentication. The switch can repeat the check at intervals and closes the port when the link drops, so a device cannot be swapped behind an authorised session.
EAP methods compared
EAP, the Extensible Authentication Protocol (RFC 3748), is a framework, so the actual proof of identity depends on the EAP method both sides agree on. The method decides how secure the login is and how much set-up it needs.
| EAP method | Device proves identity with | Mutual authentication | Typical use |
|---|---|---|---|
| EAP-TLS (RFC 5216) | Client certificate | Yes, certificates on both sides | Managed company devices; the strongest common option |
| PEAP (MSCHAPv2 inside) | User name and password in a TLS tunnel | Server certificate only | Windows domains and user logins |
| EAP-TTLS (RFC 5281) | Password or other method in a TLS tunnel | Server certificate only | Mixed operating systems |
| EAP-FAST (RFC 4851) | Protected credential or password | Yes, via a shared credential | Older Cisco-centred networks |
| EAP-MD5 | Password hash | No | Legacy wired use only; avoid |
For fixed equipment such as industrial PCs, gateways and HMIs, EAP-TLS is usually the right choice: each system gets its own certificate, there is no shared password to leak, and a certificate can be revoked when the system is retired. On a PC with a TPM 2.0 chip, the private key can be held in the TPM so it cannot be copied off the drive. Our explainer on what a TPM is covers how that works.
802.1X on OT and industrial networks
Industrial networks are where 802.1X is most useful and hardest to apply. A cabinet socket or a spare switch port on a production line is an easy way in, and standards such as IEC 62443-3-3, whose system requirements include identifying and authenticating devices, and NIST SP 800-82 both point towards controlling which devices can connect. Our page on IT vs OT explains why plant networks are secured differently from office ones.
The difficulty is that many field devices, such as PLCs, drives, remote I/O, sensors and older cameras, have no supplicant at all. Plants usually combine several measures.
-
//
802.1X where a supplicant exists. Industrial PCs, HMIs, engineering laptops and gateways running Windows or Linux can authenticate with certificates.
-
//
MAC authentication bypass. Many switches can fall back to checking a device’s MAC address against the RADIUS server. It is weaker, because MAC addresses can be copied, but it keeps an inventory of allowed devices.
-
//
Dynamic VLAN assignment. The RADIUS server places each device in the right VLAN for its role, which ties access control to segmentation.
-
//
Static port security. For a fixed machine cell, locking each port to known MAC addresses and disabling unused ports may be enough.
Where 802.1X runs in our range
Port-based 802.1X is one of the most widely listed security features in our switch range. Our managed industrial switches commonly list IEEE 802.1X together with RADIUS, TACACS+, access control lists and IP source guard, and the board-level embedded Ethernet switches list IEEE 802.1X for vehicle and rugged systems. RADIUS is used for 802.1X device logins; TACACS+, where listed, is typically used for administrators logging in to manage the switch itself.
Quick answers on 802.1X
802.1X: common questions
What is 802.1X used for?
Stopping unknown devices joining a network. It authenticates each device or user at the switch port or access point before any normal traffic is allowed.
Is 802.1X obsolete?
No. It is maintained by the IEEE, revised in 2020, and remains the basis of enterprise Wi-Fi security and wired network access control.
Should I enable IEEE 802.1X authentication?
Only if the network asks for it. On a device, turn it on when your network administrator has set up 802.1X and given you credentials. On a network without it, enabling the client setting simply stops the connection working.
Is 802.1X the same as RADIUS?
No, they work together. 802.1X runs between the device and the switch. RADIUS runs between the switch and the server that makes the decision.
Can 802.1X work with devices that have no supplicant?
Partly. MAC authentication bypass lets the switch check the device’s MAC address instead, but it is weaker than certificate-based 802.1X.
We supply managed industrial switches and industrial PCs as part of a complete system, and as standard we can configure 802.1X, RADIUS settings and device certificates to your security policy before it ships.