What Is 802.1X? Port-Based Access Control on a Corporate Network
The most overlooked opening on a corporate network is also the most visible one: the spare ethernet socket in the meeting room. Anyone who plugs in a cable — a visitor, an intern, a service engineer, a cleaner — lands inside the network. Wireless is slightly better, but if a single shared WPA2 passphrase is in use it amounts to the same thing: everyone who knows it sits on the same network with the same rights.
802.1X fixes this at the root. It ties the connection not to the port but to an identity: a device joins the network only after the person behind it has been verified.
How it works
Three parties, all of them standard components:
- Supplicant: the laptop or phone itself. Built into Windows, macOS, iOS, Android and Linux — nothing to install.
- Authenticator: the switch or access point. It holds the door; it does not decide.
- Authentication server: the RADIUS server. It verifies the user and tells the switch what to do.
When a device plugs in or tries to join the wireless network, the switch passes only authentication traffic; nothing else moves. The username and password reach the RADIUS server, and the port opens only if the server says accept. If it refuses, the cable is connected and there is still no network.
EAP methods: which one when
802.1X carries credentials over EAP, and in practice two methods cover almost every corporate network:
EAP-PEAP-MSCHAPv2
The common one. Username and password travel inside a TLS tunnel established with the server's certificate. The user accepts that certificate on first connect; after that it is silent. Passwords are not stored in plain text on the network side.
EAP-TTLS-PAP
Used when you want authentication to happen in your existing directory. The password still travels inside the TLS tunnel, but verification is asked of your Active Directory or LDAP server. Staff then join the network with the domain account they use every day — no separate network password, and removing someone from the directory removes their network access too.
VLAN assignment: the real payoff
802.1X does more than decide pass or fail. On success the RADIUS server can also tell the switch which VLAN to use — the standard is RFC 3580 and the attribute is Tunnel-Private-Group-Id.
In practice this means two people plugging into the same socket end up on two different networks. Someone from finance opens in the finance VLAN, someone from production in the production VLAN. The person decides, not the port — and moving somebody's desk changes no network configuration.
- Staff → corporate VLAN
- Visitors → guest VLAN with internet access and no view of the internal network
- Contractors → restricted VLAN reaching only the relevant systems
What about devices that cannot do 802.1X?
Not every device has a supplicant: printers, IP cameras, POS terminals, some IoT devices and older production equipment cannot authenticate themselves. This is where 802.1X projects most often stall — and the answer is part of the standard.
MAC-Bypass (MAB) admits these devices by their MAC address. The switch sees no 802.1X response, asks the RADIUS server about the MAC address, and opens the port if it is on the list.
Because a MAC address is a forgeable identity, MAB is best set up as an exception: only for devices that genuinely need it, in their own VLAN where possible, and with an end date when one applies.
Rollout order
- Define users and groups. Give each group a VLAN id. Keeping the number of groups small makes every later step easier.
- Register switches and access points as RADIUS clients. Each device gets a shared secret and uses it to talk to the server.
- Distribute your EAP server certificate. Clients recognise the server by it. Pushing a profile to managed devices beats showing users a certificate prompt.
- Try one switch and one VLAN first. Enforcing 802.1X across the whole network at once can take the entire organisation offline on a single misconfiguration. Go in stages.
How it relates to guest WiFi
802.1X is for internal identities; a captive portal is for guests. Neither replaces the other and they run side by side on the same network. Staff join the corporate VLAN through 802.1X with their own account, while a visitor is verified on the guest network through a captive portal landing page and their record is kept for compliance.
In Captivo, 802.1X is the 802.1X module, with user, group and network-device management in the panel, and it runs on a self-hosted (on-premise) installation — setup steps are on the On-Premise page.