Blog

Wired 802.1X + RADIUS: Making Wall Ports Authenticate Before They Connect

December 16, 2025 3 min read
Networking802.1XSecurity
Office wall ports secured with wired 802.1X authentication

Wireless networks get captive portals or PSK rotation all the time, but wired wall ports have stayed "plug in, you're on the LAN" for years. Outsourced laptops, a visitor just grabbing an open port — the security model collapses straight back to a flat L2 network. What we did was a round of wired 802.1X: usernames and passwords (or machine certs) go through RADIUS, and the switch port stays isolated until the client authenticates.

Roles

Component Job
Client Windows Wired AutoConfig / admin pre-provisioning
Authenticator The access switch port
Authentication server NPS / FreeRADIUS, wired into AD
Optional Dynamic VLAN, MAB fallback for printers

First-phase goal: employee domain accounts get online; unauthenticated clients land in a Guest/isolated VLAN; dumb endpoints like printers get MAB or statically permitted ports. No building-wide enforcement on day one.

Switch port modes

  • access + 802.1X authentication
  • On failure: push a Guest VLAN or just deny (depends on how much downtime the business tolerates)
  • Keep an escape hatch: IT leaves a few force-authorized ports so you don't lock yourself out in the hallway
# Logical sketch
interface Gi0/12
  authentication port-control auto
  dot1x pae authenticator
  # failed VLAN / voice VLAN as needed

RADIUS and AD

  • NPS connection request and network policy: AD group G-Wired-Users
  • A different shared secret per switch is better
  • Event logs: authentication failure reasons (bad account, clock skew, certs, protocol not enabled)

Clock skew makes cert-based auth fail in mystifying ways — sort out NTP first.

Windows clients

Group Policy pushes the wired service (Wired AutoConfig), the authentication method (PEAP-MSCHAPv2 etc.), and whether to validate the server certificate. If the cert chain hasn't been distributed, users just see "Cannot connect" and the whole thing feels haunted.

Machine auth vs user auth: boot-time screen casting and imaging scenarios may need machine auth — align with the desktop team at the design stage.

Dumb endpoints: printers and time clocks

802.1X isn't the whole world. Options:

  1. MAB (MAC bypass) + an allowlist of known MACs
  2. A dedicated dumb-endpoint VLAN + static physical ports
  3. Hanging a small switch underneath (not recommended — it grows the blind spot)

MACs can be spoofed, so MAB is a compromise, not an honor. Keep the asset ledger and port descriptions accurate.

Rollout cadence

  1. IT test VLAN and two switches
  2. One floor
  3. The whole building; ship a desktop inspection script in parallel — is the service running, is the cert present

Rollback: port-control force-authorized on the port — restore service first, then debug RADIUS.

Payoff and cost

Payoff: a wall port is no longer a LAN pass; disable a departed employee's account and their wired access dies too.
Cost: helpdesk tickets jump in the first week, and "my Raspberry Pi has no network" becomes a ticket.

Wrap-up

Wired 802.1X is a project that crosses networking, desktops, and identity. Resume material: switch fleet size, RADIUS flavor, whether you did dynamic VLANs, dumb-endpoint policy. Getting it live isn't the hard part — keeping enforcement on through a semester or a fiscal year without flipping it back off is how you know the org has actually digested the plan.

← Back to Blog