802.1X Authentication Explained: Supplicant, Authenticator and RADIUS

802.1X Authentication Explained: Supplicant, Authenticator and RADIUS
Networking ATN Campus October 07, 2026 26 views

802.1X Authentication Explained: Supplicant, Authenticator and RADIUS

802.1X is a standard for port-based network access control. It allows a network to authenticate a device or user before providing normal network access.

802.1X is commonly used on enterprise wired Ethernet networks and Wi-Fi networks. It works with an authentication framework such as EAP and commonly uses a RADIUS server as the backend authentication server.

The three most important roles to understand are the Supplicant, Authenticator, and Authentication Server.

What Is 802.1X?

802.1X provides a framework for controlling access to a network port based on authentication. 

```

Without 802.1X:

Device connects
↓
Network access

With 802.1X:

Device connects
↓
Authentication
↓
Authentication successful?
↓
Yes → Network access
No  → Access restricted/denied
```

This is especially useful in enterprise environments where organizations do not want every device connected to a switch port to automatically receive unrestricted network access.

The Three 802.1X Roles

802.1X is easiest to understand by remembering three roles:

  1. Supplicant
  2. Authenticator
  3. Authentication Server

1. Supplicant

The supplicant is the endpoint requesting network access.

Examples include:

  • Employee laptop
  • Desktop computer
  • Mobile device
  • Other supported endpoint
```

Laptop
|
| "I want network access"
v
Switch
```

The endpoint runs supplicant software that participates in the authentication process.

2. Authenticator

The authenticator is the network device that controls access to the network.

Examples include:

  • Ethernet switch
  • Wireless access point
```

Supplicant
|
| Authentication exchange
v
Authenticator
|
| Authentication request
v
Authentication Server
```

The authenticator controls whether the endpoint receives normal network access based on the authentication result.

3. Authentication Server

The authentication server validates the credentials or identity information presented during authentication.

RADIUS is commonly used between the authenticator and authentication server. 

```

Supplicant
|
| EAP
v
Authenticator
|
| RADIUS
v
Authentication Server
```

802.1X Architecture

```

+-------------+       +-------------+       +------------------+
| Supplicant  |       | Authenticator|      | Authentication   |
|             |       |             |       | Server           |
| Laptop      | ----> | Switch/AP   | ----> | RADIUS           |
+-------------+       +-------------+       +------------------+
|                     |                       |
|                     |                       |
+------ EAPOL --------+                       |
+------ RADIUS ---------+
```

What Is EAP?

EAP (Extensible Authentication Protocol) is a framework that supports different authentication methods.

EAP itself is not one single authentication method. Different EAP methods can provide different ways of authenticating users and/or devices.

Examples include:

  • EAP-TLS
  • PEAP
  • Other EAP methods supported by the environment

The authentication method should be selected according to the organization's security requirements and infrastructure.

What Is EAPOL?

EAPOL stands for Extensible Authentication Protocol over LAN.

In a wired 802.1X environment, EAPOL is used for communication between the endpoint and the authenticator. 

```

Laptop
|
| EAPOL
v
Switch
|
| RADIUS
v
Authentication Server
```

What Is RADIUS?

RADIUS stands for Remote Authentication Dial-In User Service.

It is widely used as an AAA protocol and is commonly used with 802.1X deployments to communicate between the network access device and the authentication server.

RADIUS can support authentication and authorization, and it can also support accounting in appropriate deployments.

802.1X Authentication Flow

A simplified authentication sequence looks like this: 

```

1. Endpoint connects
   |
   v
2. Switch detects endpoint
   |
   v
3. Authentication begins
   |
   v
4. Credentials / identity information
   |
   v
5. Switch sends authentication request
   to RADIUS server
   |
   v
6. RADIUS validates authentication
   |
   v
7. Result returned
   |
   +---+---+
   |       |
   Accept   Reject
   |       |
   v       v
   Access   Restricted /
   No normal access

Step-by-Step Example

```

Step 1: Laptop Connects

An employee connects a laptop to an 802.1X-enabled switch port.

Step 2: Authentication Begins

The switch acts as the authenticator and begins the authentication process.

Step 3: Identity Is Provided

The supplicant provides authentication information using the selected EAP method.

Step 4: RADIUS Request

The switch forwards the authentication information to the configured RADIUS server.

Step 5: Authentication Result

   ```

RADIUS Server

Credentials valid?
|
+---+---+
|       |
YES      NO
|       |
Accept   Reject
```

Step 6: Access Decision

The authenticator applies the result and the configured policy.

What Happens After Successful Authentication?

Depending on the network design, the authentication result may be associated with additional authorization policies.

For example:

```

Employee
↓
802.1X Authentication
↓
RADIUS
↓
Successful
↓
Employee access policy
↓
Employee VLAN / permissions
```

The exact authorization features available depend on the network access device, RADIUS server, and deployment.

What Happens When Authentication Fails?

```

Authentication fails
|
v
Normal network access
is not granted
|
v
Possible result:

* Deny access
* Restricted access
* Guest/remediation policy
```

The exact behavior is controlled by the network's configuration.

```

802.1X and RADIUS Relationship

```
Component Role
Supplicant Requests access and participates in authentication
Authenticator Controls network access
EAP Authentication framework/methods
EAPOL Carries EAP over LAN between endpoint and authenticator
RADIUS Common protocol between authenticator and authentication server
Authentication Server Validates identity and returns authentication/authorization information
```

Basic Cisco 802.1X Configuration Concept

```

A Cisco switch requires the appropriate AAA and 802.1X configuration. A simplified example is: 

  ```

Switch(config)# aaa new-model

Switch(config)# radius server RADIUS-SERVER
Switch(config-radius-server)# address ipv4 192.168.100.10 auth-port 1812 acct-port 1813
Switch(config-radius-server)# key YOUR_SECRET

Switch(config)# dot1x system-auth-control
```

On an access interface, a common configuration pattern is: 

```

Switch(config)# interface gigabitEthernet 0/10
Switch(config-if)# switchport mode access
Switch(config-if)# authentication port-control auto
Switch(config-if)# dot1x pae authenticator
```

Cisco syntax can vary by IOS release and platform, so always verify the commands supported by the specific switch model.

Why Is 802.1X Better Than MAC-Only Authentication?

MAC addresses can be changed or spoofed. Therefore, relying only on a MAC address as proof of identity has limitations.

MAC-Based Access 802.1X
Primarily identifies a device by MAC Can authenticate users/devices using supported EAP methods
MAC can potentially be spoofed Can use stronger authentication mechanisms
Limited identity assurance Supports stronger identity-based access control

802.1X in a Company Network

             RADIUS Server
                   |
                   |
              +---------+
              | Switch  |
              +---------+
               /       \
              /         \
    Employee Laptop    Unknown Device
          |                  |
      802.1X               802.1X
          |                  |
      Authenticated?      Authenticated?
          |                  |
          v                  v
    Employee Access       Restricted/
                          Denied

802.1X for Wi-Fi

802.1X is also widely associated with enterprise Wi-Fi authentication. 

```

Laptop / Phone
|
| Wireless authentication
v
Access Point
|
| RADIUS
v
Authentication Server
```

Enterprise wireless deployments commonly combine 802.1X with WPA2-Enterprise or WPA3-Enterprise and an appropriate EAP method.

802.1X vs Port Security

Port Security 802.1X
Primarily controls MAC addresses Provides port-based authentication
Useful for limiting MAC addresses Can authenticate users/devices
Does not provide full identity authentication Uses EAP authentication framework
Often simple for fixed endpoints Better suited to identity-based enterprise access

802.1X Troubleshooting

When 802.1X authentication fails, check the following areas:

  1. Is the endpoint supplicant enabled?
  2. Is the switch port configured correctly?
  3. Is AAA configured?
  4. Can the switch reach the RADIUS server?
  5. Is the RADIUS shared secret correct?
  6. Are the authentication credentials valid?
  7. Is the selected EAP method supported?
  8. Is the endpoint certificate valid if certificate-based authentication is used?
  9. Are authorization policies correctly configured?

Useful Cisco Verification Commands

```

show authentication sessions
```

Check 802.1X details:

```

show dot1x all
```

Check AAA configuration:

```

show running-config | section aaa
```

Exact commands and output vary by Cisco IOS/IOS-XE release and switch platform.

Packet Tracer / Lab Concept

Build an enterprise-style authentication topology where supported: 

```

PC
|
| 802.1X
|
Switch
|
| RADIUS
|
Authentication Server
```

Practice understanding:

  1. Supplicant configuration
  2. Authenticator configuration
  3. AAA configuration
  4. RADIUS server configuration
  5. Authentication success
  6. Authentication failure
  7. Access policy

If your simulator does not support the complete 802.1X workflow, use the topology to study the architecture and authentication flow, then perform the full configuration on supported Cisco hardware or a suitable lab platform.

Quick Quiz

1. What are the three main roles in 802.1X?

Show Answer

Supplicant, Authenticator, and Authentication Server.

2. What is the role of the supplicant?

Show Answer

It is the endpoint requesting network access and participating in authentication.

3. What device commonly acts as the authenticator?

Show Answer

A network switch or wireless access point.

4. Which protocol is commonly used between the authenticator and authentication server?

Show Answer

RADIUS.

5. What does EAPOL stand for?

Show Answer

Extensible Authentication Protocol over LAN.

Key Takeaways

  • 802.1X provides port-based network access control.
  • The three important roles are Supplicant, Authenticator, and Authentication Server.
  • The endpoint is the supplicant.
  • The switch or access point commonly acts as the authenticator.
  • RADIUS is commonly used between the authenticator and authentication server.
  • EAP provides the authentication framework and supports different authentication methods.
  • EAPOL carries EAP between an endpoint and authenticator on a LAN.
  • Successful authentication can be combined with authorization policies such as VLAN assignment.
  • 802.1X is widely used in enterprise wired and wireless networks.

Want to Learn 802.1X and Network Authentication? Visit ATN Campus

Want to learn 802.1X, RADIUS, AAA, NAC, VLAN security, network authentication, Cisco switching, and cybersecurity through practical training?

Visit ATN Campus and develop practical networking skills through Cisco theory, authentication concepts, and hands-on networking labs.

Learn More Than Just 802.1X

  • CCNA – Cisco Certified Network Associate
  • CCNP – Cisco Certified Network Professional
  • Network Routing & Switching
  • Network Security
  • CEH – Certified Ethical Hacker
  • Cisco CyberOps
  • VLAN & Network Segmentation
  • Python for Network Automation
  • Practical Cisco Networking Labs

???? Want to learn networking and network security? Visit ATN Campus.

???? Learn Networking. ???? Authenticate Users & Devices. ???? Practice with Real Labs. ???? Prepare for Certifications. ???? Build Your IT Career with ATN Campus.

Share this article:

Facebook Twitter WhatsApp LinkedIn
Related Articles
Networking
Network Engineer Career Roadmap: From Student to Network Professional
Networking
What Is a Reverse Proxy? Nginx, HTTPS and Web Applications
Networking
What Is a Load Balancer? How Websites Handle Millions of Users
Back to All Articles
Recent Posts
Categories
Networking 105 Cyber Security 9 Career 6 Python 4 Cloud 4
Document ATN CAMPUS