802.1X & Cisco ISE: CCNP Security SCOR 350-701 Domain 6.0 Guide

What is 802.1X?

IEEE 802.1X is a standard for port-based network access control (PNAC). It provides an authentication mechanism for devices trying to connect to a LAN or WLAN. Before a device can send or receive any network traffic, it must prove its identity.

802.1X involves three roles:

Here's how the process works:

1. A device connects to a switch port or wireless network
2. The switch (authenticator) blocks all traffic except EAP (Extensible Authentication Protocol) frames
3. The supplicant sends its credentials via EAP to the authenticator
4. The authenticator forwards the EAP messages to the RADIUS server, encapsulated in RADIUS packets
5. The RADIUS server verifies the credentials against its identity source (Active Directory, LDAP, local database)
6. If authentication succeeds, the RADIUS server sends an Access-Accept message with authorization attributes (VLAN assignment, ACL, etc.)
7. The switch opens the port and applies the authorized policy

EAP Methods for 802.1X

EAP (Extensible Authentication Protocol) is a framework that supports multiple authentication methods within 802.1X. Different EAP methods offer different security levels and deployment requirements:

PEAP in Detail

PEAP (Protected EAP) is the most widely deployed EAP method in enterprise environments because it balances security with ease of deployment:

1. The RADIUS server presents its certificate to the supplicant
2. The supplicant validates the server certificate (trusted CA)
3. A TLS tunnel is established between supplicant and server
4. Inside this encrypted tunnel, the user authenticates with username/password (using MSCHAPv2)
5. Credentials are never sent in cleartext because they're protected by the outer TLS tunnel

EAP-TLS in Detail

EAP-TLS provides the strongest security by eliminating passwords entirely:

• Both the server and client present X.509 certificates
• Mutual authentication - each side verifies the other's identity
• Immune to password-based attacks (phishing, brute force, credential stuffing)
• Requires a PKI (Public Key Infrastructure) to issue and manage client certificates
• Higher administrative overhead - certificate enrollment, renewal, and revocation must be managed

Cisco ISE Overview

Cisco Identity Services Engine (ISE) is an enterprise-grade RADIUS and policy server that provides centralized network access control. It is the product behind almost every identity and secure-access line in SCOR Domain 6.0, and the whole subject of the 300-715 SISE concentration exam.

Core ISE Functions

• Authentication - verifies who or what is connecting (user identity, device type)
• Authorization - determines what the authenticated entity can access (VLAN, ACL, SGT)
• Accounting - logs all access events for auditing and compliance
• Posture Assessment - checks device health (OS patches, antivirus status, disk encryption) before granting access
• Profiling - automatically identifies device types (laptop, printer, IP phone, IoT) based on network behavior

ISE Policy Framework

ISE uses a layered policy model:

802.1X Configuration

Here's what 802.1X configuration looks like on the switch (authenticator) side. SCOR line 6.2 says "configure and verify", so this is not optional background - being able to read this config and predict the port's behaviour is the skill being tested.

Switch-Side Configuration (Cisco IOS)

! Enable AAA globally
aaa new-model

! Define RADIUS server
radius server ISE-PRIMARY
 address ipv4 10.1.1.100 auth-port 1812 acct-port 1813
 key MyRadiusSecret123

! Create authentication method list
aaa authentication dot1x default group radius
aaa authorization network default group radius
aaa accounting dot1x default start-stop group radius

! Enable 802.1X globally
dot1x system-auth-control

! Configure access port for 802.1X
interface GigabitEthernet0/1
 switchport mode access
 switchport access vlan 100
 authentication port-control auto
 dot1x pae authenticator
 authentication order dot1x mab
 authentication priority dot1x mab

Key configuration concepts:

• aaa new-model - enables the AAA framework (required for 802.1X)
• dot1x system-auth-control - enables 802.1X globally on the switch
• authentication port-control auto - the port starts in unauthorized state and waits for authentication
• dot1x pae authenticator - sets the port's 802.1X role to authenticator
• authentication order dot1x mab - try 802.1X first, fall back to MAB if no supplicant responds

RADIUS Communication

The authenticator communicates with the RADIUS server using UDP ports 1812 (authentication) and 1813 (accounting). Legacy systems may use ports 1645/1646. The RADIUS shared secret encrypts the communication between the authenticator and the server.

MAB and Guest Access

MAC Authentication Bypass (MAB)

Not all devices support 802.1X. Printers, IP phones, cameras, and IoT devices typically lack supplicant software. MAB is a fallback authentication method that uses the device's MAC address as its identity.

How MAB works:

1. The switch detects a new device but receives no 802.1X response
2. After a timeout, the switch captures the device's MAC address
3. The switch sends the MAC address to the RADIUS server as both username and password
4. The RADIUS server checks the MAC against a known-device database
5. If matched, the server returns the appropriate authorization (VLAN, ACL)

Guest Access

For visitors and BYOD (Bring Your Own Device), NAC solutions provide guest access portals:

• Web Authentication (WebAuth) - redirects unauthenticated users to a captive portal
• Sponsored Guest - an employee creates a guest account for the visitor
• Self-Registration - guests register themselves (typically with email or SMS verification)
• Guest VLAN - guests are placed in an isolated VLAN with limited access (internet only, no internal resources)

Change of Authorization (CoA)

CoA (RFC 5176) allows the RADIUS server to dynamically change a client's authorization after initial authentication. This is critical for posture assessment workflows:

1. Device authenticates and is placed in a quarantine VLAN for posture assessment
2. ISE checks the device's health (patches, antivirus, compliance)
3. If compliant, ISE sends a CoA message to the switch
4. The switch re-authorizes the device into the appropriate production VLAN - no user action needed

802.1X on the SCOR 350-701 Exam

Everything on this page sits in Domain 6.0, Secure Network Access, Visibility and Enforcement - 15% of SCOR 350-701. Unlike a vendor-neutral exam, SCOR asks you to configure and verify, not just describe, so knowing the roles is the starting point rather than the finish line.

What the blueprint actually names

• 6.1 - identity management and secure network access concepts: guest services, profiling, posture assessment, BYOD
• 6.2 - configure and verify network access control mechanisms: 802.1X, MAB, WebAuth
• 6.3 - network access with CoA (Change of Authorization)
• 6.4 - the benefits of device compliance and application control
• 6.6 - the benefits of network telemetry
• 6.7 - Cisco Secure Network Analytics, Secure Cloud Analytics, pxGrid and Umbrella Investigate

Where candidates lose marks

• Order of operations on the port. What the switchport does while the supplicant is silent, when MAB takes over, and what changes if the order is flipped - that is a configure-and-verify question, not a definition question.
• CoA as an exam answer. Any scenario where authorization changes after the session is already up - posture turning compliant, a profiling result arriving late - is CoA. It has its own blueprint line for a reason.
• Profiling vs posture. Profiling works out what the device is; posture works out whether it is healthy. They get swapped constantly.
• pxGrid. Easy to skip because it feels peripheral, and it is named explicitly in 6.7.

802.1X & NAC Practice Questions

Test your understanding with these 5 expert-created questions. Each includes a detailed explanation to reinforce your learning.