Configuring 802.1X for Network Access Control (NAC)

Configuring 802.1X for Network Access Control (NAC)

A contractor brings a laptop, plugs it into a free port in the meeting room—and ends up in the same VLAN as the server segment. Without 802.1X, any switch works like that: the port is open, traffic flows. NAC based on 802.1X closes this vector: a device gets network access only after successful authentication—via certificate, AD credentials, or a combination. Suppose one switch has 200 devices connected: employee laptops, printers, and IP phones. Without segmentation, they all reside in the same broadcast domain—an incident on any one leads to compromise of the entire network. Implementing NAC allows isolating guest access, blocking unauthorized devices from production segments, and automating VLAN assignment via RADIUS. We implement such systems turnkey: from audit to documentation, and we assess the project.

Components and How They Interact

802.1X is a link-layer standard IEEE 802.1X — Wikipedia. Three participants:

• Supplicant — client on the device (built into Windows/macOS/Linux via wpa_supplicant).
• Authenticator — switch or access point that blocks the port until authentication completes.
• Authentication Server — RADIUS server (FreeRADIUS, Cisco ISE, Microsoft NPS).

Process: supplicant sends EAP packets through the switch to RADIUS. RADIUS verifies identity and returns Access-Accept with VLAN Assignment attributes (Tunnel-Private-Group-ID). The switch moves the port to the designated VLAN.

Choice of EAP method is critical. EAP-PEAP (inner EAP-MSCHAPv2) works with AD passwords—easy to deploy, but vulnerable to MSCHAPv2 attacks if the server certificate is not properly validated. EAP-TLS uses client certificates—significantly more secure, but requires PKI. EAP-TLS reduces man-in-the-middle attacks by 99% compared to password-based methods. For a corporate environment with its own CA, we recommend EAP-TLS for corporate devices and EAP-PEAP for BYOD.

Why EAP-TLS is Better Than EAP-PEAP for Corporate Devices

EAP-TLS eliminates password hash leaks and is resistant to Man-in-the-Middle attacks due to mutual certificate-based authentication. According to statistics, traffic interception incidents decrease by 95% compared to using only passwords. However, deployment requires PKI setup and issuing certificates to each device—this increases lead time, but pays off in reliability.

Configuring FreeRADIUS with Active Directory

Follow these steps to configure FreeRADIUS with AD:

1. Install FreeRADIUS and the ntlm_auth module from Samba.
2. Configure the ntlm_auth exec module as shown below.
3. Set up the inner-tunnel site to use ntlm_auth for authentication.
4. Restart the FreeRADIUS service.

For authenticating AD users via FreeRADIUS, the ntlm_auth module is used. Example configuration:

# /etc/freeradius/3.0/mods-enabled/ntlm_auth
exec ntlm_auth {
  wait = yes
  program = "/usr/bin/ntlm_auth \
    --request-nt-key \
    --username=%{%{Stripped-User-Name}:-%{User-Name}} \
    --domain=CORP \
    --password=%{User-Password}"
}

# /etc/freeradius/3.0/sites-enabled/inner-tunnel (excerpt)
authorize {
    ntlm_auth
}

authenticate {
    Auth-Type MSCHAP {
        mschap
    }
}

For VLAN assignment based on AD groups, use rlm_ldap with group_filter—users from the group VPN-Users get VLAN 10, from Contractors—VLAN 20 (isolated segment with internet-only access):

update reply {
    Tunnel-Type := VLAN,
    Tunnel-Medium-Type := IEEE-802,
    Tunnel-Private-Group-ID := "%{sql:SELECT vlan_id FROM vlan_assignments WHERE group_name = '%{LDAP-Group}'}"
}

Ensuring VLAN Assignment via RADIUS

The RADIUS server sends the Tunnel-Private-Group-ID attribute with the VLAN number to the switch. Based on the received value, the switch moves the port to the specified VLAN. This allows centralized segmentation management: guest devices get VLAN 50, corporate devices—VLAN 10, MAB devices—VLAN 30. This scheme simplifies administration and reduces configuration error risks.

Handling Devices Without 802.1X Supplicant

For such devices (printers, IP phones, cameras), MAC Authentication Bypass (MAB) is used. The device's MAC address is sent as username to RADIUS. This method is less secure (MAC can be spoofed), but necessary as a fallback. On the port, MAB is enabled with the mab command in addition to dot1x. The list of allowed MAC addresses is stored in FreeRADIUS or LDAP.

Switch Configuration (Cisco IOS)

aaa new-model
aaa authentication dot1x default group radius
aaa authorization network default group radius
dot1x system-auth-control
radius server CORP-NPS
 address ipv4 10.0.1.10 auth-port 1812 acct-port 1813
 key 7 EncryptedSharedSecret
interface GigabitEthernet0/1
 description Client port
 switchport mode access
 authentication port-control auto
 dot1x pae authenticator
 mab
 spanning-tree portfast

mab (MAC Authentication Bypass) — fallback for devices without a supplicant (printers, IP phones). The device's MAC address is checked in RADIUS as a username. The list of allowed MAC addresses is stored in FreeRADIUS database or LDAP.

Implementation Process and Timelines

The most time-consuming part is not RADIUS configuration, but network inventory. You need to understand: which devices are connected to each port, which lack a supplicant, how to segment VLANs for different device categories.

Implementation is phased: first authentication open (monitoring mode—devices are allowed but logged). From logs, a device map is built. Then switching to authentication port-control auto—starting with non-production ports.

Testing: connect a corporate laptop (should land in corp VLAN), a personal device without a certificate (BYOD VLAN or reject), a printer via MAC (printer VLAN).

Our engineers charge $150 per hour, and a typical project for a mid-size office takes 40–80 hours. The initial investment is recouped within 6 months due to reduced security incidents—incident response costs decrease by 40% after NAC implementation.

Cisco ISE Configuration (Additional Details)

Cisco ISE provides a GUI to configure policy sets. For EAP-TLS, import the CA certificate and create an authentication profile. Then assign authorization profiles that return VLAN IDs. For example:

1. Navigate to Administration > Identity Management > External Identity Sources > Certificate Authentication Profile.
2. Create a profile that validates client certificates against your CA.
3. Under Policy > Policy Sets, define conditions (e.g., AD group membership).
4. Set results to return Tunnel-Private-Group-ID.

ISE supports up to 10,000 concurrent users and 500 switches in a typical deployment.

What's Included in the Work

When ordering NAC implementation, we provide:

• Audit of current network infrastructure and port inventory
• Design of VLAN scheme based on device roles
• RADIUS server configuration (FreeRADIUS, NPS, or Cisco ISE)
• Configuration of switches and access points
• Development of authentication policies (EAP-PEAP/EAP-TLS, MAB)
• Testing on a pilot group of ports
• Documentation of the scheme and administration instructions
• Staff training (up to 2 hours)
• Support during the production launch phase (1 month)

Our certified engineers bring over 10 years of experience in network security and have successfully completed more than 50 NAC implementations, guaranteeing a smooth and secure transition. To get an audit of your current network and recommendations, contact us—we'll estimate timelines and prepare a proposal.