implementing-network-access-control

Enable AAA with 'aaa authentication dot1x default group radius', define the RADIUS server, activate 'dot1x system-auth-control', then apply 'authentication port-control auto' and 'dot1x pae authenticator' on access ports. Add MAB as a fallback and event actions for guest, quarantine, and critical VLANs.

Create a FreeRADIUS policy that checks LDAP group membership and returns Tunnel-Type, Tunnel-Medium-Type, and Tunnel-Private-Group-ID reply attributes. Reference the policy in the authorize section so authenticated users are placed into role-appropriate VLANs automatically.

MAB (MAC Authentication Bypass) authenticates devices by MAC address when they cannot run an 802.1X supplicant, such as printers and medical devices. Scope it to specific ports and reconcile the MAC list regularly, since cloned MACs can gain unauthorized access.

Only if you configure a critical-VLAN fallback with 'authentication event server dead action authorize vlan'. Without it, new devices either lose network access entirely or, with open authentication, all connect without verification.

Common causes include supplicants not validating the RADIUS server certificate, missing trusted root CA, or mismatched inner methods. Push the corporate CA via GPO and enforce server certificate validation to prevent rogue RADIUS credential theft.