Home › Guides › Security+
Security+3 min read

What is 802.1X?

IEEE 802.1X is port-based network access control: a device has to prove who it is before the network lets it in. Here's how it works and what to remember for the Security+ exam.

The port that says no#

Someone walks into your office, plugs a laptop into a wall jack, and gets an IP address. Are they on your network?

On most networks, yes: immediately, with no questions asked. The switch hands out access to whatever is plugged in, because that is what switches do.

802.1X changes the default. The port stays closed until the device proves who it is. Not filtered, not monitored. Closed. Nothing but authentication traffic crosses it.

So the whole standard is one reversal: authenticate first, then get network. Everything below is who does what in that exchange.

The short answer#

802.1X is an IEEE standard for port-based network access control (PNAC). When a device plugs into a switch port, or joins an enterprise Wi-Fi network, the port stays blocked until the device successfully authenticates. Only then does the switch or access point open the port and let traffic through.

In one line

802.1X = "authenticate first, then you get network access." No valid credentials, no connection.

The three roles#

Every 802.1X exchange has exactly three parts. Memorize these:

  • Supplicant: the client device asking to join (a laptop, phone, or printer running 802.1X software).
  • Authenticator: the device that controls the port and enforces the block: a network switch (wired) or a wireless access point (Wi-Fi). It relays messages but does not make the decision itself.
  • Authentication server: the back end that actually validates credentials, almost always a RADIUS server tied to a directory (like Active Directory).

How the authentication flow works#

  1. The supplicant connects. The authenticator's port is closed to everything except authentication traffic.
  2. The supplicant sends its credentials using EAP (Extensible Authentication Protocol), the flexible framework 802.1X uses (EAP-TLS with certificates, PEAP, etc.).
  3. The authenticator forwards those credentials to the RADIUS server.
  4. RADIUS checks them against the directory and replies accept or reject.
  5. On accept, the port opens (and can even place the device on a specific VLAN). On reject, the port stays blocked or drops the device into a restricted/quarantine VLAN.

802.1X vs a Wi-Fi password vs MAC filtering#

Weaker access controls authenticate the network or a spoofable address. 802.1X authenticates the identity:

  • WPA2-Personal (a shared password): everyone uses the same key; you can't tell users apart or revoke one person.
  • MAC filtering: MAC addresses are trivially spoofed, so it's not real security.
  • 802.1X (WPA2/3-Enterprise): per-user or per-device authentication, dynamic VLAN assignment, and instant revocation by disabling the account.

Where you'll see it, and why it matters#

802.1X is the backbone of Network Access Control (NAC): it's how enterprises make sure only authenticated, and often health-checked (patched, encrypted), devices reach the network, whether on a wired switch port or corporate Wi-Fi.

Exam tips

Know the three roles cold (supplicant / authenticator / authentication server), remember RADIUS is the usual authentication server, that EAP is the authentication framework it carries, and that 802.1X is port-based. If a question describes "a device must authenticate before the switch grants network access," the answer is 802.1X.

Test yourself in the free Kestrel Exams app

Topic-selectable practice — offline, no ads, no account.

Practice this topic →

Frequently asked questions#

What does 802.1X do?

It provides port-based network access control: a device must authenticate before the switch port or wireless network grants it any access. Until it authenticates, the port is blocked.

What are the three components of 802.1X?

The supplicant (the client device), the authenticator (the switch or access point that controls the port), and the authentication server (usually RADIUS, which validates the credentials).

Is 802.1X the same as RADIUS?

No. 802.1X is the framework for port-based access control; RADIUS is the protocol typically used as the back-end authentication server that 802.1X relies on.

How is 802.1X different from a Wi-Fi password?

A shared Wi-Fi password authenticates the network, not the user. 802.1X (WPA2/3-Enterprise) authenticates each user or device individually, enabling per-user access, dynamic VLANs, and easy revocation.

Suggest a change

Something here not clear? A topic you wish we covered? Tell us. We read every message, and a request is the fastest way to get a guide written — several of these exist because somebody asked.