What is 802.1X?
IEEE 802.1X is port-based network access control — a device has to prove who it is before the network lets it in. Here's how it works and what to remember for the Security+ exam.
The short answer
802.1X is an IEEE standard for port-based network access control (PNAC). When a device plugs into a switch port — or joins an enterprise Wi-Fi network — the port stays blocked until the device successfully authenticates. Only then does the switch or access point open the port and let traffic through.
The three roles
Every 802.1X exchange has exactly three parts — memorize these:
- Supplicant — the client device asking to join (a laptop, phone, or printer running 802.1X software).
- Authenticator — the device that controls the port and enforces the block: a network switch (wired) or a wireless access point (Wi-Fi). It relays messages but does not make the decision itself.
- Authentication server — the back end that actually validates credentials, almost always a RADIUS server tied to a directory (like Active Directory).
How the authentication flow works
- The supplicant connects. The authenticator's port is closed to everything except authentication traffic.
- The supplicant sends its credentials using EAP (Extensible Authentication Protocol) — the flexible framework 802.1X uses (EAP-TLS with certificates, PEAP, etc.).
- The authenticator forwards those credentials to the RADIUS server.
- RADIUS checks them against the directory and replies accept or reject.
- On accept, the port opens (and can even place the device on a specific VLAN). On reject, the port stays blocked or drops the device into a restricted/quarantine VLAN.
802.1X vs a Wi-Fi password vs MAC filtering
Weaker access controls authenticate the network or a spoofable address. 802.1X authenticates the identity:
- WPA2-Personal (a shared password) — everyone uses the same key; you can't tell users apart or revoke one person.
- MAC filtering — MAC addresses are trivially spoofed, so it's not real security.
- 802.1X (WPA2/3-Enterprise) — per-user or per-device authentication, dynamic VLAN assignment, and instant revocation by disabling the account.
Where you'll see it, and why it matters
802.1X is the backbone of Network Access Control (NAC): it's how enterprises make sure only authenticated — and often health-checked (patched, encrypted) — devices reach the network, whether on a wired switch port or corporate Wi-Fi.
Test yourself in the free Kestrel Exams app
Exam-weighted Security+ SY0-701 practice — offline, no ads, no tracking.
Open Kestrel Exams →Frequently asked questions
What does 802.1X do?
It provides port-based network access control: a device must authenticate before the switch port or wireless network grants it any access. Until it authenticates, the port is blocked.
What are the three components of 802.1X?
The supplicant (the client device), the authenticator (the switch or access point that controls the port), and the authentication server (usually RADIUS, which validates the credentials).
Is 802.1X the same as RADIUS?
No. 802.1X is the framework for port-based access control; RADIUS is the protocol typically used as the back-end authentication server that 802.1X relies on.
How is 802.1X different from a Wi-Fi password?
A shared Wi-Fi password authenticates the network, not the user. 802.1X (WPA2/3-Enterprise) authenticates each user or device individually, enabling per-user access, dynamic VLANs, and easy revocation.