What is IEEE 802.1X network au­then­tic­a­tion?

IEEE 802.1X is a standard that enables or denies par­ti­cipants in networks. The method is supported by all common operating systems.

What is 802.1X?

Simply put, IEEE 802.1X is a standard that checks the various par­ti­cipants in a LAN or WLAN network and then either grants or denies them access. IEEE 802.1X is a stan­dalone standard that operates at the link layer, the second layer of the OSI model. Its main task is to identify un­au­thor­ized users even before they access an IEEE 802 network, pro­tect­ing the en­vir­on­ment from unwanted access. The method gives unknown par­ti­cipants access to the network after a thorough check.

IEEE 802.1X was in­tro­duced by the Institute of Elec­tric­al and Elec­tron­ic­al Engineers (IEEE) in 2001 and was ori­gin­ally intended only for LAN networks. Now the standard is also used for WLAN en­vir­on­ments. Au­then­tic­a­tion and au­thor­isa­tion are performed at the physical port of the network. Various protocols are used for this purpose. The IEEE 802.1X standard is sometimes referred to as ‘IEEE Standard for Local and Met­ro­pol­it­an Area Networks - Port-Based Network Access Control’ (PNAC). In addition to pure access control, IEEE 802.1X can be used to allocate band­widths and regulate network use.

What’s IEEE 802.1X being used for?

The IEEE 802.1X au­then­tic­a­tion process contains three actors: a sup­plic­ant, an au­then­tic­at­or or ne­go­ti­at­or, and an au­then­tic­a­tion server (AS).

Sup­plic­ant

The re­questers can be any device that must first be au­then­tic­ated according to the network rules and IEEE 802.1X. These can be computers, printers, scanners or other devices.

Au­then­tic­at­or

The au­then­tic­at­or performs the actual veri­fic­a­tion and decides whether the sup­plic­ant is granted access to the network or not. It checks the applicant’s cre­den­tials in the IEEE 802.1X procedure. If they are in order, access is granted. If they don’t comply with the network rules, access is denied. The au­then­tic­at­or is a WLAN access point, a router, or an IEEE 802.1X-capable switch.

Au­then­tic­a­tion Server

The au­then­tic­a­tion server is a WLAN access point, a RADIUS server, or an LDAP gateway. It’s installed in a protected network and provides the au­then­tic­at­or with an au­then­tic­a­tion service. It matches the applicant’s cre­den­tials with stored and pre­vi­ously defined au­thor­isa­tions.

How does IEEE 802.1X work?

To get a better idea of the basic operation of IEEE 802.1X, let’s compare the procedure to ordinary access control. For example, assume a guest wants to get into a party. He hands his in­vit­a­tion to the bouncer who then scans the card, receives con­firm­a­tion that the guest has been invited, and grants him access to the premises. If, on the other hand, the card is faulty or not present, the guest is denied entry.

In IEEE 802.1X, the sup­plic­ant is the guest, which forwards its cre­den­tials to the au­then­tic­at­or via the Ex­tens­ible Au­then­tic­a­tion Protocol (EAP). The au­then­tic­at­or sends the cre­den­tials to the au­then­tic­a­tion server, which compares them with the pre­vi­ously defined au­thor­iz­a­tions. The cre­den­tials can be stored in a simple text file or avin database. The server checks the cre­den­tials and returns the result to the au­then­tic­at­or. If the data is correct, the au­then­tic­at­or enables access to the network, grants the sup­plic­ant admission and may allocate bandwidth for network use. If the cre­den­tials are incorrect, the sup­plic­ant is rejected.

What are the ad­vant­ages of IEEE 802.1X?

The use of IEEE 802.1X offers numerous ad­vant­ages. The main advantage is that the method is a standard which means it’s widely used. IEEE 802.1X is supported by all common operating systems. It’s easy to implement and provides good pro­tec­tion against unwanted access. IEEE 802.1X is also very versatile. The standard doesn’t just work for LAN networks, but also in com­bin­a­tion with WLAN and VLAN. In­di­vidu­al login re­quire­ments can be defined for each sup­plic­ant. There are other functions such as ad­min­is­tra­tion options or the provision and al­loc­a­tion of usage bandwidth as well.

MAC address as an al­tern­at­ive to IEEE 802.1X

While IEEE 802.1X is supported by almost all operating systems like Windows, macOS and Linux as well as many network types, some devices don’t use the standard, such as certain printers or webcams, for example. In that case, the switch uses the MAC address of the host for au­then­tic­a­tion and creates a username and password from it. However, this method is very vul­ner­able compared to IEEE 802.1X and can be misused for un­au­thor­ised access.