> ## Content Index > Fetch the complete content index at: https://www.pinglabz.com/llms.txt > Use this file to discover other available public pages before exploring further. # Phased 802.1X Deployment Strategy for Enterprise Networks - URL: https://www.pinglabz.com/802-1x-phased-deployment/ - Published: 2026-03-24T03:04:43.000Z - Updated: 2026-07-04T23:21:50.000Z - Description: Phased 802.1X deployments succeed when each phase is data collection first, enforcement second. Here is Phase 0 through Phase 4 with real endpoint discovery tactics. - Author: Jaime - Tags: 802.1X, #Import 2026-08-01 19:54 Enterprise 802.1X deployments fail for two predictable reasons: insufficient pre-deployment data about the endpoint population, and enforcement that moves faster than remediation. Both problems are solved by a disciplined phased approach that treats each phase as a data collection exercise before it becomes an enforcement exercise. If you want the bigger picture first, the [802.1X complete guide](https://www.pinglabz.com/802-1x/) covers the architecture this article plugs into. This article uses a reference environment of a three-building campus with approximately 1,500 access ports served by Cisco Catalyst 9300 switches and Cisco ISE 3.2 as the policy engine. The configuration examples use IOS XE 17.9.x syntax throughout. The same framework scales up to 30,000+ port deployments with appropriate ISE node sizing and switch stack planning. ## Phase 0: Pre-Deployment Audit and Infrastructure Readiness No switch configuration changes happen in Phase 0\. The goal is to establish a complete picture of the network before any 802.1X configuration is applied. ### Infrastructure Readiness Checklist **AAA Infrastructure:** - Cisco ISE 3.2 nodes deployed and licensed (at minimum, one Administration node and one Policy Service Node) - RADIUS reachability verified from all access switches to ISE PSN IP (10.0.0.10) - ISE integrated with Active Directory (Administration > Identity Management > External Identity Sources > Active Directory) - PKI infrastructure in place if EAP-TLS is planned (root CA trusted in ISE, certificate templates deployed via GPO) **Switch Infrastructure:** - All access switches running IOS XE 17.9.x (verify with `show version`) - Management VLAN 99 configured and reachable to ISE management interface - NTP synchronized across all switches and ISE (authentication timestamp mismatches cause EAP failures) - Spanning-tree portfast configured on all access ports (required for fast 802.1X convergence) **VLAN Infrastructure:** - VLAN 10 (Data), VLAN 20 (Voice), VLAN 30 (Guest), VLAN 40 (Auth-Fail), VLAN 50 (Critical) defined and trunked correctly on uplinks - DHCP scopes defined for all VLANs with appropriate lease times - DNS resolution working from all VLANs **Endpoint Inventory:** Begin building the endpoint inventory. Pull MAC addresses from existing DHCP logs, ARP tables, and any existing endpoint management systems (SCCM, Intune, etc.). Categorize by type: - Corporate laptops and desktops (expect 802.1X with PEAP or EAP-TLS) - Corporate IP phones (Cisco 8800 series - expect 802.1X EAP-MD5 or MAB) - Printers, copiers, IoT devices (expect MAB only) - Conference room devices (projectors, video conferencing systems - expect MAB) - Personal/BYOD devices (expect MAB or guest redirect) This inventory becomes the basis for ISE endpoint group configuration and MAB exception lists. ## Phase 1: ISE Base Configuration and Policy Framework Before touching access switches, build the ISE policy structure that supports all phases. ### Network Device Configuration in ISE Navigate to **Administration > Network Resources > Network Devices > Add**. Create a network device entry for each access switch: - Name: `SW-BLDG1-FL1-01` (use a consistent naming convention) - IP Address: Switch management IP (10.0.99.1 for this lab) - RADIUS Authentication Settings: Shared Secret `ISEsecret123` - Device Type: `Cisco` \> `Catalyst 9300` For a large deployment, use **Administration > Network Resources > Network Device Groups** to group switches by building, floor, or function. These groups can be used as conditions in authorization rules. ### Identity Groups Navigate to **Administration > Identity Management > Groups > Endpoint Identity Groups**. Create: - `Corporate-Computers` \- for domain-joined Windows endpoints - `Corp-Phones` \- for Cisco IP Phone MACs - `Printers` \- for printer MACs - `IOT-Devices` \- for other non-supplicant devices - `Unknown` \- catch-all for unrecognized MACs Pre-populate `Corp-Phones` and `Printers` with known MACs from the Phase 0 inventory. Use ISE's profiling capabilities to auto-classify the remainder. ### Phase 1 Authorization Policy (Monitor Mode Compatible) Navigate to **Policy > Policy Sets > Add** and create a new policy set named `802.1X-Access`: - Conditions: `RADIUS:NAS-Port-Type EQUALS Ethernet` Within the policy set, create authorization rules in order: 1. **Rule: Corp-Computers-Monitor** - Condition: `AD:ExternalGroups EQUALS corp.local/Domain Computers` - Result: `PermitAccess` 2. **Rule: Corp-Phones-Monitor** - Condition: `Endpoints:LogicalProfile EQUALS Cisco-IP-Phone` OR `Endpoints:IdentityGroup EQUALS Corp-Phones` - Result: `PermitAccess` 3. **Rule: MAB-Catch-All** - Condition: `Network Access:AuthenticationMethod EQUALS MAB` - Result: `PermitAccess` 4. **Default Rule:** - Result: `PermitAccess` During Monitor Mode, every endpoint gets PermitAccess. The policy structure exists so you can see which rule is matching each endpoint in ISE live logs - this is what tells you whether your rule logic will work before enforcement. ## Phase 2: Monitor Mode Deployment ### Switch Configuration - Monitor Mode Apply this configuration to all access ports on a per-switch basis. In production, use a configuration template deployed via Cisco DNA Center or a script - applying this manually to 1,500 ports is error-prone. ``` ! Global AAA - apply once per switch aaa new-model aaa authentication dot1x default group ISE_SERVERS aaa authorization network default group ISE_SERVERS aaa accounting dot1x default start-stop group ISE_SERVERS radius server ISE-PSN-1 address ipv4 10.0.0.10 auth-port 1812 acct-port 1813 key ISEsecret123 timeout 5 retransmit 2 aaa group server radius ISE_SERVERS server name ISE-PSN-1 deadtime 15 dot1x system-auth-control ! Per-interface - Monitor Mode interface range GigabitEthernet1/0/1 - 48 switchport mode access switchport access vlan 10 switchport voice vlan 20 authentication open authentication port-control auto authentication host-mode multi-domain authentication order dot1x mab authentication priority dot1x mab dot1x pae authenticator dot1x timeout tx-period 10 spanning-tree portfast ``` The `interface range` command applies the config to all access ports in one block. Adjust the range to match your switch layout, excluding uplink ports. ### Verification After Monitor Mode Deployment ``` SW1# show authentication sessions Interface MAC Address Method Domain Status Session ID Gi1/0/1 a4b1.c2d3.e4f5 dot1x DATA Auth 0A00630A00000001 Gi1/0/2 001e.7a3b.9c12 mab DATA Auth 0A00630A00000002 Gi1/0/3 b4c2.d3e4.f516 dot1x DATA Auth 0A00630A00000003 Gi1/0/4 0050.56b3.11aa mab VOICE Auth 0A00630A00000004 Gi1/0/5 0000.0000.0000 N/A N/A No Auth N/A ``` Every port with an active endpoint shows `Status: Auth` \- even those that would fail in Closed Mode. This is expected Monitor Mode behavior. Port Gi1/0/5 shows `No Auth` \- no EAPOL or MAC has been detected, meaning the port is empty or the device has not generated traffic. ### Monitor Mode Validation Period: 2-4 Weeks During this period, run weekly ISE reports: Navigate to **Operations > Reports > Reports > Endpoint and Users > Authentication Summary**. Filter by date range and group by `Identity Group`. This report shows: - Total authentications per identity group - Percentage passing vs failing per group - Failure reason breakdown (wrong password, certificate error, AD lookup failed, etc.) A well-deployed Monitor Mode phase surfaces the following categories of problems: **Category 1: Supplicant not running** \- Endpoints showing `Method: MAB` that should be using `dot1x`. These are typically domain-joined PCs where the Wired AutoConfig service is disabled. Fix via GPO before moving to enforcement. **Category 2: Certificate not trusted** \- EAP-TLS failures with reason "Unknown CA." These are machines where the root CA certificate was not deployed via GPO, or where the machine cert has expired. Fix in PKI before enforcement. **Category 3: Unknown MACs** \- Devices falling through to the MAB-Catch-All rule with no identity group match. These are IoT, printers, and other devices that need to be added to the appropriate ISE endpoint group and assigned a proper authorization policy. **Category 4: Correctly failing** \- Personal devices, guest devices, test equipment. These will land in VLAN 30 (Guest) or VLAN 40 (Auth-Fail) after enforcement. Decide in advance whether this is acceptable. **Success Criteria Before Moving to Phase 3:** - 95%+ of corporate laptops authenticating via dot1x successfully - 98%+ of Cisco IP Phones authenticating via MAB or EAP-MD5 successfully - All printers and IoT devices in ISE endpoint groups with appropriate MAB authorization rules - Zero unresolved "Unknown CA" failures for managed endpoints ## Phase 3: Low-Impact Mode Deployment With Monitor Mode data in hand, move to Low-Impact Mode. This phase introduces real enforcement: the pre-auth ACL limits unauthenticated endpoint traffic, and post-auth policy (VLAN, dACL) is enforced. ### Pre-Authentication ACL ``` ip access-list extended PREAUTH-ACL 10 remark -- Allow DHCP 20 permit udp any host 255.255.255.255 eq 67 30 permit udp any any eq 68 40 remark -- Allow DNS to corporate resolver 50 permit udp any host 10.0.0.10 eq 53 60 permit tcp any host 10.0.0.10 eq 53 70 remark -- Allow ICMP for troubleshooting 80 permit icmp any any 90 remark -- Block everything else 100 deny ip any any log ``` Apply this ACL globally before changing any port configuration. Verify it is accessible in the running config before proceeding. ### Updated ISE Authorization Policy - Enforcement Mode Update the ISE authorization rules to return enforcement attributes. Navigate to **Policy > Policy Sets > 802.1X-Access > Authorization Rules** and update: 1. **Rule: Corp-Computers-Enforce** - Condition: `AD:ExternalGroups EQUALS corp.local/Domain Computers` - Result: `Corp-VLAN10-Profile` (Authorization Profile returning VLAN 10 + dACL `CORP-USERS-ACL`) 2. **Rule: Corp-Phones-Enforce** - Condition: `Endpoints:LogicalProfile EQUALS Cisco-IP-Phone` - Result: `Voice-VLAN20-Profile` (Authorization Profile returning VLAN 20) 3. **Rule: Printers-Enforce** - Condition: `Endpoints:IdentityGroup EQUALS Printers` - Result: `Printer-VLAN10-Profile` (Authorization Profile returning VLAN 10 + dACL restricting to printer traffic only) 4. **Rule: Unknown-MAB-Devices** - Condition: `Network Access:AuthenticationMethod EQUALS MAB AND Endpoints:IdentityGroup EQUALS Unknown` - Result: `Guest-VLAN30-Profile` (Authorization Profile returning VLAN 30) 5. **Default:** - Result: `DenyAccess` ### Switch Configuration - Low-Impact Mode ``` interface GigabitEthernet1/0/1 switchport mode access switchport access vlan 10 switchport voice vlan 20 ip access-group PREAUTH-ACL in authentication event fail action authorize vlan 40 authentication event no-response action authorize vlan 40 authentication event server dead action authorize vlan 50 authentication event server alive action reinitialize authentication port-control auto authentication host-mode multi-domain authentication order dot1x mab authentication priority dot1x mab dot1x pae authenticator dot1x timeout tx-period 10 spanning-tree portfast ``` The `authentication open` command is removed. The `ip access-group PREAUTH-ACL in` is added. The RADIUS server dead/alive actions are critical - without `authentication event server dead action authorize vlan 50`, a loss of ISE connectivity would lock every unauthenticated endpoint out of the network. See [Article 28: RADIUS Redundancy and Failover in 802.1X Deployments](https://www.pinglabz.com/802-1x-radius-redundancy) for the full failover design. ### Low-Impact Mode Validation Period: 2-4 Weeks During this period, watch for: - VLAN assignment correctness (endpoints landing in expected VLANs) - dACL hit counts (use `show ip access-lists` to verify expected traffic patterns) - Auth-Fail VLAN 40 population (should be only the devices that legitimately should fail) - Critical VLAN 50 population (should be zero under normal conditions - presence indicates ISE reachability issues) **Success Criteria Before Moving to Phase 4:** - Zero managed corporate endpoints landing in VLAN 40 or VLAN 50 under normal conditions - dACL hit counts matching expected traffic patterns - Guest VLAN 30 receiving only personal/BYOD devices ## Phase 4: Closed Mode Enforcement Closed Mode removes the last safety net. There is no `authentication open`, no pre-auth ACL permitting traffic - unauthenticated endpoints have no network access. Only authenticated and authorized endpoints pass traffic. ### Rollout Sequence Do not apply Closed Mode to all ports simultaneously. Use a building-by-building or floor-by-floor rollout: **Week 1:** Pilot floor (typically IT department or a controlled area where staff understand what is happening) **Week 2-3:** Building 1, Floor 1 through Floor N (change management window per floor - off-hours) **Week 4+:** Expand to remaining buildings based on Phase 3 validation data ### Switch Configuration - Closed Mode ``` interface GigabitEthernet1/0/1 no ip access-group PREAUTH-ACL in no authentication event no-response action authorize vlan 40 authentication event fail action authorize vlan 40 authentication event server dead action authorize vlan 50 authentication event server alive action reinitialize authentication port-control auto authentication host-mode multi-domain authentication order dot1x mab authentication priority dot1x mab dot1x pae authenticator dot1x timeout tx-period 10 spanning-tree portfast ``` Note: `no ip access-group PREAUTH-ACL in` removes the pre-auth ACL. The `authentication event no-response` line is removed - in Closed Mode, if an endpoint generates no EAPOL, MAB takes over based on `authentication order dot1x mab`. The switch sends EAP-Request/Identity, waits for `tx-period` seconds, then falls through to MAB. For a no-response scenario in Closed Mode with the above config (no explicit `no-response` action), the endpoint's MAC will attempt MAB. If MAB fails, the endpoint ends up in `Authz Failed` state with no network access. If you want a no-response fallback VLAN for Closed Mode, add: ``` authentication event no-response action authorize vlan 30 ``` This sends devices that generate no EAPOL and fail MAB to VLAN 30 (Guest). Whether this is appropriate depends on your security policy. ### Verification - Closed Mode ``` SW1# show authentication sessions interface GigabitEthernet1/0/1 details Interface: GigabitEthernet1/0/1 MAC Address: a4b1.c2d3.e4f5 User-Name: CORP\jsmith Status: Auth Domain: DATA Security Policy: Restrict Security Status: Secured Oper host mode: multi-domain Server Policies: Vlan Group: Vlan: 10 ACS ACL: xCORP-USERS-ACL-98765432 Method status list: Method State dot1x Authc Success ``` `Security Policy: Restrict` and `Security Status: Secured` confirm Closed Mode enforcement is active. The session is authorized, VLAN 10 is assigned, and the dACL is applied. ## Change Management Considerations ### Communication Plan For a 1,500-port campus deployment, send communications at: - **T-30 days:** Department heads briefing (what is 802.1X, what changes for users, what to do if they lose connectivity) - **T-7 days:** All-staff email (practical impact: "you may see a 10-30 second delay when plugging in your laptop before network access is available") - **T-0:** Per-floor enforcement window (off-hours, IT staff on standby in the building) ### Rollback Plan For each floor enforcement window, have a prepared rollback configuration that re-adds `authentication open` to all access ports on that floor. A simple template: ``` interface range GigabitEthernet1/0/1 - 48 authentication open ``` This restores Monitor Mode behavior without removing any other 802.1X configuration. Keep this template in a text file ready to paste at the console. ### Tracking Progress Build a deployment tracking spreadsheet or use Cisco DNA Center's 802.1X readiness dashboard. Track per-switch: - Phase (Monitor/Low-Impact/Closed) - Date moved to current phase - Endpoint count - Auth success rate from ISE - Open exceptions (devices not yet authenticating) ## Exceptions and Bypass Configuration Every enterprise deployment has devices that cannot authenticate via 802.1X or MAB. Handling these cleanly prevents them from becoming recurring helpdesk escalations. ### Static MAB Exceptions in ISE For devices with known MACs that cannot authenticate (legacy systems, specialized lab equipment), create static endpoint entries in ISE: Navigate to **Administration > Identity Management > Identities > Endpoints > Add**. Enter the MAC address and assign the appropriate identity group (e.g., `Legacy-Exceptions`). Create an authorization rule that matches this group and returns the appropriate VLAN and dACL. ### 802.1X Bypass for Specific Ports For ports that genuinely cannot participate in 802.1X at all (isolated lab ports, break-glass console access), use: ``` interface GigabitEthernet1/0/48 description CONSOLE-ONLY-NO-8021X switchport mode access switchport access vlan 99 no authentication port-control spanning-tree portfast ``` Document every port with `no authentication port-control` explicitly. These are exceptions to your security posture and should be tracked in your network documentation. ## Troubleshooting ### Symptom: After moving a floor to Closed Mode, 15% of endpoints in the building lose connectivity and land in VLAN 40 **Cause:** These endpoints have a higher-than-expected failure rate that was masked during Monitor Mode. Common causes include: endpoints that were in the ISE live log with failed auth that were categorized as "acceptable failures" but were actually managed devices; stale machine certificates; or endpoints that re-imaged without cert re-enrollment. **Fix:** Pull the ISE live log for the building, filter by `Authentication Status: Failed` and `NAS-IP: 10.0.99.X`. Export to CSV and group by failure reason. Address each failure reason class before re-attempting enforcement. In the meantime, restore `authentication open` on the affected floor to maintain productivity. ### Symptom: After Low-Impact Mode deployment, endpoints on one floor get DHCP but cannot authenticate - ISE shows no auth attempts from those ports **Cause:** The PREAUTH-ACL is blocking RADIUS traffic. This happens when the ISE PSN IP changes or when a secondary ISE PSN is added and the switch is sending RADIUS to a new IP not permitted in the pre-auth ACL. **Fix:** Review the PREAUTH-ACL entries. RADIUS is between the switch and ISE - the switch initiates RADIUS, not the endpoint. The pre-auth ACL applies to endpoint traffic, not switch-to-ISE RADIUS traffic. RADIUS flows from the switch management plane and is not subject to interface ACLs in the same way. If RADIUS traffic is actually being blocked, the issue is an upstream ACL on the SVI or a routed path, not the port-level pre-auth ACL. ### Symptom: Change of Authorization (CoA) from ISE stops working after moving to Closed Mode **Cause:** CoA requires the switch to accept incoming RADIUS Disconnect or Change-of-Authorization messages from ISE. If the management VLAN ACL or a control-plane policy is blocking UDP 1700 (CoA) from ISE's IP, CoA packets are silently dropped. **Fix:** Verify that UDP 1700 is permitted from ISE IP (10.0.0.10) to the switch management IP (10.0.99.1) in any ACL applied to the management interface or SVI. The relevant switch configuration for CoA is: ``` aaa server radius dynamic-author client 10.0.0.10 server-key ISEsecret123 port 1700 auth-type all ``` For the full CoA configuration and workflow, see [Article 19: Change of Authorization (CoA) in 802.1X](https://www.pinglabz.com/802-1x-coa-configuration-cisco-ios-xe-ise/). **What's Next:** [Article 28: RADIUS Redundancy and Failover in 802.1X Deployments](https://www.pinglabz.com/802-1x-radius-redundancy) \- A single ISE node is a single point of failure for every 802.1X authentication on your campus. Article 28 covers RADIUS server group configuration, deadtime tuning, ISE PSN high availability, and the Critical VLAN strategy that keeps the network accessible when ISE goes offline. Build this yourself, on real gear The PingLabz lab library: 74 hands-on labs on real Cisco IOS XE in Cisco Modeling Labs. Seven are free, no card required. [Browse the labs](https://www.pinglabz.com/labs/)