MAC Authentication Bypass (MAB) Configuration on Cisco IOS XE and ISE
MAB authenticates printers, cameras, and legacy gear that cannot run a supplicant by using their MAC as the RADIUS username. Here is the Cisco IOS XE and ISE config.
802.1X
Port-based network access control, the standard for authenticating users and devices onto wired and wireless networks. Articles tagged 802.1X cover supplicant and authenticator behavior, RADIUS, EAP methods, Cisco ISE, dynamic VLANs, dACLs, host modes, and phased deployment.
Latest posts — page 2
Configuring EAP-TLS with Certificates on Cisco ISE and IOS XE
EAP-TLS replaces 802.1X passwords with mutual certificate auth. Here is the PKI prep, ISE policy, and IOS XE config you need for a production certificate-based rollout.
Configuring PEAP Authentication with Cisco ISE and IOS XE
PEAP-MSCHAPv2 protects the credential exchange inside a TLS tunnel against an ISE server certificate. Here is the full Cisco ISE and IOS XE config for AD users.
Configuring Cisco ISE as a RADIUS Server for 802.1X
The ISE side of 802.1X: network devices, identity sources, authentication and authorization policies, and the Policy Set that ties it all together for a Catalyst 9300.
Basic 802.1X Port Configuration on Cisco IOS XE Switches
A complete 802.1X switchport config on IOS XE 17.9: AAA, RADIUS servers, dot1x system-auth-control, interface policy-map, and the voice VLAN gotchas to avoid.
802.1X Authentication Flow Step by Step: From EAPOL Start to RADIUS Accept
The 802.1X authentication flow, step by step, from EAPOL-Start through RADIUS Access-Accept and port authorization. Three conversations, one timeline, no magic.
Introduction to Cisco ISE: What It Is and Why It Matters for 802.1X
Cisco ISE is more than a RADIUS server. It is the policy decision point for 802.1X, layering device type, posture, and context on top of pass/fail authentication.
Change of Authorization (CoA) in 802.1X: How It Works and How to Configure It
RADIUS CoA lets ISE push policy updates to the switch mid-session, no re-auth required. Here is the IOS XE and ISE config, plus the posture remediation use case.
Web Authentication as a Fallback in 802.1X: Configuration and Use Cases
Web authentication adds a captive portal as an 802.1X fallback for guests, contractors, and unmanaged endpoints. Here is the Cisco IOS XE and ISE config.
802.1X with IP Phones: Configuring Multi-Domain Authentication on Cisco IOS XE
Multi-domain authentication lets an IP phone and a PC share one 802.1X port with separate voice and data VLANs. Here is the Cisco IOS XE config and verification.
Downloadable ACLs (dACLs) with Cisco ISE and 802.1X
dACLs move ACL definitions off the switch and into ISE, delivered per session via RADIUS. Here is how the download mechanism works and how to configure both sides.
Guest VLAN, Auth-Fail VLAN, and Critical VLAN in 802.1X: When and How to Use Them
Guest VLAN, Auth-Fail VLAN, and Critical VLAN cover the three 802.1X failure paths: no supplicant, wrong credentials, and RADIUS down. Here is when and how to use each.