Dynamic VLAN Assignment with 802.1X and Cisco ISE
Dynamic VLAN assignment returns the target VLAN in RADIUS Tunnel attributes, so identity (not cabling) decides the network segment. Here is the ISE and IOS XE config.
802.1X
Port-based network access control, the standard for authenticating users and devices onto wired and wireless networks. Articles tagged 802.1X cover supplicant and authenticator behavior, RADIUS, EAP methods, Cisco ISE, dynamic VLANs, dACLs, host modes, and phased deployment.
Latest posts — page 3
802.1X Authentication Host Modes: Single-Host, Multi-Host, Multi-Domain, Multi-Auth
Single-host, multi-host, multi-domain, and multi-auth control how many MACs can use an 802.1X port. Pick the wrong mode and you get silent failures or open ports.
Troubleshooting 802.1X with show authentication sessions and debug Commands
show authentication sessions is your first 802.1X diagnostic. Here is how to read the output, when to escalate to debug dot1x and debug radius, and how to stay sane.
dACL Not Applying Correctly in 802.1X: Troubleshooting Downloadable ACLs
dACL not applying usually means ISE sent the wrong AVPair name, the switch cannot download it, or the ACL content parsed badly. Here is the full troubleshooting path.
Dynamic VLAN Assignment Not Working in 802.1X: Troubleshooting Guide
Dynamic VLAN not working breaks down to four causes: ISE not sending Tunnel attributes, wrong values, switch not processing them, or VLAN not in the database. Here is how to isolate.
RADIUS Server Unreachable in 802.1X: Causes and Fixes
When a switch marks ISE DEAD, every 802.1X port is affected. Here is how to confirm the outage fast, check shared secret and routing, and restore service.
Client Stuck in Unauthorized State: Diagnosing 802.1X Port Issues
A client stuck in Unauthorized covers five different failures: no EAPOL, supp timeout, dot1x missing, Access-Reject, or post-auth policy failure. Here is how to tell them apart.
802.1X Authentication Failing: Where to Start Troubleshooting
802.1X auth fails across four layers: endpoint, switch port, RADIUS, ISE policy. Jumping straight to ISE logs wastes time. Here is the structured way to isolate the layer.
Cisco TrustSec and SGTs: How They Integrate with 802.1X
TrustSec attaches a Security Group Tag to an 802.1X session, so segmentation policy follows identity through the network. Here is how SGT assignment integrates with ISE.
RADIUS Redundancy and Failover in 802.1X Deployments
Running Closed Mode 802.1X without RADIUS redundancy is asking for an outage. Here are the failure modes, the IOS XE config for multiple PSNs, and the verification.
Phased 802.1X Deployment Strategy for Enterprise Networks
Phased 802.1X deployments succeed when each phase is data collection first, enforcement second. Here is Phase 0 through Phase 4 with real endpoint discovery tactics.
Monitor Mode vs Low-Impact Mode vs Closed Mode: Choosing Your 802.1X Deployment Strategy
Monitor Mode, Low-Impact Mode, and Closed Mode each trade visibility for enforcement. Here are the IOS XE configs, show output, and honest gaps for each mode.