802.1x for Wired and Wireless

Question 1

Supplicant

Answer 1

Endpoint 802.1X-compliant software service. It communicates with NAD authenticators to request network access

Question 2

Authenticator

Answer 2

controls access to the network, based on client authentication status. The objective here is for the endpoints to authenticate to the authentication server via some Extensible Authentication Protocol (EAP). NAD authenticators act as an intermediary between the client and the authentication server.

Question 3

Authentication server

Answer 3

This role performs client authentication. Then authentication server validates client identity and notifies NAD authenticators of client authorization status.

Question 4

The authorization features include

Answer 4

VLAN assignment
ACL assignment
Time-based access
Security group access

Question 5

Dynamic VLAN

Answer 5

After successful 802.1x/EAP authentication, the user can be authorized to be on a specific VLAN. This dynamic VLAN is configured on the Cisco ISE RADIUS service and communicated in a RADIUS Access-Accept message. It can also be used when authentication fails.

Question 6

Default VLAN

Answer 6

the default VLAN is the one that is configured on a wired switch port or for a wireless service set identifier

Question 7

802.1x Names ACLs

Answer 7

named ACLs provide differentiated access for wireless users. Named ACLs are configured locally on the WLC

Question 8

802.1X Downloadable ACLs

Answer 8

Downloadable ACLs(dACL) can provide different levels of access to 802.1X authenticated users. The RADIUS server authenticates 802.1x connected users. Based on user identity, it retrieves ACL attributes and sends them to the switch. The switch applies attributes to the 802.1x port during the user session

Question 9

What is the difference between Names ACL and Downloadable ACLs

Answer 9

1. Named ACLs are for wireless users while Downloadable ACLs are for wired
   2.dACL are configured on Cisco ISE, and pushed down to the switch during the authentication/ authorization process
   Named ACLs are configured locally on the WLC. You merely reference this ACL in a Cisco ISE authorization policy.

Question 10

Monitor Mode

Answer 10

1. 802.1X deployment without any effect on user or endpoint access
2. AAA RADIUS accounting provides visibility into 802.1x operation

Question 11

Monitor mode is configured with

Answer 11

authentication open

authentication host-mode multi-auth interface commands

Question 12

Low-impact mode

Answer 12

1. ingress ACL applied to a port configured in open mode
2. ACL allows basic connectivity for the unauthenticated host. (Low-impact mode allows you to incrementally increase security)

Question 13

Closed Mode

Answer 13

1. The default behavior, traditional 802.1x method

2. Dynamic VLAN or DACL assignment for differentiated access

Question 14

High-security mode

Answer 14

allows only EAPOL traffic until the authentication process completes, which is the default behavior of 802.1x enabled switch port

Question 15

Single Host Mode

Answer 15

in single-host mode, only one client can be connected to the 802.1x enabled port. When the port state changes to “up”, the switch detect the client and sends an EAPOL frame.

Question 16

Multiple Host Mode

Answer 16

in multiple-host mode, you can attach multiple hosts to a single 802.1x enabled port. In this mode, only the first client that attaches clients must be authorized. All subsequent client is granted network access based on this authentication. If the port becomes unauthorized, the authenticator denies network access to all attached client

Question 17

Multiple Domain Authentication Mode

Answer 17

multidomain authentication mode allows an IP phone, and a single host behind the IP phone, to authenticate independently via 802.1x, MAB, or web-based authentication. In this application, multidomain refers to two domains (data and voice VLAN). Only one MAC address is allowed per domain

Question 18

Multiple Authentication Mode

Answer 18

Multiple Authentication mode allows one 802.1x or MAB client on the voice VLAN. it also allows multiple authenticated 802.1X, MAB, or web authorization client on the data VLAN. When a hub or access point is connected to an 802.1x port, multi-auth mode provides enhanced security over the multi-host mode by requiring authentication of each connected client

Question 19

802.1x implementation Guidelines

Answer 19

1. 802.1x is supported on layer 2 wired and wireless access ports
2. 802.1x is not supported on: Dynamic port and EtherChannel Port