Certopolis

CompTIA Network+ (V9)

802.1X and NAC explained for Network+

802.1X keeps a port closed to normal traffic until the connecting device authenticates with EAP. The device is the supplicant, the switch or access point is the authenticator, and a server such as RADIUS decides. Network access control (NAC) goes further and also checks the device's health, such as its patch level, before granting full access.

The three roles

NIST SP 800-97 defines the roles. The supplicant is the entity being authenticated, such as a laptop. The authenticator sits at the other end of the link and facilitates authentication, such as a switch or access point. The authentication server checks the supplicant's credentials and decides whether it may use the service.

Between supplicant and authenticator, the messages use EAP over LAN (EAPOL). Between authenticator and server, RADIUS is the protocol most commonly used to carry the EAP messages.

RFC 3748 explains why this scales: instead of updating every authenticator for each new authentication method, EAP lets a backend server implement the methods, and the authenticator acts as a pass-through. Adopting a new EAP method across hundreds of access points therefore means updating the RADIUS server, not the access points.

Controlled and uncontrolled ports

SP 800-97 describes the port model. EAP authentication travels through the uncontrolled port. Non-EAP data frames go through the controlled port, which passes or blocks them depending on whether authentication succeeded.

Example: a laptop on an 802.1X switch port has not finished authenticating, and its DHCP requests get no answer. That is expected. DHCP is non-EAP traffic, so the controlled port drops it until authentication succeeds.

What NAC adds

NIST SP 800-41 Rev. 1 describes network access control as allowing access based on the user's credentials and on health checks of the user's computer.

The checks it lists include antimalware and personal firewall updates and settings, time since the last malware scan, and the patch level and security configuration of the operating system and applications.

If the credentials are good but the device fails the check, the user may get only limited access for remediation. 802.1X alone decides on identity; the health check is what NAC adds.

Why MAC filtering is not a substitute

SP 800-97 notes that the MAC address is not encrypted, so allowed addresses are easy to see in captured traffic, and almost all adapters let software set the MAC address. An outsider can copy an allowed address and pass a MAC filter. 802.1X requires real authentication, which a copied address does not provide.

Where the exam catches people

  • Believing the access point must support each new EAP method: it passes EAP through; the backend authentication server implements the method.
  • Believing the laptop is the RADIUS client: the switch or access point is the authenticator and RADIUS client; the laptop is the supplicant.
  • Believing an unauthenticated 802.1X port still passes DHCP: only EAP frames pass until authentication succeeds.
  • Believing 802.1X checks patch level: it checks identity; health checks are part of NAC.

Written from CompTIA's documentation

Try 3 questions on this

Pick an answer to see why each option is right or wrong.

  1. A laptop on an 802.1X-enabled switch port has not yet completed authentication, and its DHCP requests get no reply. Which of the following is the most likely reason?

    Right. In the game that’s Renown for your Network Security building.

    Not that one: D is right. In the game your Network Security building would lose a little Renown, and this question would come back later.

    Show the full explanation and doc quotes

    Until the laptop authenticates, its DHCP requests are non-EAP frames on a blocked controlled port, so no DHCP server ever sees them.

    Written from nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-97.pdf

  2. A company runs 802.1X on hundreds of wireless access points that check users against one central authentication server, and it adopts a new EAP method. Which of the following must implement the method?

    Right. In the game that’s Renown for your Network Security building.

    Not that one: C is right. In the game your Network Security building would lose a little Renown, and this question would come back later.

    Show the full explanation and doc quotes

    In this deployment the central RADIUS server is that backend server, so it is the infrastructure component that must support the new method; the access points relay the EAP exchange unchanged.

    Written from www.rfc-editor.org/rfc/rfc3748.html

  3. A company wants a laptop presenting valid user credentials to stay off the production LAN until its patch level and antivirus state have been verified. Which of the following provides this?

    Right. In the game that’s Renown for your Network Security building.

    Not that one: C is right. In the game your Network Security building would lose a little Renown, and this question would come back later.

    Show the full explanation and doc quotes

    It adds that a user with acceptable credentials whose device fails the check may get only limited access for remediation. Credentials alone are what 802.1X decides on; the health check is what NAC adds.

    Written from nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-41r1.pdf