Network Security: ACLs, Port Security, and 802.1X/RADIUS
ACLs, port security, and 802.1X
ACLs filter traffic by matching fields and applying permit/deny in order; there is an implicit deny at the end of an ACL. Standard ACLs match source; extended ACLs match source, destination, protocol, and ports. Place ACLs close to the source when possible, and remember direction: inbound ACLs are evaluated before routing. Port security limits learned MAC addresses per port and can take violation actions. 802.1X uses a supplicant, an authenticator switch, and a RADIUS server; EAP exchanges credentials, and the server returns accept/reject plus attributes such as dynamic VLAN or downloadable ACL. MAB provides MAC-based fallback; CoA can reauthenticate or change policy.
Traps: forgetting the implicit deny; applying an ACL in the wrong direction; mixing port security and 802.1X without planning; mismatched RADIUS shared secrets; and assuming 802.1X authenticates the switch rather than the endpoint. Also watch guest VLAN and critical VLAN behavior.
Worked example/rule of thumb: To allow SSH from 10.1.1.0/24 to 10.2.2.2 only, permit tcp 10.1.1.0/24 host 10.2.2.2 eq 22, then rely on implicit deny. Rule: order rules most-specific first, test with counters, and keep a management access path that cannot be locked out.