Campus Access Security and Network Access Control
This domain covers port security, 802.1X, MAC authentication, captive portal, role-based access, and RADIUS integration. The core idea: authenticate the user or device, assign a role, and enforce policy - ideally at the edge and consistently for wired and wireless.
Know the 802.1X roles: supplicant (client), authenticator (switch or AP/controller), and authentication server (RADIUS). EAP methods differ: PEAP/MSCHAPv2 is common for user credentials; EAP-TLS uses certificates on both sides. MAC authentication is a fallback for devices that cannot run a supplicant (printers, cameras), and MAC auth + 802.1X fallback ordering is a frequent question. Understand dynamic authorization (RADIUS CoA) to change a role or VLAN without reconnecting, and downloadable roles so policy lives centrally.
Traps: thinking MAC authentication is strong security (MACs are spoofable - it is identification, not strong authentication); confusing the unauthenticated role with a deny-all state; forgetting that RADIUS shared secrets and server reachability must be correct before any auth succeeds; and mixing up captive portal (web login) with 802.1X (supplicant-based). Also watch for questions about port security (limiting MACs per port) versus 802.1X - they solve different problems.
Rule of thumb: design a fallback chain - 802.1X first, MAC auth second, captive portal or a restricted unauthenticated role last - and give unknown devices the least-privilege role. Verify with RADIUS logs and authenticator show commands; a failed auth usually points to shared secret, certificate, or VLAN/role mapping, not the client.