802.1X Works for Staff, Fails for Contractor Devices
An enterprise runs 802.1X with EAP-TLS for staff laptops via a RADIUS server. A new group of contractor tablets must join the same SSID but cannot be issued corporate certificates. Contractors are currently failing authentication and falling back to a guest network with no access to internal resources. Security requires that contractor devices be authenticated, placed on a restricted VLAN, and prevented from reaching staff subnets. The RADIUS server supports multiple EAP methods and role-based authorization.
1. Design an authentication and authorization approach that admits contractor tablets without corporate certificates while enforcing segmentation.
Read the worked answer
Use a separate identity path on the same SSID with role-based authorization:
- Configure the RADIUS server to accept EAP-TTLS/PAP or PEAP-MSCHAPv2 for the contractor user group (username/password), while staff continue with EAP-TLS.
- On successful contractor authentication, return authorization attributes (e.g., tunnel attributes) that place the device on a restricted VLAN.
- Enforce segmentation with an ACL/role on the controller that permits only required internal resources and denies staff subnets.
- Optionally require device posture or a registration step for contractor tablets.
This satisfies security (authenticated, segmented) without issuing corporate certificates. Document the RADIUS policy so staff and contractors are cleanly separated by group.
2. How would you verify that a contractor device cannot reach staff subnets after connecting?
Read the worked answer
Test from the contractor device after association:
- Confirm it received an IP on the restricted VLAN (not the staff VLAN).
- Attempt to reach a known staff subnet host (ping/HTTP) - must fail.
- Attempt to reach an allowed internal resource - must succeed, proving the ACL is not over-blocking.
- Confirm the RADIUS authorization attributes applied (check controller role/VLAN assignment logs).
- Repeat for a staff laptop to confirm staff policy is unchanged.
Capture the controller role assignment and RADIUS accept logs as evidence.