Network Access Control and Authentication
Core concepts
802.1X is the backbone here. Know the three roles: supplicant (client), authenticator (switch or controller), and authentication server (RADIUS). EAP variants matter: EAP-TLS uses certificates on both sides (strongest, most mutual authentication); PEAP and EAP-TTLS tunnel an inner method (often MSCHAPv2) inside a TLS server certificate. Know that the client must validate the server certificate to prevent evil twin credential capture.
Understand MAB (MAC authentication bypass) as a fallback for devices that cannot do 802.1X, and why it is weak (MAC spoofing). Know RADIUS accounting and CoA (change of authorization) for dynamic re-assignment of roles after posture changes.
Traps to watch
- "Which EAP method is most secure?" The answer is EAP-TLS because it requires certificates on both client and server, giving mutual authentication without a password.
- MAB is not authentication; it is identification. Never pick it as a strong control.
- Open authentication on a guest SSID is acceptable only when paired with captive portal and client isolation; questions test whether you know it provides no encryption by itself.
Rule of thumb
Ask "does the client verify the server?" If not, the method is vulnerable to a fake AP. EAP-TLS and properly configured PEAP/TTLS (with server cert validation) pass; bare PSK and open networks do not.
Worked example
A laptop cannot run an 802.1X supplicant. The correct fallback is MAB on the switch port, ideally combined with a restricted role and profiling, not disabling authentication entirely.