I85PREP
⌘ K
JNCIP-ENT study materials
JNCIP-ENT study resources

JNCIP-ENT: Layer 2 Authentication and Access Control

JNCIP-ENT · Work through your exam, one topic at a time.

All guide sections

Layer 2 Authentication and Access Control

What the Layer 2 Authentication and Access Control domain tests

JNCIP-ENT tests 802.1X, MAC RADIUS, captive portal, RADIUS profiles, and dynamic VLAN assignment on Junos access switches. You must know the roles and the order of authentication methods.

Core rules

  • The supplicant is the endpoint, the authenticator is the switch, and the RADIUS server makes the decision.
  • 802.1X uses EAP over LAN; MAC RADIUS authenticates the endpoint MAC address without a supplicant.
  • Authentication order determines which method is tried first; multiple supplicants can share a port.
  • RADIUS attributes can assign a VLAN or apply a filter after success.
  • Guest, server-reject, and server-fail VLANs control fallback behavior.

Worked example

A VoIP phone without an 802.1X supplicant connects to a port configured only for dot1x. Authentication fails and the phone stays on the guest VLAN. The endpoint needs MAC RADIUS. Adding mac-radius to the authentication order lets the switch send the MAC address as the username; RADIUS accepts it and assigns the voice VLAN. The reasoning is method mismatch, not a bad password.

Traps

Do not put an uplink behind 802.1X unless you have a planned fallback. Do not confuse MAC RADIUS with MAC move limiting. Check that the RADIUS shared secret and server reachability are correct before changing supplicant settings. Dynamic VLAN assignment requires the switch port to accept the returned VLAN.