Tutorials · Security
How to Enable 802.1X Port Authentication on Switches
Stop unknown devices from using your network ports: configure 802.1X with RADIUS and MAC-authentication bypass for printers and cameras.
Before you start
- Managed switches with 802.1X support
- A RADIUS server
- A test port and a test laptop
Step by step
Point the switch to RADIUS
radius-server host 10.99.0.20 key <shared-secret> aaa authentication dot1x default group radius
Enable 802.1X globally
dot1x system-auth-controlEnable it on access ports
Start with a few ports in monitor mode if your switch supports it.
interface range gigabitEthernet 0/1-20 dot1x port-control auto
Handle devices without 802.1X
Use MAC authentication bypass (MAB) for printers, phones and cameras, and place them in restricted VLANs.
interface gigabitEthernet 0/21 mab
Assign VLANs from RADIUS
Return the VLAN in the RADIUS reply so staff, contractors and IoT land in the right network.
Verify
show dot1x all
Commands are generic, industry-standard examples. Exact syntax and menu names vary by model and firmware; check your device's manual on the Documentation page.
Pro tips
- Roll out in phases: monitor first, then enforce.
- Keep a guest or remediation VLAN for devices that fail authentication.
FAQ
Frequently asked questions
Is MAC authentication secure?
MAC addresses can be spoofed, so put MAB devices in tightly restricted VLANs with ACLs.
Keep learning
Related guides
WPA3-Enterprise with RADIUS
Read more →Zero trust networking
Read more →How to Secure the Management of Switches, Routers and Access Points
A hardening checklist for every network device: strong credentials, SSH only, a management VLAN, access lists and logging.
Read more →How to Segment IoT and CCTV Devices From Your Main Network
Put cameras, smart TVs, sensors and building systems in their own VLANs so one compromised device cannot reach your business systems.
Read more →How to Write Firewall Rules That Actually Protect You
Default-deny, least privilege and clean rule bases: practical rules for any firewall or gateway.
Read more →Stuck on a step?
Ask Navijin technical support or an authorised partner for help with your configuration.