Enterprise Wireless: 802.1X and RADIUS

WPA2-Personal uses a single shared passphrase known to all authorized users. If one employee leaves the organization or if the passphrase is shared with an unauthorized person, the entire network is compromised and the passphrase must be changed for everyone. 802.1X eliminates this problem by giving each user or device unique credentials, so revoking access for one employee does not affect others. This is the foundational reason why enterprise environments use 802.1X over PSK — granular, per-identity access control.

The 802.1X framework has three roles. The supplicant is the client device (laptop, phone) that wants network access. The authenticator is the network device (wireless AP or switch) that enforces access — it forwards credentials but does not validate them itself. The Authentication Server (AS), typically a RADIUS server, validates the credentials and tells the authenticator whether to grant or deny access. This three-party design separates the enforcement point from the validation logic, enabling centralized policy management.

RADIUS (Remote Authentication Dial-In User Service) uses UDP ports 1812 (authentication) and 1813 (accounting). RADIUS messages are protected by a shared secret between the authenticator and the RADIUS server — only the User-Password attribute is encrypted; other fields are sent in cleartext. A more secure alternative is RADIUS over TLS (RadSec), which encrypts the entire RADIUS exchange. Common RADIUS implementations include Microsoft NPS (Network Policy Server), Cisco ISE, FreeRADIUS, and Aruba ClearPass.

EAP (Extensible Authentication Protocol) defines how credentials are exchanged within the 802.1X framework. Multiple EAP methods exist with varying security levels. EAP-TLS uses mutual certificate authentication (both client and server present certificates) and is the most secure. PEAP (Protected EAP) creates a TLS tunnel and sends username/password inside it — only the server needs a certificate. EAP-TTLS is similar to PEAP but more flexible. LEAP and EAP-MD5 are deprecated and vulnerable to offline dictionary attacks.

EAP-TLS is considered the gold standard for wireless enterprise authentication because it provides mutual authentication — both the client and the RADIUS server prove their identity with digital certificates. The client's certificate is provisioned by the organization's PKI through MDM or manual enrollment. Even if an evil twin AP is deployed, the client will reject the RADIUS server's certificate if it is not signed by the trusted corporate CA. This eliminates credential phishing via rogue wireless infrastructure.

RADIUS can do more than grant or deny access — it can dynamically assign the client to a specific VLAN based on user identity, group membership, or device type. This is called dynamic VLAN assignment. For example, an employee might be placed in VLAN 10 (corporate), a guest in VLAN 20, and a non-compliant device in VLAN 99 (quarantine). The RADIUS Access-Accept response includes Tunnel-Type, Tunnel-Medium-Type, and Tunnel-Private-Group-ID attributes specifying the VLAN. This enables one physical SSID to serve multiple security zones.

RADIUS Accounting records connection events — when a client connected, how long the session lasted, how much data was transferred, and which VLAN was assigned. These records are invaluable for forensic investigations: if a security incident occurs, accounting logs can identify which user was connected from which IP at a given time. Accounting messages are sent on UDP port 1813. Many organizations forward RADIUS accounting records to their SIEM for correlation with other security events such as anomalous data exfiltration or connections outside business hours.

Microsoft's NPS (Network Policy Server) is the built-in RADIUS implementation in Windows Server. NPS integrates natively with Active Directory, allowing RADIUS policies to be based on AD group membership, user attributes, and device health (via NAP/RADIUS quarantine). NPS supports EAP-TLS, PEAP-MS-CHAPv2, and PEAP-TLS. For wireless, NPS is configured as a RADIUS server and Wireless Access Points are added as RADIUS clients with a shared secret. Connection Request Policies and Network Policies control who gets access and what VLAN they receive.

Headless devices (printers, IP cameras, IoT sensors) often cannot perform EAP authentication because they lack a supplicant software stack or certificate store. For these devices, organizations may use MAC Authentication Bypass (MAB), where the device's MAC address is submitted to RADIUS as the credential. MAB is weaker than 802.1X because MAC addresses can be spoofed, but combined with VLAN isolation and NAC posture assessment, it provides a workable approach for devices that cannot support full 802.1X. Always place IoT devices on a separate restricted VLAN.

RADIUS is a critical infrastructure component — if the RADIUS server is unavailable, no wireless clients can authenticate. Best practices include deploying primary and secondary RADIUS servers configured on all APs, using server failover order so the secondary is contacted automatically. The shared secret between APs and RADIUS servers must be strong (at least 22 random characters) and kept confidential. Use RADIUS over TLS (RadSec) when RADIUS traffic traverses untrusted networks. Monitor RADIUS logs for authentication failure spikes that may indicate brute-force attempts or a credential stuffing attack.

802.1X is not limited to wireless networks — it is equally important on wired switch ports in environments where physical port security matters. Without 802.1X on wired ports, anyone who plugs an Ethernet cable into an office port gains network access. With 802.1X on switches, the port is blocked until the device authenticates. This prevents attackers from connecting unauthorized devices to network drops in conference rooms, hallways, or visitor areas. Guest users can be directed to a guest VLAN, while corporate devices are placed in their appropriate segment.

Test your understanding of CompTIA Security+ (SY0-701) concepts from this lesson.

In this lesson you learned: 802.1X uses a three-party model (supplicant, authenticator, RADIUS server) to provide individual per-user wireless authentication without a shared passphrase, EAP-TLS provides the strongest security through mutual certificate authentication while PEAP is a practical alternative requiring only a server certificate, and RADIUS accounting logs session data that is invaluable for forensic investigations. Next up we explore Bluetooth and IoT wireless threats.