Security Fundamentals Fix · Medium ~18 min · 3 devices · 5 tasks · CCNA v2.0

802.1X wired: fix the RADIUS reach, policy and interface mode

SW1 is set up to require 802.1X on Fa0/1, with the RADIUS server RADIUS-SRV at 10.0.99.10 (shared key RadKey99). On fail or timeout a client should land in VLAN 99 (guest). The AAA model is not enabled, dot1x system auth control is off, the port is still in force-authorized mode, and the guest VLAN is not set. Fix all five issues so a successful auth lands in VLAN 10 and a failure lands in VLAN 99.

SW1 Fa0/1 -> PC1 (supplicant, VLAN 10 if authorized, VLAN 99 guest if not)
SW1 Gi0/23 -> RADIUS-SRV (10.0.99.10, key RadKey99, user alice / Alice2026)
VLAN 10 = USERS, VLAN 99 = GUEST

Topology

Tasks

○Enable AAA: aaa new-model
○Point dot1x auth at RADIUS: aaa authentication dot1x default group radius
○Turn on dot1x platform-wide: dot1x system-auth-control
○Set the port to authentication port-control auto on Fa0/1
○Set the guest VLAN on Fa0/1: authentication event fail action authorize vlan 99

Hints (open one at a time)

Hint 1: AAA first

dot1x needs AAA. Start with aaa new-model, then aaa authentication dot1x default group radius. Without this, the switch has no idea where to send EAPoL frames.

Hint 2: the platform flag

Enable dot1x platform-wide with dot1x system-auth-control. Without this, per-port dot1x pae authenticator commands are silently ignored.

Hint 3: the port mode

Under Fa0/1 apply switchport mode access, switchport access vlan 10, authentication port-control auto, and dot1x pae authenticator. Then set the guest VLAN: authentication event fail action authorize vlan 99.

Full solution

SW1# configure terminal
SW1(config)# aaa new-model
SW1(config)# radius server RADIUS-SRV
SW1(config-radius-server)# address ipv4 10.0.99.10
SW1(config-radius-server)# key RadKey99
SW1(config-radius-server)# exit
SW1(config)# aaa authentication dot1x default group radius
SW1(config)# dot1x system-auth-control
SW1(config)# interface Fa0/1
SW1(config-if)# switchport mode access
SW1(config-if)# switchport access vlan 10
SW1(config-if)# authentication port-control auto
SW1(config-if)# dot1x pae authenticator
SW1(config-if)# authentication event fail action authorize vlan 99
SW1(config-if)# end

The guest VLAN fallback applies when the supplicant fails or does not respond. For a client with no 802.1X supplicant at all, use authentication event no-response action authorize vlan 99.

Stuck on a lab, or not sure what to practice next?

Talk it through with a mentor on a free 20-minute call. We look at your lab, your exam date and your weak spots, and you leave with a plan.

Book a free session

Cisco Mentorship

CompTIA Foundation

Firewall Security

Short Courses

More

CCNA v1.1

CCNA v2.0

CCNA Automation

CCNP

Network+

NSE 4

Lab Tasks

Videos

Packet Tracer Labs

Simulators

802.1X wired: fix the RADIUS reach, policy and interface mode

Stuck on a lab, or not sure what to practice next?