How to Configure and Set Up 802.1X Port-Based Authentication

In this tutorial, you’ll learn how to configure and set up 802.1X port-based authentication to secure network access. We’ll cover how 802.1X works, the roles of the supplicant, authenticator, and authentication server, and how to enable local or RADIUS authentication. You’ll also learn to set up Guest VLANs, adjust port settings, and manage re-authentication. Finally, we’ll show a real-world example of how 802.1X helps protect a corporate network by allowing only authorized users and devices to connect.

Software Required

MapleLink Lite User Interface (Enter the network switch’s IP address into a web browser to access its web interface.

Hardware Required

• MS1-L05G01F
• MS1-L08G
• Embedded Industrial Box PC (A web browser is required. Use one of our Industrial Box PCs.)

What is IEEE 802.1X

IEEE 802.1X is a standard for port-based network access control, where a “port” refers to a single point of attachment to a LAN. Part of the IEEE 802.1 family of protocols, it provides an authentication mechanism for devices attempting to connect to the network, either permitting or denying access based on identity verification. It is widely used in wireless 802.11 networks and operates using the Extensible Authentication Protocol (EAP).

802.1X authentication involves three parts:

• Supplicant – the client device (like a laptop) trying to connect.
• Authenticator – the switch or wireless access point that controls access.
• Authentication server – usually a RADIUS server that verifies credentials.

The authenticator acts like an airport gate, only letting the client in after its identity is confirmed. The client (supplicant) sends credentials such as a username, password, or certificate, which the authenticator forwards to the server. If approved, the client gains access to the network.

When a device first connects, its port is unauthorized, allowing only 802.1X messages (like EAPOL) and blocking all other traffic. The authenticator asks for the client’s identity, forwards the response to the server, and if verified, changes the port to authorized, allowing normal network traffic. When the client disconnects, the port returns to the unauthorized state.

Local User Accounts

Switches can store user profiles locally, allowing them to authenticate users without relying on an external server. However, this method supports only a limited number of users.

Guest VLAN

The Guest VLAN feature allows limited network access (e.g., to download 802.1X client software) for devices that either don’t respond to EAP requests or don’t send EAPOL packets. When enabled, clients are placed into the Guest VLAN if they fail to complete the authentication handshake.

CLI Configuration

Web Configuration 802.1X Global Settings

Global Settings

Web Configuration 802.1X Port Settings

Port Settings

Real-World Scenario

Industrial Automation Network Security

Setting:
In a modern manufacturing plant, hundreds of industrial devices—such as PLCs, HMIs, SCADA servers, sensors, and engineering workstations—communicate over a shared Ethernet network. This network often bridges both the plant floor and higher-level business systems. To maintain uptime and protect critical assets, the IT/OT team must ensure that only trusted and authorized devices can connect to the control network. Unauthorized connections, even accidental ones, could disrupt production or create serious safety and compliance risks.

Why Use 802.1X Authentication?
Without 802.1X, any device plugged into a switch port or wireless access point could gain network access. For example, an engineer’s personal laptop or an infected maintenance device could unintentionally introduce malware or alter PLC configurations. Shared Wi-Fi passwords are also difficult to manage and can easily leak outside the organization.

802.1X solves this by enforcing identity-based access control at every port. Each device or user must first authenticate using credentials (username/password, certificate, or hardware ID) before being granted network access. This ensures that only approved devices—such as company-managed laptops or validated HMIs—can communicate with control equipment. Devices that fail authentication can be automatically restricted to a limited VLAN for diagnostics or updates.

How It Works (On the Factory Floor):
When an engineer plugs a laptop into a control switch, the port starts in an unauthorized state, allowing only 802.1X traffic (EAPOL messages). The switch, acting as the authenticator, sends an EAP-Request to the laptop (supplicant). The laptop replies with credentials, which the switch forwards to the RADIUS server for verification. If the credentials are valid, the server authorizes the connection, and the switch transitions the port to an authorized state, allowing normal communication with PLCs, HMIs, or engineering tools. When the session ends, the port reverts to an unauthorized state, blocking all non-802.1X traffic.

Real Benefits in Industrial Environments:

• Enhanced security: Prevents unauthorized laptops, IoT devices, or rogue controllers from accessing the control network.
• Role-based access control: Limits each user or device to specific network zones, reducing the attack surface.
• Regulatory compliance: Supports cybersecurity frameworks like ISA/IEC 62443 and NIST SP 800-82.
• Centralized management: Allows IT/OT teams to monitor authentication activity and manage credentials through a RADIUS or Active Directory integration.
• Reduced downtime risk: Protects critical automation systems from configuration tampering or malware propagation via unauthorized network connections.

Resources & Documentation

Lite-Managed Network Switches Resources:

• Industrial Network Switches
• Industrial Lite-Managed Network Switches – MS1 Series Datasheet
• MS1-L05G01F Quick Start Guide
• MS1-L08G Quick Start Guide
• What is a network switch?
• Industrial Network Switch Operations Manual – Lite-Managed Series

More
Tutorials
Sample Projects
Software Downloads

See our Support Center for a complete list of Quick Start and Installation Guides