802.1X Port Security & Dynamic VLAN Assignment via RADIUS / Windows NPS

1. Scope, Threat Model & Defensive Overview

Open, unauthenticated Ethernet ports in conference rooms, lobby jacks, and unmonitored desks represent an immediate physical attack vector. Anyone connecting an unmanaged device can obtain a DHCP lease and probe internal infrastructure.

IEEE 802.1X Network Access Control (NAC) enforces identity-driven port access:

• Ports remain in an unauthorized state; all frames are blocked except for EAPOL authentication.
• Corporate Domain Machines: Authenticate via Machine/User Certificate or credentials → Dynamically assigned to VLAN 30 (Users).
• Corporate IP Phones: Authenticate via MAC Authentication Bypass (MAB) → Assigned to VLAN 40 (VoIP).
• Unmanaged / Guest Devices: Authentication fails → Automatically dumped into VLAN 50 (Guest) with internet-only egress.

[Workstation Plugged In] ──► [Switchport: Closed]
                                    │
                                    ▼ (EAPOL / RADIUS Challenge)
                      [Windows Server 2022/2025 NPS]
                                    │
         ┌──────────────────────────┴──────────────────────────┐
         ▼ (Access-Accept + VLAN 30)                           ▼ (Access-Reject)
[Authorized Corporate PC: VLAN 30]              [Guest / Rogue Device: VLAN 50]

---

2. Windows Server 2022/2025 NPS Configuration

Run on the Domain Controller or dedicated member server running the Network Policy Server (NPS) role (DC-01 / NPS-01).

Step 1: Register Network Switch as RADIUS Client

1. Open Network Policy Server (nps.msc).
2. Right-click RADIUS Clients → New:
   • Friendly Name: SW-ACCESS-01
   • Address (IP or FQDN): 10.10.10.2 (Switch Management IP)
   • Shared Secret: Set a secure, 32+ character random secret (e.g. RadiusSharedSecret2026!).

Step 2: Configure Network Policy for Corporate PCs

Under Policies → Network Policies, create POL-8021X-Corporate-Computers:

1. Conditions:
   • Add: NAS-Port-Type: Ethernet
   • Add: Windows Groups: CORP\Domain Computers
2. Constraints:
   • Authentication Methods: Enable Microsoft: Protected EAP (PEAP) (or EAP-TLS).
3. Settings (Standard RADIUS Attributes for Dynamic VLAN Assignment): Under Standard Attributes, configure:
   • Tunnel-Type: Virtual LANs (VLAN) (Value: 13)
   • Tunnel-Medium-Type: 802 (Includes all 802 media plus Ethernet) (Value: 6)
   • Tunnel-Private-Group-ID: 30 (Target VLAN ID string)

---

3. Implementation Path A: Cisco Catalyst / IOS-XE Switch Configuration

Configure on Cisco Catalyst switches (SW-ACCESS-01):

Step 1: Enable AAA & Define RADIUS Server

configure terminal

# 1. Enable AAA subsystem
aaa new-model

# 2. Configure RADIUS Server Group
radius server NPS-SERVER-01
 address ipv4 10.10.10.10 auth-port 1812 acct-port 1813
 key RadiusSharedSecret2026!
exit

# 3. Define AAA Authentication & Authorization lists
aaa group server radius RADIUS-GROUP-NPS
 server name NPS-SERVER-01
exit

aaa authentication dot1x default group RADIUS-GROUP-NPS
aaa authorization network default group RADIUS-GROUP-NPS
aaa accounting dot1x default start-stop group RADIUS-GROUP-NPS

# 4. Globally enable 802.1X
dot1x system-auth-control

Step 2: Configure Access Switchports

Apply 802.1X, MAB, and Guest-VLAN failover to user access ports:

interface range GigabitEthernet1/0/1 - 40
 description 802.1X-SECURED-ACCESS-PORT
 switchport mode access
 switchport access vlan 50

 # Enable 802.1X and MAC Authentication Bypass
 authentication order dot1x mab
 authentication priority dot1x mab
 authentication port-control auto
 dot1x pae authenticator

 # Host Mode: Multi-Domain (Permits 1 PC + 1 IP Phone on same physical jack)
 authentication host-mode multi-domain

 # Fallback Actions:
 # If client fails auth, drop to Guest VLAN 50
 authentication event fail action authorize vlan 50
 authentication event no-response action authorize vlan 50

 # Critical Auth Survivability: If NPS server is unreachable, allow corporate VLAN 30
 authentication event server dead action authorize vlan 30
 exit
write memory

---

4. Implementation Path B: Fortinet FortiSwitch Configuration

Configure via FortiGate controller CLI:

Step 1: Configure RADIUS Server in FortiOS

config user radius
    edit "RADIUS-NPS"
        set server "10.10.10.10"
        set secret RadiusSharedSecret2026!
        set auth-type ms_chap_v2
    next
end

Step 2: Create 802.1X Security Policy

config switch-controller security-policy 802-1X
    edit "8021X-POLICY-CORP"
        set security-mode 802.1X-mac-based
        set user-group "RADIUS-NPS"
        set guest-vlan enable
        set guest-vlan-id 50
        set auth-fail-vlan enable
        set auth-fail-vlan-id 50
    next
end

Step 3: Apply Policy to Access Ports

config switch-controller managed-switch
    edit "FSW-ACCESS-01"
        config ports
            edit "port1"
                set port-security-policy "8021X-POLICY-CORP"
            next
        end
    next
end

---

5. Operational Verification & Troubleshooting

On Cisco Catalyst:

# 1. View live authenticated sessions on interface
show authentication sessions interface GigabitEthernet1/0/1 details

Expected Output (Corporate Machine):

            Interface:  GigabitEthernet1/0/1
          MAC Address:  0050.56a1.b2c3
          IPv4 Address:  10.10.30.55
            User Name:  host/ws-eng-042.corp.internal
               Status:  Authorized
               Domain:  DATA
       Oper host mode:  multi-domain
     Oper control dir:  both
        Authorized By:  Authentication Server
          Vlan Policy:  30
      Method status:  DOT1X - Success

On Windows Server NPS:

Open Event Viewer → Custom Views → Server Roles → Network Policy Server:

• Event ID 6272: “Network Policy Server granted access to a user.”
• Event ID 6273: “Network Policy Server denied access to a user.” (Review reason code to fix certificate trust or account lockouts).

---

6. Rollback & Emergency Inaccessible Server Bypass

If the RADIUS / NPS server experiences catastrophic hardware loss:

Emergency Global Bypass (Temporarily Open Switchports)

If endpoints are trapped in Guest VLAN because the RADIUS server is dead:

# On Cisco Catalyst:
configure terminal
interface range GigabitEthernet1/0/1 - 40
 authentication port-control force-authorized
 switchport access vlan 30
exit

(Instantly restores full network access to corporate VLAN 30 across all ports until the RADIUS infrastructure is restored).