A visitor waiting in a conference room unplugs the room's IP phone and plugs in a laptop. On many networks that laptop now has an address, a default gateway and a route to every server in the building. Network access control exists so that plugging in a cable, or knowing the Wi-Fi password, isn't enough to get on.
On the CompTIA Security+ SY0-801 exam, network access control sits under objective 4.1, which expects you to apply mitigating controls in a scenario, and it names three pieces: 802.1X, captive portals and endpoint posture checks. This lesson covers how NAC makes its decision, the three 802.1X roles and the RADIUS server behind them, why EAP-TLS is the strong option, how posture checks and quarantine VLANs work, agent versus agentless assessment, and captive portals for guests.
Network access control decides what a device may reach at the moment it connects
Network access control (NAC) runs a short decision every time a device connects to a switch port or wireless network. First it identifies the user and the device. Then it assesses whether the device meets policy. Finally it enforces a result: full access, limited access, a quarantine network, or no access.
The pieces are a policy server, which holds the rules and makes the decision, and the network devices that enforce it. Switches and wireless controllers apply the result by opening or closing the port, placing the device in a VLAN, or applying an access list to its traffic. Commercial NAC platforms and open-source tools such as FreeRADIUS and PacketFence fill the policy server role.
NAC traditionally makes its decision at admission and rechecks periodically. Zero Trust goes further and evaluates every request to every resource, as covered in the Zero Trust architecture section. The two work together: NAC keeps unknown and unhealthy devices off the network, and Zero Trust limits what admitted devices can reach.
802.1X has three roles: supplicant, authenticator, and authentication server
802.1X is the IEEE standard for port-based network access control, and it works through three roles.
- The supplicant is the software on the connecting device that presents credentials. It is built into Windows, macOS, Linux, iOS and Android.
- The authenticator is the switch or wireless access point (or wireless controller). It doesn't decide anything. Until authentication succeeds it keeps the port in an unauthorized state that passes only EAP over LAN (EAPOL) frames, and it relays the conversation to the server.
- The authentication server makes the decision, almost always a RADIUS server listening on UDP 1812 for authentication and UDP 1813 for accounting. It checks passwords against the directory or certificates against a trusted certificate authority, and replies with Access-Accept, often carrying a VLAN assignment, or Access-Reject.
The Extensible Authentication Protocol (EAP) runs end to end between supplicant and server. On the wire it rides in EAPOL frames, and between the authenticator and the server it rides inside RADIUS messages:
Supplicant (laptop) Authenticator (switch Gi1/0/14) Authentication server (RADIUS)
EAPOL-Start --->
<--- EAP-Request/Identity
EAP-Response/Identity ---> RADIUS Access-Request (UDP 1812) --->
... EAP method exchange relayed: EAPOL on the wire, RADIUS Access-Challenge/Access-Request upstream ...
<--- Access-Accept, VLAN 20
<--- EAP-Success, port authorized in VLAN 20
On a Cisco access switch, the port configuration is short:
interface GigabitEthernet1/0/14
switchport mode access
authentication port-control auto
dot1x pae authenticator
mab
The last line enables MAC Authentication Bypass (MAB) as a fallback for printers, cameras and phones that can't run a supplicant. The switch submits the device's MAC address as its identity. MAC addresses are trivial to spoof, so MAB devices belong in a restricted VLAN, ideally with device profiling to confirm a "printer" still behaves like one.
On Wi-Fi, WPA2-Enterprise and WPA3-Enterprise are 802.1X, with the AP or controller as the authenticator. Watch for TACACS+ as a distractor: it authenticates administrators logging in to network devices, not devices joining the network.