"Prove Who You Are Before You Get a Port"
VLANs control where traffic goes once a device is on the network. But what stops an unauthorized person from walking up to an empty desk, plugging in their laptop, and getting a corporate IP address? Nothing — unless you implement 802.1X.
802.1X is an IEEE standard for port-based Network Access Control (NAC). Before a device is allowed to send any traffic (other than authentication packets), it must prove its identity to a central authentication server. Until it does, the switch port is in a locked state — the device might as well be unplugged.
The Three Actors:
- Supplicant: The device trying to connect (your laptop). It runs an 802.1X client, often built into the OS.
- Authenticator: The network device enforcing access — the switch or WiFi access point. It acts as a middleman, forwarding authentication traffic but blocking everything else.
- Authentication Server: Usually a RADIUS server (Remote Authentication Dial-In User Service). This is the source of truth — it checks credentials and tells the switch "allow" or "deny."
The Flow:
1. Laptop plugs into switch port.
2. Switch: "Who are you?" (EAP-Request/Identity)
3. Laptop: "I am [email protected]" (EAP-Response)
4. Switch forwards credentials to RADIUS server.
5. RADIUS checks Active Directory / certificate store.
6. RADIUS → Switch: "ACCEPT. Put this port in VLAN 10."
7. Switch opens the port. Laptop gets a DHCP lease on VLAN 10.
If the RADIUS server says "REJECT" (wrong password, unrecognized device certificate), the port stays locked. The device gets nothing.
Certificate-Based vs. Password-Based Authentication:
Most enterprise deployments use EAP-TLS (Extensible Authentication Protocol - Transport Layer Security), where the device presents a client certificate instead of a password. This is stronger because certificates can't be phished, and the device itself is authenticated (not just the user). The certificate is provisioned by your MDM (Mobile Device Management) system when the laptop is enrolled.
A common interview question for network or security engineering roles: "How do you prevent an unauthorized laptop from getting network access if someone finds an open Ethernet port?" The answer is 802.1X with EAP-TLS. Follow up with: the switch port stays in an unauthorized state, the device can only exchange EAP packets, and without a valid certificate issued by your internal CA, it never gets a VLAN assignment or DHCP lease. Mentioning that you'd also disable unused ports in the switch config shows operational depth.