802.1X Deployment: A Phased Plan for UK Networks

A safe 802.1X deployment is a phased one. Prepare switches, RADIUS servers and identity sources first. Provision supplicants to endpoints. Then move each switch port from monitor mode, to low-impact mode, to closed mode only once the logs show that legitimate devices authenticate. Jumping straight to enforcement is the most common way to lock out printers, phones and staff on day one.

This guide is for IT directors and network managers in education, manufacturing, logistics, hospitality, shared workspaces and housing. It covers the prerequisites, how to choose between certificates, credentials and MAC authentication bypass (MAB), the rollout stages, profile provisioning, verification and troubleshooting.

Re-solution

Plan a Safer 802.1X Rollout

Re-Solution provides Cisco network solutions, infrastructure audits and network surveys to support secure, well-planned network changes.

Explore Re-Solution’s services

TL;DR

802.1X needs capable edge switches or access points, at least one reachable RADIUS server (ideally several) and an identity source before any port is enforced.
Use certificates or credentials for managed devices, and MAB as a controlled fallback for devices that cannot run a supplicant.
Follow Cisco’s phased model: monitor mode, low-impact mode, then closed mode. Never go straight to closed.
Push wired and wireless profiles through your endpoint management tool, and verify with show dot1x commands before widening enforcement.
Most failures trace back to RADIUS reachability, timers or a missing profile, so check those first.

How 802.1X works in practice
What you need before you start
Certificates, credentials or MAB: choosing per device type
The phased rollout: monitor, low-impact, closed
Provisioning supplicants to endpoints
Verifying that 802.1X is active
Troubleshooting failed authentication
Plan your 802.1X rollout with Re-Solution
FAQ
Sources

How 802.1X works in practice

IEEE 802.1X is port-based network access control. Nothing but authentication traffic passes until the device has proved who or what it is. Three roles are involved:

Supplicant: the software on the endpoint (laptop, phone, IoT device) that presents an identity.
Authenticator: the switch port or wireless access point that relays the exchange and enforces the result.
Authentication server: normally a RADIUS server, which checks the identity against a directory or certificate authority and returns an allow or deny decision, often with a VLAN or access policy.

The authenticator does not judge credentials itself. It passes EAP messages between supplicant and RADIUS server, then opens or restricts the port according to the reply. That is why the RADIUS service is the heart of any deployment, and why its availability matters so much.

For a wider view of how access control fits together, our network access controller guide explains where 802.1X sits alongside policy and posture checks.

What you need before you start

Preparation decides whether the rollout is uneventful. Jisc, the UK education and research network body, sets out the basics: suitable 802.1X-capable infrastructure, and at least one RADIUS server reachable by every authenticator. Most organisations will want several redundant servers.

The same guidance notes that older edge switches may need replacing, and that switch software or firmware may need upgrading. You also need RADIUS servers configured with shared secrets, and AAA enabled on the switches.

A practical readiness checklist:

Inventory every edge port and device. Include access points, printers, door controllers, cameras, meters, handhelds and anything plugged into a wall socket in a corridor.
Check switch and AP capability. Confirm the hardware and software versions support the 802.1X features you plan to use, including MAB and flexible authentication.
Design RADIUS for resilience. Use at least two servers in separate failure domains, and decide what happens to ports if both are unreachable.
Choose the identity source. Typically a directory for users and machines, plus a certificate authority if you use certificates.
Decide the policy outcome. For each group, state which VLAN or access list applies, and what a failed device receives.
Plan the supplicant rollout for every managed endpoint type.

If you have not audited the network recently, do that first. A network audit shows which switches cannot support the design and which ports carry devices nobody has documented. Our network audit checklist lists what to evidence at each step.

If door readers, cameras or other physical security systems share your access layer, include them in the port inventory. Planning for face recognition access control hardware early prevents these devices appearing as unexplained MAC addresses during monitor mode.

Wireless considerations for education

UK universities and colleges running eduroam should follow Jisc’s current guidance. Jisc recommends WPA3-Enterprise transition mode in the 2.4GHz and 5GHz bands, with Protected Management Frames (PMF) supported rather than required. The 192-bit mode is not permitted in eduroam environments on those bands, because mandatory PMF would exclude some older devices. Schools face the same trade-off between security and legacy hardware, which is covered in our piece on network access management for schools.

Certificates, credentials or MAB: choosing per device type

No single method suits every device. Match the method to what the device can do and how much you trust it.

Device type	Typical method	Why
Managed laptops and desktops	EAP-TLS with machine certificates	Strongest identity, no passwords to phish or reset
Staff or student personal devices	Credentials (for example PEAP) or certificates via onboarding	Ties access to a user, works with existing directory
Corporate phones and tablets	Certificates pushed by device management	Silent, consistent, easy to revoke
Printers, IoT sensors, building controllers	MAB, with profiling and restricted access	Cannot run a supplicant
Guests and contractors	Web authentication or a guest portal	Short-lived, separated from internal resources

Certificates give the best assurance but need a certificate authority and a lifecycle process for issuing, renewing and revoking. Credentials are quicker to start but depend on users trusting the right server certificate. If supplicants are not configured to validate the RADIUS server’s certificate, credentials can be exposed to a fake access point.

MAB deserves care. Cisco recommends enabling MAB to support devices that are not 802.1X compliant, with the switch using the device’s MAC address as its identity. A MAC address is easy to spoof, so treat MAB as a lower-trust method. Pair it with device profiling, place those devices in a restricted segment, and allow only the traffic they need. In manufacturing and logistics, where scanners, PLC gateways and sensors are common, this segmentation is the real security control.

The phased rollout: monitor, low-impact, closed

Cisco’s guidance is explicit. The wired deployment best practice is monitor mode to gain visibility without blocking, low-impact mode to allow limited access while testing, and high-security (closed) mode once you are confident. The earlier Cisco 802.1X deployment guide describes moving from an open network to a closed model as a fundamental change that needs thorough planning.

Stage 1: monitor mode

Authentication is enabled on the port, but failure does not block access. You collect logs showing who authenticates, who fails and which devices never attempt it. Run this long enough to cover a full working cycle, including term time, shift patterns or seasonal peaks. The output is a list of misconfigured and unknown devices to fix before moving on.

Stage 2: low-impact mode

Ports now permit limited pre-authentication access, such as DHCP, DNS and a path to the servers needed for provisioning. After successful authentication, the device receives its full policy. This stage proves that policy assignment works, and that VLAN or access list changes do not break applications. Keep the pilot small: one building, one floor or one warehouse zone.

Stage 3: closed mode

No traffic passes until authentication succeeds. Move to it port group by port group, only where monitor and low-impact data shows few exceptions. Keep a documented rollback for each group, and a defined process for staff who report a device that has stopped working.

A sensible pilot order

IT-owned areas and managed laptops.
A single site or building with a known device mix.
Wireless SSIDs using 802.1X, which are usually simpler than wired.
Remaining wired segments, with IoT and operational technology last.

For multi-site organisations, standardise the policy design centrally and roll out site by site. This is where managed services help: the same team monitors authentication logs across sites and handles exceptions.

Provisioning supplicants to endpoints

A policy is only as good as the endpoints’ ability to meet it. On Windows, the wired supplicant (Wired AutoConfig) must be running and given a profile. In Intune, administrators can deploy Windows wired profiles that specify the EAP type, server trust settings, and either client certificates or username and password authentication.

Good practice for profile design:

Specify the trusted RADIUS server certificate and root CA so clients refuse to authenticate to an impostor.
Use certificate deployment (SCEP or PKCS) in the same policy group as the network profile, so a device never receives a profile that needs a certificate it does not hold.
Test on a pilot group with each hardware model and operating system build before assigning to all.
Cover wireless and wired separately. They use different profile types and different failure modes.
Plan for unmanaged and personal devices with an onboarding portal or a separate SSID and policy.

Verifying that 802.1X is active

Do not assume that a configuration push means ports are protected. Cisco’s guide lists the commands to inspect 802.1X status: show dot1x statistics, show dot1x interface statistics, show dot1x all and show dot1x interface, which show statistics along with administrative and operational state.

A verification routine worth scheduling:

Compare the list of access ports against the list with 802.1X enabled, and chase every gap.
Check that ports in closed mode actually show the expected operational state.
Review RADIUS logs for devices that authenticate by MAB and confirm each is expected.
Test wireless with a deliberately unauthorised device.

Repeat after switch replacements and cabling changes, since new hardware often arrives with default configuration. A periodic review also fits within wider compliance work, covered in our cybersecurity compliance basics.

Troubleshooting failed authentication

Cisco’s Catalyst 9000 troubleshooting guide recommends reviewing syslog errors and capturing traffic at the client or access interface, and near the authenticator and the authentication server. It also points to RADIUS reachability, configuration and timeout values as the first checks.

A working order of investigation:

Is the supplicant running and configured? A disabled Wired AutoConfig service or a missing profile is a frequent cause.
Can the switch reach the RADIUS server? Check routing, firewall rules, the shared secret and the source interface.
Does the server trust the client? Expired certificates, missing root CAs and clock drift cause silent failures.
Is the policy returning the right result? Inspect the RADIUS logs for the matched rule.
Are timers aligned? Per the same Cisco guide, if the client’s DHCP timeout is shorter than the dot1x timeout, DHCP can fail and the client may fall back to an APIPA address. Adjust the timeout values to suit.

If devices work in monitor mode but fail in low-impact or closed mode, the usual suspect is the access list applied before authentication, or a policy assignment that places devices in the wrong VLAN.

Our perspective

In our experience, 802.1X projects rarely fail on cryptography. They fail on inventory and on operations: unknown devices, no owner for the RADIUS service, and no process for the exception that appears on a Monday morning.

With over 35 years working with Cisco, we approach deployment as a managed change, not a switch-on. We start with an audit of switches, wireless and device types, design policy by sector and risk, then pilot, then enforce in stages. We design the policy so that the people who run the building, the school or the warehouse can live with it.

For organisations without a large in-house team, the ongoing work matters as much as the rollout: certificate renewals, log review, new device onboarding. That is why we pair the design with a managed service, so identity-based access keeps working long after the project closes.

Jacob

Plan your 802.1X rollout with Re-Solution

Re-Solution designs and supports Cisco-based wired and wireless networks for education, manufacturing, logistics, hospitality, shared workspaces and housing providers. We can audit your readiness, define the access policy, run the pilot and operate the service afterwards, or deliver the network as a subscription through Network as a Service.

To discuss your estate, start with our professional services or get in touch through re-solution.co.uk. For platform choices, see our comparison of Meraki access control and Cisco ISE, and our overview of Cisco Access Manager.

FAQ

How long does an 802.1X deployment take?

It depends on the number of sites, the device mix and how many unknown devices monitor mode reveals. A single site pilot can run in weeks, while a multi-site estate is usually staged over months. Spending longer in monitor mode is cheaper than fixing lockouts later.

Do I need certificates for 802.1X?

Not always. Credentials-based methods work, but certificates give stronger assurance for managed devices and avoid password handling. Whichever you choose, supplicants should validate the RADIUS server’s certificate.

What about devices that cannot run a supplicant?

Use MAB, which identifies a device by its MAC address, as Cisco describes. Combine it with profiling and a restricted network segment, since MAC addresses can be spoofed.

Should I go straight to closed mode on a new network?

Cisco’s best practice is not to jump directly to closed mode, even on wired networks. Passing through monitor and low-impact stages surfaces misconfigured devices before they lose access.

Does 802.1X apply to Wi-Fi as well as wired ports?

Yes. Access points act as authenticators, using WPA2 or WPA3-Enterprise with a RADIUS server. Wireless is often the easiest place to begin.

802.1X Deployment: A Phased Plan for UK Networks

TL;DR

Table of Contents

How 802.1X works in practice