Network access control and 802.1X
A wall jack or a Wi-Fi password should not be a free pass onto the internal network. Network access control checks who or what is connecting before it gets an address, and places it in the right VLAN: staff, guests, printers or quarantine.
What we do
- 802.1X design and phased rollout
- Certificate authority and enrolment planning
- VLAN and policy mapping
- Guest and contractor access
- IoT and printer onboarding
- Monitor-mode rollout to avoid outages
- Authentication log review
Our team works with IEEE 802.1X authentication using a RADIUS server, with EAP-TLS certificates for managed laptops and phones, and with MAC authentication bypass for devices such as printers that cannot run a login. We have used FreeRADIUS, Microsoft Network Policy Server, Cisco Identity Services Engine and Aruba ClearPass, and we connect them to Active Directory, Entra ID and the certificate authority.
This group links to our Managed IT Services and Cybersecurity practices. Certificates are the hard part, so we plan enrolment and renewal first. MAC bypass is weaker than 802.1X, so we limit it to low-risk devices and place them in restricted segments. These are tools our team has experience with, not partnerships.
Leading platforms we work with
- FreeRADIUS
- Cisco Identity Services Engine
- Aruba ClearPass
- Microsoft Network Policy Server
Platforms and practices
- IEEE 802.1X wired and wireless
- EAP-TLS with device certificates
- RADIUS and dynamic VLAN assignment
- MAC authentication bypass for printers and IoT
- Guest and contractor onboarding
- Device posture and compliance checks
- Quarantine VLANs
- Certificate enrolment through Intune
References
Sources last checked .
Product names are trademarks of their owners and are listed to describe our experience; they do not imply endorsement or partnership.
How we use Network access control and 802.1X for clients
Managed IT Services
We run your IT day to day so it stays secure: help desk, devices, Microsoft 365, Exchange, Active Directory, backups, networks and monitoring.
Learn moreCybersecurity
We find out whether everything you run is safe from attackers, then we fix it.
Learn moreDatacenter & Colocation Builds
Cages, racks, power, cabling and servers, built by the people who will run them.
Learn moreWhere this matters most
Frequently asked questions
Direct answers to the questions we hear most. Something else on your mind?
Send us a messageWhat happens to devices that cannot run 802.1X?
Printers, cameras, door controllers and many medical or factory devices have no login capability. We identify them by MAC address (MAC authentication bypass) and place them in a restricted VLAN with rules allowing only what they need. A MAC address can be copied, so this is weaker than 802.1X, and we limit it to low-risk devices and monitor them.
Do we need certificates for 802.1X?
For managed laptops and phones, certificates (EAP-TLS) are the stronger choice, because there is no password to phish. They require a certificate authority and a way to enroll and renew certificates, usually through your device management. Password-based methods are possible but easier to attack, so we plan certificate enrolment and renewal before rollout.
Could a misconfiguration lock everyone out?
It can if rolled out carelessly. We start in monitor-only mode on a few ports, review which devices would have failed, add fallbacks for the ones that cannot authenticate, and then enforce in stages by site or floor. A RADIUS server outage is a real failure mode, so we build in redundant servers.
Does this also secure Wi-Fi?
Yes. WPA2 or WPA3 Enterprise uses the same 802.1X and RADIUS mechanism, so each person or device has its own credential instead of one shared Wi-Fi password. When someone leaves or a device is lost, you revoke that one credential and nobody else is affected.