Build an 802.1X lab

These hands-on guides walk a complete 802.1X deployment on a lab small enough to build in an afternoon, and concrete enough that every command and every checkbox is one you will actually type. This first page builds the foundation the others start from: a switch that talks RADIUS to Taranac, one access port under 802.1X, and a Windows PC on the other end of the cable.

Nothing here authenticates a user yet — that is deliberate. The single most common way an 802.1X rollout stalls is that the plumbing was never proven before the supplicant was touched, so a switch-side problem gets mistaken for a client problem for hours. By the end of this page you will have positive proof that a RADIUS request leaves the switch and arrives at Taranac, and only then do the later guides configure the client.

VLANs used throughout the series:

Substitute your own addressing as you go — the only hard requirement is that the switch and Taranac can reach each other on UDP, and that the switch’s RADIUS source address matches what you register in Taranac.

• Taranac installed and reachable. See Installation or the virtual appliance. You need admin access to the web UI.
• A switch with a management IP and an L3 path to Taranac. Console or out-of-band access to that switch — you are about to enable port authentication, and locking yourself out of a lab switch is a rite of passage worth skipping.
• A Windows 10/11 machine with a wired NIC on a port of that switch.
• The NAC RADIUS ports open between them: auth 1814/udp, accounting 1815/udp, CoA 3799/udp.

A switch that is not registered is not a client: the NAC server drops its packets before any policy runs, and you will see nothing in the logs. This step comes first for that reason.

1. Open Network → Devices (/network/devices) and click New.

2. Fill in the identity side — a name, and a Network Object carrying the switch’s address (a /32 host object is the usual choice). That address must be the one the switch sources RADIUS packets from, not necessarily its loopback or its DNS name. Vendor, platform and location are optional but worth filling in.

3. Under Protocol Support, turn on NAC. NAC rides on the RADIUS protocol, so enabling it reveals the RADIUS Secret field even when the RADIUS toggle itself is off — that same secret is what your radius server line on the switch must carry. Set a strong one and keep it to hand.

4. Leave CoA Port and CoA Secret empty unless you have a reason not to. Empty means inherit: the device falls back to its group, then to the global nac.coa_port / nac.coa_secret setting — the Details panel spells out which value is actually in effect. The default CoA port is 3799.

5. Optionally pin a Vendor Dictionary (CoA). Left empty, Taranac detects the vendor and falls back to a generic encoding; set explicitly, CoA actions (reauth, bounce, VLAN change) are encoded exactly the way that platform expects.

6. Save.

The device form. RADIUS is off and the RADIUS Secret field is still there — that is NAC reusing it. On the right, the Details panel resolves what each setting actually evaluates to, including 3799 (Global default) for the CoA port left blank on the left.

Secrets resolve along a three-level chain — device → device group → global setting — with the first level that has a value winning. For a lab, set it on the device. For a real network, a per-site device group carrying the secret is usually the better shape; see Network devices.

Now the switch side. This block is global plumbing only: which server, which ports, which secret, and the master switch that turns 802.1X on.

! ── The NAC RADIUS server ───────────────────────────────────────
radius server TARANAC-NAC
 address ipv4 10.30.0.20 auth-port 1814 acct-port 1815
 timeout 5
 retransmit 2
 key <RADIUS_SECRET>

! ── Its own server group, so device-admin AAA is untouched ──────
aaa group server radius TARANAC-NAC-GRP
 server name TARANAC-NAC
 ip radius source-interface Vlan1

aaa authentication dot1x default group TARANAC-NAC-GRP
aaa authorization network default group TARANAC-NAC-GRP
aaa accounting dot1x default start-stop group TARANAC-NAC-GRP

! ── The global 802.1X master switch ─────────────────────────────
dot1x system-auth-control

! ── Source + attributes ─────────────────────────────────────────
ip radius source-interface Vlan1
radius-server attribute 6 on-for-login-auth
radius-server attribute 8 include-in-access-req
radius-server attribute 25 access-request include

! ── CoA listener (Taranac pushes reauth / disconnect here) ──────
aaa server radius dynamic-author
 client 10.30.0.20 server-key <RADIUS_SECRET>
 port 3799
 auth-type any

! ── The global 802.1X master switch ─────────────────────────────
dot1x system-auth-control
dot1x dynamic-authorization

! ── The NAC RADIUS server + CoA listener ────────────────────────
radius-server host 10.30.0.20 auth-port 1814 acct-port 1815 key 0 <RADIUS_SECRET>
radius-server dynamic-authorization port 3799

aaa group server radius TARANAC-NAC
 server 10.30.0.20 auth-port 1814 acct-port 1815

aaa authentication dot1x default group TARANAC-NAC
aaa accounting dot1x default start-stop group TARANAC-NAC

Two more things worth getting right the first time:

• Source the RADIUS packets deliberately. ip radius source-interface Vlan1 (Cisco) makes packets carry the switch’s management IP, which is what you registered in Step 1. If the source address and the registered address disagree, the NAC server sees an unknown client and drops the request without logging a policy decision.
• The secret is per device. It must match the radius_secret on this switch’s device entry. Not the TACACS+ key, and not another switch’s secret. A mismatch surfaces as a rejected or unanswered request at the NAC handler.
• Save the configuration — write memory on Cisco, write on EOS. A lab switch that reloads with half of this config missing produces symptoms that look nothing like “the config is gone”: authentication may keep working while accounting silently stops, so sessions vanish from Taranac while access still succeeds.

Wire the Windows PC to Gi1/1 and apply the port config. This is a dot1x port with MAB as the fallback — the shape you will use for most real access ports.

interface GigabitEthernet1/1
 switchport access vlan 10
 switchport mode access
 ip device tracking maximum 10
 authentication open                       ! ← monitor mode; remove when you go live
 authentication order mab dot1x
 authentication priority dot1x mab
 authentication port-control auto
 authentication periodic
 authentication timer reauthenticate server
 authentication violation restrict
 mab
 dot1x pae authenticator
 dot1x timeout tx-period 10
 spanning-tree portfast edge

interface Ethernet3
 switchport access vlan 10
 switchport mode access
 dot1x pae authenticator
 dot1x port-control auto
 dot1x host-mode multi-host authenticated
 dot1x reauthentication
 dot1x mac based authentication
 dot1x timeout tx-period 10
 spanning-tree portfast edge

Do not configure the Windows supplicant yet. First confirm that a request physically reaches Taranac.

On the switch:

show dot1x
show dot1x interface GigabitEthernet1/1 details
show authentication sessions interface GigabitEthernet1/1 details
show aaa servers

show dot1x
show dot1x interface Ethernet3
show radius
show aaa accounting
show mac address-table
show logging

On Taranac: open Logging → NAC → Authentication (/logging/nac/authentication). Plug the PC in, or bounce the port (shutdown / no shutdown), and watch.

• With Windows’ 802.1X not yet configured, the PC sends no EAPOL — so after the dot1x timeout the switch falls back to MAB and you should see a MAB attempt for the PC’s MAC address. That request is almost certainly rejected by the default deny-all policy, and that is a success for this step: a rejected request that reached the handler proves the client entry, the secret, the routing and the ports are all correct.
• The device should also appear under Endpoints (/nac/endpoints), created from the MAC the switch reported.

If you see nothing at all, work down this table before changing anything on the client.

The lab is now a working NAC testbed: the switch asks, Taranac answers, and every answer is logged. From here:

• 802.1X with PEAP — create a user, build a policy, configure the Windows supplicant window by window, watch a real authentication succeed, and close the port.
• MAB for printers and IoT — take the dumb client on Gi1/0 from unknown to classified and onto VLAN 40. (Coming next in this series.)
• EAP-TLS for domain users — certificates instead of passwords, for Active Directory accounts.

• NAC overview — how the pieces fit together
• Network devices — device fields, groups and secret inheritance
• 802.1X authentication — what each EAP method needs
• NAC policy — authorization profiles and rule matching