Dot1x

802.1X is an IEEE standard for port-based network access control that provides authentication framework to prevent unauthorized devices from accessing network resources until proper credentials are validated. It operates using the Extensible Authentication Protocol (EAP) to facilitate secure communication between supplicants (client devices), authenticators (network switches), and authentication servers (typically RADIUS). The 802.1X framework supports various authentication methods including username/password, digital certificates, and smart cards, enabling organizations to implement comprehensive network access control policies with granular user and device identification capabilities.

Diagram

Classes

configuration (iosxe.devices)

Name	Type	Constraint	Mandatory	Default Value
dot1x	Class	`[dot1x]`	No

dot1x (iosxe.devices.configuration)

Name	Type	Constraint	Mandatory
auth_fail_eapol	Boolean	`true`, `false`	No
credentials	List	`[credentials]`	No
critical_eapol	Boolean	`true`, `false`	No
critical_eapol_block	Boolean	`true`, `false`	No
critical_eapol_config_block	Boolean	`true`, `false`	No
critical_recovery_delay	Integer	min: `1`, max: `10000`	No
guest_vlan_supplicant	Boolean	`true`, `false`	No
test_timeout	Integer	min: `1`, max: `65535`	No
logging_verbose	Boolean	`true`, `false`	No
supplicant_controlled_transient	Boolean	`true`, `false`	No
supplicant_force_multicast	Boolean	`true`, `false`	No
system_auth_control	Boolean	`true`, `false`	No

credentials (iosxe.devices.configuration.dot1x)

Name	Type	Constraint	Mandatory
profile_name	String		Yes
description	String		No
username	String		No
password_type	Choice	`0`, `6`, `7`	No
password	String		No
pki_trustpoint	String		No
anonymous_id	String		No

Guidelines and Limitations

The guest_vlan_supplicant attribute (dot1x guest-vlan supplicant) is deprecated on IOS XE 17.15.3 and later. On newer platforms, guest VLAN behavior should be managed through Control Policy Language (CPL) configurations instead.

Examples

Comprehensive 802.1X Configuration with Guest VLAN and Credentials

dot1x system-auth-control
dot1x guest-vlan supplicant
dot1x auth-fail eapol
dot1x critical eapol-config block
dot1x critical recovery delay 20
dot1x test timeout 20
dot1x logging verbose
dot1x supplicant controlled transient
dot1x supplicant force-multicast

iosxe:
  devices:
    - name: Device1
      configuration:
        dot1x:
          auth_fail_eapol: true
          critical_eapol_config_block: true
          critical_recovery_delay: 20
          guest_vlan_supplicant: true
          test_timeout: 20
          logging_verbose: true
          supplicant_controlled_transient: true
          supplicant_force_multicast: true
          system_auth_control: true
          credentials:
            - profile_name: first_creds
              description: first profile test
              username: test_user
              password_type: '0'
              password: test_pass
              pki_trustpoint: sample_trustpoint
              anonymous_id: anon_test_1