Missing Network Access Control (802.1X)

How Missing Network Access Control (802.1X) works

Missing network access control means any device that reaches a live socket gets an address and full user-VLAN access, with no check on what it is. The port in a meeting room, behind the reception desk, in a warehouse or under a desk in an unlocked branch office is patched straight to the user VLAN, and DHCP answers whatever asks. Where 802.1X exists it is often deployed in monitor mode indefinitely, or with a MAC authentication bypass list and an auth-fail VLAN that quietly grants the same access a supplicant would have earned.

The attacker gets a foothold with no credential, no malware and no phishing: a small computer inside a delivered printer, a device left in a meeting room, or a laptop plugged in during a site visit. It is easy to miss because the control is invisible when absent. Nothing logs a port that never asked for authentication, the network works perfectly for everyone, and a compliance answer of “we have 802.1X” is true for the head-office floor while every branch, lift lobby and camera port runs the old configuration. The MAB exception list is the second blind spot: it authenticates a value printed on the outside of the device.

Missing Network Access Control (802.1X) in practice

Read the access-port configuration before plugging anything in

The switch config tells you which ports enforce, which run in monitor mode and which were never touched, so the physical test confirms a conclusion rather than discovering one. Collect it read-only.

! show running-config interface GigabitEthernet1/0/14
interface GigabitEthernet1/0/14
 description Meeting Room 2 - floor plate
 switchport mode access
 switchport access vlan 20
 spanning-tree portfast
!                                  <- no authentication port-control, no dot1x pae
                                   <- port is live and unauthenticated

! show authentication sessions interface GigabitEthernet1/0/9
Interface  MAC Address     Method  Domain  Status Fg  Session ID
Gi1/0/9    0011.2233.4455  mab     DATA    Auth       0A0A14390000...
!                                  <- MAB success, no supplicant: label-based identity

! show dot1x all summary | count "Auth"  vs  total access ports

Three counts make the finding: access ports total, ports with authentication port-control auto, and ports whose only successful method is mab.

Attach an authorised test device and watch the port come up

This proves the config reading. Capture on the wire before requesting an address, so the absence of an EAP exchange is evidenced rather than assumed.

# start the capture first, then plug the cable in
sudo tcpdump -i eth0 -nn -e -c 20 'ether proto 0x888e' -w /tmp/eapol.pcap &
sudo ip link set eth0 up
sleep 20; sudo pkill tcpdump

# no EAPOL frames captured -> the switch never requested identity
tcpdump -r /tmp/eapol.pcap 2>/dev/null | wc -l

sudo dhclient -v eth0
ip -4 addr show dev eth0
ip route

An empty EAPOL capture plus a lease in the production user VLAN is the finding. A lease in a quarantine or remediation VLAN is the correct behaviour and should be recorded as such, so re-test reachability from it with the probes on the Flat Networks And Missing Segmentation page before calling it isolated.

Test the MAB fallback without disrupting the real device

MAB is bypassed by presenting an allow-listed MAC. Do not clone the address of a device that is currently online: two identical MACs make the switch flap the entry between ports and take the real printer offline. Schedule the test with the device owner, power the printer down for the window, and use its address only for that window.

# MAC taken from the printer's own label or the switch CAM table, with the
# device powered down for the agreed window
PRINTER_MAC="00:11:22:33:44:55"

sudo ip link set eth0 down
sudo ip link set eth0 address "$PRINTER_MAC"
sudo ip link set eth0 up
sudo dhclient -v eth0

# probe set the printer would never make
nmap -Pn -n --open -p 445,3389 10.10.30.0/24 -oN /tmp/mab-bypass.txt

# restore the burned-in address before leaving the port
sudo ip link set eth0 down && sudo ip link set eth0 address <ORIGINAL_MAC>
sudo ip link set eth0 up

The equivalent check on an IP phone port is whether multi-domain authentication is configured: a phone in the voice domain with an unauthenticated data domain behind it gives a laptop the same free ride.

Record the result per port class, not per port

One office has hundreds of ports and three or four behaviours. Classify what you tested so the remediation list is finite.

port class            sample      EAPOL?  lease VLAN     verdict
--------------------  ----------  ------  -------------  ----------------------------------
meeting room plates   Gi1/0/14    no      20 (user)      FINDING: open port, full user VLAN
reception desk        Gi1/0/22    no      20 (user)      FINDING: public-area port, live
desk port, staff area Gi1/0/3     yes     20 (user)      enforcing, certificate supplicant
printer port          Gi1/0/9     no      20 (user)      FINDING: MAB, label identity only
failed-auth test      Gi1/0/3     yes     20 (user)      FINDING: auth-fail VLAN == user VLAN
unused patched port   Gi1/0/31    no      20 (user)      FINDING: live but unassigned

The auth-fail row matters most: a port that enforces 802.1X but drops a failed supplicant into the production VLAN is enforcing nothing.

How to fix and prevent Missing Network Access Control (802.1X)

1. Set the failure policy before widening coverage
   • A failed or timed-out authentication must land in a quarantine VLAN with no route to internal zones, never in the production user VLAN.
   • Check the auth-fail, guest and critical-auth VLAN settings together; one permissive fallback undoes the whole rollout.
2. Deploy 802.1X in monitor mode, then set a date to enforce
   • Monitor mode measures which devices have no supplicant without breaking them. It is a survey step, not a control: it blocks nothing while it runs.
   • Use the monitor data to build the exception list, then switch port-control to auto per switch stack.
3. Shut and shelve every port that is not in use
   • Administratively down plus an unused-port VLAN on the whole access range, with ports enabled on request rather than patched by default.
   • Public-area ports in reception, meeting rooms and lifts get quarantine access even after enforcement.
4. Replace MAB with certificate identity wherever the device supports it
   • Modern printers and cameras usually support EAP-TLS. MAB is a partial control at best: the identity is readable from the device label.
   • Where MAB must stay, bind the exception to a specific port and a restricted VLAN, with an expiry date and a named owner.
5. Review the exception and quarantine lists on a schedule
   • Exceptions accumulate through projects and vendor visits; a quarterly diff against the asset inventory catches the ones nobody removed.

Last updated 2026-08-24