802.1X Dynamic VLAN Assignment and RADIUS

Statically assigning switch ports to specific Virtual LANs (VLANs) scales poorly and presents a critical physical security vulnerability. If a malicious actor unplugs a corporate printer and connects a laptop, they immediately gain access to the underlying subnet.

To secure the wired and wireless edge, network engineers must transition from static port configurations to identity-based networking. By implementing the IEEE 802.1X standard backed by an enterprise RADIUS infrastructure, UniFi access switches and access points dynamically alter their operational state—and VLAN assignments—based on cryptographic cryptographic authentication of the connecting device.

---

1. The 802.1X Port-Based Access Control Architecture

The 802.1X protocol relies on three distinct operational entities to establish an authenticated boundary:

1. Supplicant (Client): The endpoint device (e.g., a Windows laptop running the native dot3svc service) requesting network access.
2. Authenticator (UniFi Switch / AP): The network access device. It acts as a strict cryptographic gatekeeper. Prior to successful authentication, the physical switch port remains in an Unauthorized state, blocking all Layer 2 traffic except Extensible Authentication Protocol over LAN (EAPOL) frames.
3. Authentication Server (RADIUS): The backend database and cryptographic validator (e.g., FreeRADIUS, Windows NPS, or Cisco ISE) that verifies the supplicant's credentials and instructs the Authenticator on how to configure the port.

---

2. The EAP-TLS Cryptographic Handshake

While several EAP methods exist, EAP-TLS (Transport Layer Security) is the enterprise gold standard because it relies on mutual certificate-based authentication rather than vulnerable passwords.

The transaction must execute in a strict procedural sequence to successfully transition the authenticator's port state.

1. EAPOL-Start (Supplicant Initiation): Layer 2 MAC Broadcast. The Supplicant detects a link-state change on the physical network interface card (NIC) and broadcasts an EAPOL-Start frame to the reserved multicast MAC address 01:80:C2:00:00:03.

2. Identity Request & Response: Cleartext Exchange. The UniFi switch (Authenticator) replies with an EAP-Request/Identity packet. The Supplicant answers with an EAP-Response/Identity packet containing its subject name (e.g., host/laptop-01.corp.local). The switch encapsulates this response into a RADIUS Access-Request packet and forwards it to the RADIUS server.

3. TLS Tunnel Establishment: Asymmetric Cryptography. The RADIUS server responds with an EAP-Request/TLS-Start. The Supplicant and Server exchange certificates to mutually authenticate one another. Once the server validates the Supplicant's certificate against the internal Certificate Authority (CA) revocation list, a secure, encrypted TLS tunnel is formed inside the EAP payload.

4. RADIUS Access-Accept & Port Transition: State shift to Authorized. Upon successful cryptographic validation, the RADIUS server transmits a RADIUS Access-Accept packet to the UniFi switch. The switch immediately transitions the physical port's state machine from $P_{\text{state}} = \text{Unauthorized}$ to $P_{\text{state}} = \text{Authorized}$, permitting standard IP traffic to flow.

---

3. RADIUS Attribute Mapping for Dynamic VLANs

Transitioning a port to an Authorized state only grants access to the switch port's native (default) VLAN. To achieve true micro-segmentation, the RADIUS server must dictate exactly which VLAN the supplicant belongs to, effectively rewriting the switch port's configuration on the fly.

This is accomplished by injecting specific Internet Engineering Task Force (IETF) Vendor-Specific Attributes (VSAs) into the final RADIUS Access-Accept payload. When the UniFi switch parses these attributes, it dynamically untags the port to the specified VLAN ID.

RADIUS Attribute (IETF)	Integer Value	Definition / Configuration Requirement
Tunnel-Type	13	Specifies the tunnel protocol. Must be set to evaluate as a VLAN.
Tunnel-Medium-Type	6	Specifies the transport medium as 802 (Ethernet/Wi-Fi).
Tunnel-Private-Group-ID	"VLAN_ID"	A string integer representing the target network (e.g., "50").

If a user from the Engineering department authenticates, the RADIUS server passes Tunnel-Private-Group-ID = "20". When an HR employee plugs into the exact same physical port an hour later, the RADIUS server passes Tunnel-Private-Group-ID = "30", dynamically re-segmenting the port isolation.

---

4. Headless Devices and MAC Authentication Bypass (MAB)

A severe architectural constraint of 802.1X is that legacy network hardware—such as printers, HVAC controllers, or older VoIP phones—lack the operating system necessary to act as an EAP Supplicant. If connected to a strict 802.1X port, they will silently fail to authenticate and remain permanently blocked.

To accommodate headless endpoints, engineers must configure MAC Authentication Bypass (MAB) on the UniFi switch ports.

The MAB Fallback Sequence

1. The UniFi switch detects a link-up state and issues an EAP-Request/Identity frame.
2. The headless device (e.g., a printer) ignores the frame.
3. After the standard EAP timeout threshold expires (typically 3 attempts over 90 seconds), the switch falls back to MAB.
4. The switch reads the device's physical hardware MAC address and forwards it to the RADIUS server as both the User-Name and User-Password attributes, typically formatted as a lowercase hex string without delimiters:

$$00\text{:}1A\text{:}2B\text{:}3C\text{:}4D\text{:}5E \rightarrow \text{001a2b3c4d5e}$$

5. If the MAC address exists in the RADIUS server's trusted endpoint database, the server returns an Access-Accept payload with the appropriate VLAN attributes.

---

5. Implementation Mechanics within the UniFi Controller

Deploying this architecture within a UniFi environment requires decoupling static VLANs from your switch port profiles and routing authentication requests to the RADIUS instance.

Step 1: Define the RADIUS Profile

Within the UniFi Network OS, navigate to Settings $\rightarrow$ Profiles $\rightarrow$ RADIUS. You must explicitly enable the dynamic assignment flags to instruct the access layer switches to listen for the IETF VSAs:

• Enable RADIUS assigned VLAN for wired network: Checked
• Enable RADIUS assigned VLAN for wireless network: Checked
• RADIUS Auth Server: Provide the IP and Shared Secret for the external NPS/FreeRADIUS server.

Step 2: Configure the Port Profile

Navigate to Settings $\rightarrow$ Profiles $\rightarrow$ Switch Ports. Create a zero-trust port profile intended for all user-facing edge ports:

• Native Network: Block All (or a dedicated un-routable "Dead VLAN").
• 802.1X Control: Auto (Enables the Authenticator state machine on the port).
• MAC Authentication Bypass: Enable (For headless device fallback).

By applying this profile globally across the aggregation and access layer switches, the physical infrastructure becomes a mathematically secure, identity-driven boundary.

What breaks in production

802.1X fails closed by design, which means every misconfiguration is an outage rather than a warning.

The four failures worth pre-planning:

• No supplicant. Cameras, printers, HVAC controllers, and older lab equipment cannot do 802.1X. MAB is the usual answer, and MAB is a MAC address in a RADIUS request — trivially spoofable. Treat it as inventory control, not authentication.
• RADIUS outage. Without a local fallback, the switch port stays unauthorized. Decide now whether that means "no access" or "quarantine VLAN," and make sure the choice is written down.
• Dynamic VLAN on a trunk. Assignment works on access ports. On a trunk, the authorization result applies to the port, not to the voice and data VLANs separately.
• Reauthentication storms. A short Session-Timeout multiplied by a building of devices produces a predictable CPU spike on the RADIUS server every cycle. Stagger it.

Checklist

1. Certificate expiry is monitored and tested before it matters.
2. MAB inventory is reviewed monthly; unknown MACs land in quarantine, not on the staff VLAN.
3. The switch has a documented behavior when RADIUS is unreachable.
4. Reauthentication timers are staggered by building.