# Wired 802.1X: Priya proves who she is before the VLAN Source: https://ai.techclick.in/blog_cisco_ise_8021x_wired_peap Markdown: https://ai.techclick.in/blog_cisco_ise_8021x_wired_peap.md Publisher: Techclick Infosec Pvt Ltd Wired 802.1X: supplicant, switch port, PEAP-MSCHAPv2, server cert. Dummy Priya on Gi1/0/12. ## The ticket Priya has no network. Switch shows Auth Failed . She turned off 802.1X “to work.” That is how printers get user VLANs. We will fix PEAP instead. Quick interview answer 802.1X: supplicant (laptop) ↔ authenticator (switch) ↔ authentication server (ISE PSN). EAP rides EAPoL on the wire and RADIUS to ISE. PEAP-MSCHAPv2 builds a TLS tunnel with ISE’s cert, then sends the password hash inside. If the laptop does not validate the server cert, a rogue RADIUS can steal the hash (lab PDF). Prefer validate + trusted CA. EAP-TLS is stronger (certificates both ways). Hero · three parties No supplicant = no 802.1X. That is a MAB or CWA conversation, not this lesson. Lab data · dummy only PAN ise-pan 10.10.10.20 · PSN ise-psn1 10.10.10.21 · MnT ise-mnt 10.10.10.22 · NAD sw-access-01 10.10.10.2 · AD dc01 10.20.30.10 · Priya 10.20.30.80 TECHCLICK\priya.hr · printer 10.20.30.60 . Not a live customer. ## Supplicant → switch → PSN PDF workflow: switch blocks the port, EAPoL identity, ISE evaluates, Access-Accept carries VLAN / dACL / SGT / redirect. Port · dummy monitor then enforce interface GigabitEthernet1/0/12 description PRIYA-HR switchport mode access authentication host-mode single-host authentication port-control auto authentication order dot1x mab authentication priority dot1x mab mab dot1x pae authenticator spanning-tree portfast ! Start with authentication open (monitor) in production rollouts. ! Enforce = remove 'authentication open' after Live Logs look clean. ## PEAP vs EAP-TLS PEAP-MSCHAPv2 EAP-TLS User proves AD password User/machine cert Must trust ISE EAP cert Both CAs Use Fast lab / many shops Higher assurance Classic fail Unknown CA / no validate Expired client cert https://ise-pan.techclick-lab.in/admin Training mock · not live ISE Admin Context Visibility Operations Policy Administration Policy → Policy Sets → Wired_Lab → Authentication ### Dot1X rule Condition Wired_802.1X Allowed protocols PEAP, EAP-TLS Identity source TECHCLICK (AD) If fail Reject Cancel Save ISE default Dot1X smart condition. Training mock. ## Three sides - #### Side A — laptop Wired auto 802.1X. PEAP. Validate server cert. User = TECHCLICK\priya.hr. - #### Side B — switch Port as above. show authentication sessions interface Gi1/0/12 details . - #### Side C — ISE Live Logs: Authc success, Authz HR. Result includes the dACL/VLAN you designed. Switch proof · dummy show authentication sessions interface Gi1/0/12 details # MAC aa:aa:aa:10:20:80 # Status Auth OK # Method dot1x # Domain DATA # VLAN 30 # ACS ACL xACSACLx-IP-dACL_HR-… ## Four 802.1X failures ### 1 · Unknown CA Deploy Lab_ISE_CA. Do not tell users to uncheck validate. ### 2 · No supplicant (printer) 802.1X times out → MAB (next lesson). Do not force PEAP on a printer. ### 3 · Wrong identity source Internal Users instead of AD. Priya never exists there. ### 4 · Monitor vs enforce mix-up authentication open still gives access while you think you enforced. ## How to prove it Close the ticket only when 1) Session method = dot1x. 2) Live Logs identity = priya.hr. 3) VLAN/dACL match HR. 4) Validate-server-cert is ON. ## Traps Wrong move Why Uncheck “validate server certificate” PDF: hash can be stolen Disable 802.1X on the port Anyone on that cable is “Priya” Skip MAB fallback forever Phones/printers die — unless you have another plan ## Knowledge check Judgment items. One best answer. Reasons send you back to the matching section. Q1 Three 802.1X roles? Supplicant, authenticator, authentication server PAN, BGP, OSPF Hide NAT, Static, PAT Only ISE and AD Correct: a . Concept. Q2 PEAP-MSCHAPv2 without validating the ISE cert is dangerous because… A rogue RADIUS can MITM and capture the hash UDP 1812 stops MnT deletes logs CoA is required Correct: a . Lab PDF. Q3 show authentication sessions method should be… dot1x for Priya mab for Priya if PEAP worked none webauth always Correct: a . Proof CLI. Q4 Printer has no supplicant. 802.1X will… Time out toward MAB if you configured the order Invent a password Use pxGrid as EAP Always succeed Correct: a . Failure 2 / next lesson. Q5 authentication open means… Monitor mode — traffic may pass before success Stronger than enforce Disables RADIUS Forces EAP-TLS Correct: a . Failure 4. Q6 Identity source for Priya’s PEAP? Active Directory join point Internal Endpoints only Guest portal MnT Correct: a . Runbook. Check answers Reset Cisco ISE class series: Personas · First day · NAD + RADIUS · Policy sets · Wired 802.1X · MAB · CWA / guest · Profiling · dACL vs VLAN · Live logs · vs Forescout · Interview ## Sources - ISE 3.3 Admin — 802.1X authentication rules, allowed protocols. - Lab PDF — PEAP tunnel, validate server cert, Access-Accept AVPs. - Cisco Secure Wired Access — switchport 802.1X. Related: ISE evidence desk · session factory · Forescout series . --- Cite this Techclick lesson with the source URL. Do not invent fees, batch dates, or job guarantees. Browse all lessons: https://ai.techclick.in/blogs AI index: https://ai.techclick.in/llms.txt