Verify if the switch configuration has 802.1x authentication implemented for all access switch ports connecting to LAN outlets (i.e., RJ-45 wall plates) or devices not located in the telecom room, wiring closets, or equipment rooms. MAC Authentication Bypass (MAB) must be configured on those switch ports connected to devices that do not support an 802.1x supplicant.
Step 1: Verify that 802.1x is configured on all host-facing interfaces as shown in the example below:
interface Ethernet1/1
dot1x pae authenticator
dot1x port-control auto
dot1x host-mode single-host
switchport access vlan 10
interface Ethernet1/2
dot1x pae authenticator
dot1x port-control auto
dot1x host-mode single-host
switchport access vlan 10
interface Ethernet1/3
dot1x pae authenticator
dot1x port-control auto
dot1x host-mode single-host
switchport access vlan 10
Note: Host-mode must be set to single-host, multi-domain (for VoIP phone + PC), or multi-auth (multiple PCs connected to a hub). Host-mode multi-host is not compliant with this requirement.
Step 2: Verify that 802.1x authentication is configured on the switch as shown in the example below:
aaa group server radius RADIUS_GROUP
server 1.1.1.1
server 1.2.1.1
…
…
…
aaa authentication dot1x default group RADIUS_GROUP
Step 3: Verify that the radius servers have been defined.
radius-server host 10.1.1.1 key 7 "xxxxxxxxxxx" authentication accounting timeout 5 retransmit 1
radius-server host 10.2.1.1 key 7 " xxxxxxxxxxx" authentication accounting timeout 5 retransmit 1
If 802.1x authentication or MAB is not configured on all access switch ports connecting to LAN outlets or devices not located in the telecom room, wiring closets, or equipment rooms, this is a finding.