802.1X Multiple Hosts mode is usually used when an access point acts as a supplicant and authenticates to the switch, then allows further hosts by bridging it to the wireless network.

My question is whether this will work with a second switch instead of the access point, where one of the hosts authenticates. Will the second switch forward the EAP-Request packets to its hosts?

  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Aug 10, 2017 at 15:39

1 Answer 1


EAPOL is done at layer 2, so it's frames not packets, and should be passed through except when the second switch has 802.1X enabled. If 802.1X is enabled on the second switch then it will either not allow clients to authenticate (if pae authenticator is not enabled on the port facing the host) or act as the authenticator (thus the switch you want to act as the authenticator won't see the frames).

The behavior could vary with cheap/low-end switches that don't handle 01:80:c2 frames as expected.

  • I read forum posts that report that Cisco 802.1X capable switches must be set to Authenticator mode and left further unconfigured to even forward EAPoL to a switch up the chain. Disabling 802.1X results in the frames being dropped. Do you know the behaviour for a plain L2 switch from Cisco / Linksys / HP that doesn't support 802.1X at all?
    – Monstieur
    Sep 27, 2014 at 5:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.