I have set up a windows nps server (radius), it works with eap-tls. In the switch when the authentication is validated the port is passed in vlan 100 and when it is refused it is passed in vlan 101.

My network policy is that when a domain computer is connected to the switch, it has access to the internal network. So computers that aren't in the domain don't have access to the internal network.

I've tested my nps but when I connect a hub to my switch with a domain computer connected to the hub. The problem is that when I connect a computer that is not in the domain to the hub, it has access to the internal network.

1 Answer 1


That (trivial) MITM scenario is a well known weakness of 802.1X. It's also possible to use a simple switch in place of the hub.

That weakness needs to be addressed on the authenticating switch. You need to at least add MAC filtering, so that only the authenticated MAC client is allowed to communicate on that port. There are other technical options for coping with the general problem, many of them proprietary (so we'd need to know more about your switch and your network).

Other methods include prohibiting the connection of unauthorized devices to the organization's network.

Even after 'hardening' 802.1X there is no strong security. For that you'd need something like IPsec or MACsec.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.