4.4 Authentication, 802.1X Port Control & AAA (RADIUS vs. TACACS+)
Covers 802.1X network access control roles (Supplicant, Authenticator, Authentication Server), EAP methods, and RADIUS vs. TACACS+ protocols.
🎯 Key CompTIA Network+ Exam Takeaways
- 802.1X defines three roles: Supplicant (client device), Authenticator (switch/AP), and Authentication Server (RADIUS).
- EAP-TLS requires mutual X.509 certificates on both client and server, providing the highest security without passwords.
- TACACS+ operates over TCP 49, encrypts the entire packet payload, and separates authentication, authorization, and accounting.
Network Access Control (NAC) using IEEE 802.1X prevents unauthorized physical or wireless devices from communicating on the network until authenticated. The client (Supplicant) authenticates through an intermediate access device (Authenticator) against a central Authentication Server.
Extensible Authentication Protocol (EAP) manages authentication exchanges. EAP-TLS enforces mutual authentication using digital certificates on both endpoints, eliminating password vulnerabilities.
For administrative device access, TACACS+ (TCP 49) encrypts the entire packet payload and decouples authorization, enabling per-command privilege controls on routers and switches.
⚠️ Common Pearson VUE Exam Traps
- Assuming RADIUS encrypts the entire packet; RADIUS encrypts only the password field and combines authentication and authorization.
- Confusing PEAP (server certificate only, password-based) with EAP-TLS (mutual certificates on both client and server).
Knowledge Checkpoint
An enterprise security engineer is selecting an Authentication, Authorization, and Accounting (AAA) protocol to manage administrative CLI access to corporate routers and firewalls. The security policy mandates that authorization must be decoupled from authentication (allowing granular per-command authorization) and that the entire packet payload must be encrypted across the wire. Which protocol meets these criteria?