Overview
ISO/IEC/IEEE 8802-1X:2021 (IEEE Std 802.1X–2020) defines port‑based network access control for local and metropolitan area networks (LANs/MANs). The standard specifies a common architecture, functional elements, and protocols that enable mutual authentication, authorization, and the controlled enabling of network access at IEEE 802 service access points (ports). It is media‑access‑method independent and supports the discovery and establishment of security associations used by IEEE 802.1AE (MACsec).
Key Topics
- Port‑based network access control: Mechanisms to restrict use of switch or access point ports until devices are authenticated and authorized.
- Authentication and authorization: Support for mutual authentication between clients and network ports using Extensible Authentication Protocol (EAP) methods.
- EAP over LAN (EAPOL): Protocols used to carry EAP exchanges between supplicants (clients) and authenticators (switches/APs).
- Controlled vs. uncontrolled port: Operational states that determine whether traffic is permitted prior to successful authentication.
- Key agreement and MACsec integration: Procedures to discover and establish security associations and keys for MACsec (IEEE 802.1AE), including MACsec Key Agreement (MKA).
- Security architecture and functional elements: Defined roles, interfaces, and message flows to support interoperable implementations across vendors.
- Media‑independence: Applicability to wired and wireless LANs and to metropolitan area network deployments.
Applications
- Enforcing network access policies in enterprise LANs, campus networks, and public Wi‑Fi hotspots.
- Protecting sensitive traffic in data centers and branch offices by combining 802.1X authentication with MACsec encryption.
- Enabling secure Bring Your Own Device (BYOD) and IoT onboarding by authenticating endpoints before granting access.
- Supporting service providers and managed‑security environments that require port‑level access control and strong device authentication.
Who uses this standard
- Network architects and security engineers designing LAN access control and segmentation.
- Equipment vendors implementing supplicant, authenticator, or authentication server functionality.
- System integrators and managed service providers deploying secure access solutions.
- Compliance and risk teams referencing standardized access control for audits and governance.
Related standards
- IEEE 802.1AE (MACsec) - MAC Security for data confidentiality and integrity.
- IEEE 802.1Xbx / 802.1Xck - incorporated revisions and amendments referenced in the 2020/2021 edition.
- ISO/IEC/IEEE 8802 series - other parts covering LAN/MAN requirements.
Keywords: port-based network access control, IEEE 802.1X, EAP, EAPOL, MACsec, MKA, LAN security, authentication, authorization, key agreement, controlled port.