Setup Wired 802.1X

9 min

Overview

Use Wired 802.1X for laptops and other managed devices that support it. The device proves its identity to a RADIUS server before it gets access, which makes it stronger than MAC-based approval.

The Nile Access Service acts as the 802.1X authenticator. Nile switches pass the device’s EAP messages to the RADIUS server, and the server decides whether the device is allowed and which segment it joins. A RADIUS server is required. You can use either of the following:

Nile RADIUS: A cloud-hosted RADIUS service from Nile, with no servers to deploy or maintain. It supports EAP-TLS and EAP-PEAP. See Setup Guide for Nile Cloud RADIUS.

Your own RADIUS server: For example, Cisco ISE, Aruba ClearPass, or Microsoft NPS. EAP is processed on your server, so you can use any EAP method that your server supports, such as EAP-TLS or PEAP.

How Wired 802.1X works

A device connects to a Nile switch port. Every port is blocked until the device is approved.

The device starts 802.1X. At the same time, Nile checks the device against your MAC Authentication rules.

Nile sends the 802.1X request to the RADIUS server selected for wired 802.1X at that location.

The RADIUS server checks the credentials and returns either an Access-Accept with the segment name, or an Access-Reject.

Nile places the device in the returned segment, and the device gets an IP address from that segment’s subnet.

Prerequisites

Complete the following before you turn on 802.1X. Most steps have a dedicated page with detailed instructions.

Configure a Service Area. Define the sites, buildings, and floors where you need Nile connectivity. See Setup Service Areas.

Configure DHCP. Choose Nile DHCP or an external DHCP server, and define the subnets your devices will use. Each segment needs a subnet at every site where its devices connect. See Setup DHCP.

Configure Segments. Create a segment for each group that the RADIUS server will return, such as Employees or Contractors. Note the exact segment names, because the RADIUS server must return them exactly. See Setup Segments.

Configure Authentication. Add your RADIUS server under Network Setup > Authentication, or set up Nile RADIUS. See Setup Authentication and Setup Guide for Nile Cloud RADIUS.

Prepare your RADIUS server (if you use your own). Have the IP addresses of up to three servers, the RADIUS port (usually 1812), and the shared secret. Make sure there is a route between the RADIUS server and the core router or firewall that connects to the Nile Service Gateway, and that RADIUS traffic is allowed in both directions.

Prepare your devices. Turn on the 802.1X supplicant on each device. For EAP-TLS, issue a client certificate to each device and install the CA chain that signed the RADIUS server certificate. Use an MDM or Group Policy for more than a few devices.

Configuration Steps

Step 1: Set up the RADIUS server in the Nile Portal

Use Option A for your own RADIUS server, or Option B for Nile RADIUS.

Option A: Your own RADIUS server

In the left navigation, select Network Setup > Authentication, and click the + sign.

Configure the following:

Name: Enter a name for the RADIUS server.

Port: Enter the RADIUS port. This is usually 1812.

Shared Secret: Enter the secret. Use the same secret on the RADIUS server.

Host 1, Host 2, Host 3: Enter the primary, secondary, and tertiary servers.

Geo Scope: Select the locations that will use this RADIUS server.

Wired Dot1x: Select this checkbox to use this server for wired 802.1X at the locations in its Geo Scope. You can select it on only one RADIUS server for a location.

Wired MAC Auth (optional): Not needed for 802.1X. Select it only to use External RADIUS MAC Authentication for devices that do not support 802.1X. See Setup MAC Authentication.

Guest Portal URL (optional): Not used for 802.1X. Leave it blank unless this server also runs a guest portal.

Click Display NAS IPs and note the addresses. These are the Nile addresses that send requests to your RADIUS server. You add them to the server in Step 3.

Optional: Click Verify Hosts and enter a test username and password to check that Nile can reach the server. You can save these credentials so Nile uses them for ongoing monitoring.

Click Save.

Note: If the Wired Dot1x or Wired MAC Auth checkbox is not visible, contact Nile Support to enable it for your organization.

Option B: Nile RADIUS

Ask your Nile CSM or SE to enable Nile RADIUS for your organization.

In the left navigation, select Network Setup > Authentication > Nile RADIUS.

Under Auth Type, choose the method:

EAP-TLS: Upload the RADIUS server certificate as a password-protected PKCS#12 (.p12 or .pfx) file. If your client certificates come from a different CA, upload that CA chain under Trust Certificates.

EAP-PEAP: Select the Active Directory servers that Nile RADIUS uses to check usernames and passwords. Nile RADIUS does not store passwords.

Click Save.

Under Policies, create a policy for each result you need. Each policy has a match condition and an action: ACCEPT with a segment, or REJECT. Policies are checked from the top down, so place the most specific policy first.

Wired 802.1X: Nile RADIUS handles wired 802.1X at a location unless an external RADIUS server for that location has Wired Dot1x selected.

For certificates, policies, Intune, and SCIM, see Setup Guide for Nile Cloud RADIUS.

Step 2: Turn on 802.1X for a segment

In the left navigation, select Network Setup > Segments.

Click the pencil icon on the segment you want to use.

Open the Service Area tab. For each site, select your RADIUS server or Nile RADIUS from the Authentication dropdown.

Click Save.

802.1X is turned on for that segment right away. Repeat these steps for every segment that the RADIUS server can return.

Step 3: Configure your RADIUS server

Skip this step if you use Nile RADIUS. Every external RADIUS server needs the following:

Nile as a RADIUS client: Add each Nile NAS IP from Step 1 as a RADIUS client or network device, with the same shared secret.

Nile dictionary: Import the Nile vendor dictionary (vendor ID 58313) so the server can send the netseg attribute. The dictionary file is in each integration guide below.

Segment name in every reply: For wired devices, your RADIUS server must return the exact segment name in its Access-Accept. The name is case-sensitive and must match the segment name in the Nile Portal. A segment name is always required for wired 802.1X, even if you use only one segment.

Nile attribute: Send the netseg attribute, for example, netseg=Employees.

Standard attribute: If your RADIUS server cannot use a custom dictionary, send the segment name in the Tunnel-Private-Group-ID attribute.

If the segment name is missing or does not match, the device is denied.

Wired request identifier: Nile includes WiredDot1x in the Called-Station-Id attribute of wired 802.1X requests. Use it to match wired requests in your policies.

Monitoring: Nile checks each RADIUS server every minute. Allow MS-CHAPv2 for the monitoring check. See your server’s integration guide below.

If you are using Cisco ISE, see Cisco Identity Service Engine (ISE) - RADIUS and the Cisco ISE Administrator Guide - Segmentation.

If you are using Aruba ClearPass, see Aruba Clearpass - RADIUS, Integrating Aruba Clearpass for Dynamic Segment Assignment, and the HPE ClearPass Policy Manager User Guide.

If you are using Microsoft NPS, see Microsoft NPS and Configure Network Policies (Microsoft).

Step 4: Configure the devices

On Windows, using the built-in supplicant:

Open Services (services.msc), start the Wired AutoConfig service, and set its startup type to Automatic.

Open Network Connections, right-click the Ethernet adapter, and select Properties.

On the Authentication tab, select Enable IEEE 802.1X authentication. If the tab is missing, the Wired AutoConfig service is not running.

Choose the authentication method:

EAP-TLS: Select Microsoft: Smart Card or other certificate, and choose the client certificate.

PEAP: Select Microsoft: Protected EAP (PEAP), and select Secured password (EAP-MSCHAP v2) as the inner method.

In Settings, select Verify the server’s identity by validating the certificate, and select the CA that signed the RADIUS server certificate.

In Additional Settings, select the authentication mode that matches your policy: User authentication, Computer authentication, or User or computer authentication.

On macOS and other devices, push an 802.1X profile with the certificate or credentials through your MDM, such as Microsoft Intune, Jamf, or Workspace ONE.

Step 5: Verify the connection

Connect the device to a Nile switch port.

In the Nile Portal, open Devices and search for the device’s MAC address or username. Check that it is authenticated by 802.1X, is in the expected segment, and has an IP address from that segment’s subnet. Open the device to see its events.

Select Network Setup > Access Management > Wired. The device appears with Authenticated By set to 802.1X Approved.

Check your RADIUS server log for the matching request and the returned segment name.

Wired 802.1X behavior

Authentication priority: Nile runs 802.1X and MAC Authentication on the same port at the same time. When both return a result:

A switch hostname + port rule or an exact MAC address rule wins over the 802.1X result. An exact MAC address rule set to Deny blocks the device even if 802.1X succeeds.

A fingerprint, OUI, or Allow all MACs rule does not override 802.1X. The 802.1X result is used, so if 802.1X fails, the device is denied.

If 802.1X does not start or times out, Nile uses MAC Authentication only. A device that matches no rule shows Waiting for approval.

Moving devices to 802.1X: Desk phones and other devices that try 802.1X by default can still connect with an exact MAC address rule. When you move a device with an exact MAC address rule to 802.1X, delete that rule so the 802.1X result is used.

One 802.1X device per port: Only one 802.1X device can be authenticated on a switch port. If a computer connects through an IP phone, use 802.1X on only one of them, and MAC Authentication on the other.

No VLAN tags: Turn off 802.1Q VLAN tagging on wired devices, such as a voice VLAN on desk phones. Nile does not support tagged traffic from wired devices.

One server for wired 802.1X per location: If more than one external RADIUS server serves a location, select Wired Dot1x on the one that should handle wired 802.1X. If you do not, requests can go to a server you did not intend.

Nile RADIUS with an existing NAC: If Nile RADIUS is turned on, it handles wired 802.1X by default. To keep wired 802.1X on your existing system (for example, ISE or ClearPass) while you move wireless first, select Wired Dot1x on that server. Clear the checkbox when you are ready to move wired devices to Nile RADIUS.

Server failover: Nile tries Host 1 first, then Host 2, then Host 3. When Host 1 returns, Nile uses it again.

Monitoring: Nile checks each RADIUS server every minute and reports latency and up or down status.

Wired table entries: Devices that authenticate with 802.1X appear in the Wired table with Authenticated By set to 802.1X Approved or 802.1X Denied. You can edit only the description. Approved entries are deleted automatically after 90 days offline. Denied entries are kept.

Internet outage with Nile RADIUS: Devices that are already connected stay connected. New sign-ins and re-authentications fail until the connection to the Nile cloud returns.

Troubleshooting

Device shows Waiting for approval: 802.1X did not start or timed out, and the switch fell back to MAC Authentication. Check that the supplicant is on and configured. On Windows, check that the Wired AutoConfig service is running. Then reconnect the device.

Device is denied, but the credentials are correct: The RADIUS reply did not include a segment name, or the name does not exactly match a Nile segment. Also check that the segment has 802.1X turned on and a subnet at the sitewhere the device connects.

Device is denied even though an Allow all MACs, OUI, or fingerprint rule matches: These rules do not override a failed 802.1X attempt. Fix the 802.1X configuration on the device or server, or add an exact MAC address rule for the device.

No request appears on the RADIUS server: Check that Wired Dot1x is selected on the correct server, the Nile NAS IPs are added as clients, the shared secret matches, and RADIUS traffic is allowed between the server and the Nile Service Gateway.

RADIUS server shows as down in the Nile Portal: Check that the server allows MS-CHAPv2 and that the credentials saved in Verify Hosts are valid.

Nile RADIUS rejects EAP-TLS devices: Check the certificates and the EAP method on the device. For example, NAK [25] in the log means the device offered PEAP instead of EAP-TLS. See the troubleshooting section of Setup Guide for Nile Cloud RADIUS.

Laptops can’t connect on imaging ports: On ports with a switch hostname + port rule, a failed 802.1X attempt from a partly provisioned laptop can stop it from using the port. Turn off 802.1X on the device until imaging is complete.

802.1X sign-in prompts on MAC Authentication ports: Devices with 802.1X turned on can show sign-in prompts on ports where you use only MAC Authentication. Contact Nile Support for options.

Device keeps its old segment after a policy change: The device keeps its current IP address until it re-authenticates and renews DHCP. Reconnect the cable to apply the new segment right away.