> For the complete documentation index, see [llms.txt](https://chunhthanhde.gitbook.io/google-learning-programs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://chunhthanhde.gitbook.io/google-learning-programs/google-it-support-professional-certificate/course-5-it-security-defense-against-the-digital-dark-arts/module-4-securing-your-networks/1.secure-network-architecture/3.supplemental-reading-on-ieee-8021x.md).

# IEEE 802.1X: Port-Based Network Access Control 🌐🔒

## Overview

IEEE 802.1X is a standard developed by the **Institute of Electrical and Electronics Engineers (IEEE)** that specifies a framework for **port-based network access control**. It governs how devices authenticate themselves before gaining access to Local Area Networks (LANs) or wireless networks, ensuring the integrity and security of the network.

## Key Components of IEEE 802.1X Authentication

The **authentication process** under IEEE 802.1X involves three key elements:

1. **Supplicant**: The client device (e.g., a laptop or smartphone) that requests access to the LAN or wireless network.
2. **Authenticator**: The device that acts as a gatekeeper (e.g., a switch or wireless access point). It forwards the client's authentication request to the authentication server and blocks all non-authenticated traffic.
3. **Authentication Server**: The system (typically a **RADIUS server**) that verifies the credentials or identity of the supplicant. It decides whether the client is granted or denied access.

## Authentication Workflow 🔄

1. **Initial Connection**: The supplicant sends an authentication request to the authenticator.
2. **Forwarding**: The authenticator relays this request to the authentication server.
3. **Verification**: The authentication server checks the credentials against its database.
   * **Valid Credentials**: If the credentials are valid, the authentication server grants access and the connection process begins.
   * **Invalid Credentials**: If the credentials are invalid, the server sends an **Access Reject** message, terminating the connection request.

## Authentication Methods 🛡️

1. **Shared Key System**: A pre-configured key or passphrase is manually set on both the supplicant (client) and the network device (e.g., access point).
2. **Open System**: The server checks the supplicant’s credentials against a list of authorized devices. Typically, this is based on the **MAC address**, but it can vary by network configuration.

## Common Shared Key Authentication Methods 🔑

1. **Wired Equivalent Privacy (WEP)**: A legacy authentication method that is no longer recommended due to vulnerabilities. Attackers can easily capture and crack the encryption.
2. **Wi-Fi Protected Access (WPA)**: Enhances network security by enforcing **IEEE 802.1X authentication** and key exchange with dynamic encryption keys. WPA is more secure than WEP.
3. **Wi-Fi Protected Access 2 (WPA2)**: An improvement upon WPA, offering stronger security. Both the supplicant and network device must use the same **WPA version** and **pre-shared key (PSK)**.

## Association Process 🤝

Once authentication is complete, the **access point** or **router** records each mobile device, ensuring that data is routed correctly. This step is crucial for data delivery after successful authentication.

***

## **Key Takeaways** 📌

* **IEEE 802.1X** standardizes port-based network access control, using modern authentication methods.
* The authentication process involves three components: the **supplicant**, **authenticator**, and **authentication server**.
* Networks can use either a **shared key system** or an **open system** to control access.
* Upon successful authentication, the **connection** is established; otherwise, the request is rejected.

These methods ensure network security by controlling which devices are allowed to access the network.