Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We are planning to implement 802.1X. What is not clear is whether a switch supporting 802.1X can successfully and correctly authenticate multiple devices connected to the same switch port (e.g. if we have a department using a hub with a bunch of computers to "share" the port)? If so, how does the protocol validate the source of packets?
Or does implementing 802.1X will require us to purchase huge expensive 802.1X supporting switches, for one port per device?

share|improve this question
up vote 2 down vote accepted

You will still be able to do port-based 802.1x authentication but only for the entire hub. As far as the 802.1x authenticator is concerned it is just able to allow or disallow (or assign to different VLANs) that one port that the hub is attached to. Imagine what will happen with a client authenticates this port to a trusted VLAN but then another client authenticates this port to an untrusted VLAN. From the perspective of the authenticator you will not be able to "validate the source of packets" only the port that your hub is attached too (and hence everything that is attached to it).

If you require port-based authentication on a switch or need to authenticate a device that doesn't support 802.1x you can rely on MAC Authentication Bypass, which is essentially just whitelisting MAC addresses or port as required.

To really take advantage of 802.1x you need a switching infrastructure that fully supports 802.1x (luckily it's pretty common on mid-range enterprise grade switches).

share|improve this answer
what about multiauth mode?… – Alex Nov 25 '11 at 7:47
We're not a Cisco shop so take this with a grain of salt but Multiauth mode looks specifically designed for Cisco's VOIP devices and requires Cisco's proprietary CDP. Take a look at Multiple-Host Mode. – kce Nov 26 '11 at 0:37

Mutli-auth does exactly this. Multi-host is an older mode that allows several devices to share the port but once one is authenticated, they all are authenticated. Multi-auth is a newer mode that forces each unique mac address on a port to authenticate individually. However, some features are disabled when you use it such as different radius assigned vlans, guest vlan and auth fail vlan since you cannot assign a vlan per mac address.

Update - Be advised that there is currently a bug in IOS 12.2(54)SG1 with multi-auth and multi-domain where authorized ports do not pass traffic.


share|improve this answer
I guess from security point of view it's quite weak? As mac address can be easily sniffed and then spoofed. – Alex Dec 7 '11 at 8:54
You aren't necessarily authenticating with MAC. You can still use certificates or other means to authenticate the devices but the only way the switch can keep track of unique devices on a single port is by mac so, yes if a PC with a valid cert authenticated and then you connected and spoofed the same MAC, I believe you would be granted access on the network, however you can setup periodic re-authentication as well and if this was setup, it is possible that the attacker's PC would respond to the re-auth and cause the port to go unauthorized. Although they could turn off dot1x to avoid this... – Paul Ackerman Dec 7 '11 at 12:43

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.