802.1x on a cisco switch with ise end to end

why your switch ports are probably wide open right now

plug a laptop into an unused ethernet jack in a conference room. does it get an ip and internet access? for a lot of networks, yes. that's the problem. any port that isn't doing 802.1x is basically saying "come on in" to anyone with a cable and five minutes alone in a building. this post walks through setting up 802.1x with cisco ise so your switch actually checks who's connecting before it lets them on the network, with mab as a fallback for the printers and badge readers that can't do real authentication.

step one: tell the switch where the radius server lives

ise acts as your radius server, but the switch has to know about it first. you're defining the server and grouping it so every auth request has somewhere to go.

radius server ISE1
 address ipv4 10.10.10.5 auth-port 1812 acct-port 1813
 key YourSharedSecretHere

aaa group server radius ISE-GROUP
 server name ISE1

the key here is literally the key. it's a shared secret between the switch and ise, and if it's weak or reused across your whole fleet, you've handed an attacker a way to spoof or intercept radius traffic. rotate it, keep it out of your configs backups sitting in plaintext on a file share, you know the drill.

step two: turn on aaa and point it at ise

this is the part that actually activates centralized authentication, authorization, and accounting instead of relying on local usernames or nothing at all.

aaa new-model
aaa authentication dot1x default group ISE-GROUP
aaa authorization network default group ISE-GROUP
aaa accounting dot1x default start-stop group ISE-GROUP

authentication answers "who are you," authorization answers "what are you allowed to do," and accounting is your audit trail. if you skip accounting to save a few lines of config, you're also skipping the logs you'll want when you're trying to figure out who was on port gi1/0/12 last tuesday at 2am.

step three: let ise push changes without waiting for a reconnect

this next command lets ise send a change of authorization, or coa, straight to the switch. that means if ise decides a device is suddenly untrusted, it can kick that session off immediately instead of waiting for the next reauth timer.

aaa server radius dynamic-author
 client 10.10.10.5 server-key YourSharedSecretHere

this is the piece that turns your nac setup from "checks once and forgets" into "checks continuously." if you're relying on posture assessment or want to quarantine a compromised endpoint fast, this is non-negotiable.

step four: flip the global switch and configure each port

now the command from the title. this one line is what actually makes the switch enforce identity globally instead of just having the plumbing configured.

dot1x system-auth-control

without this, everything above is just sitting there unused. with it, dot1x is live across the switch. then on each access port you configure the actual enforcement:

interface GigabitEthernet1/0/12
 switchport mode access
 authentication port-control auto
 authentication host-mode multi-auth
 mab
 dot1x pae authenticator
 spanning-tree portfast

port-control auto means the port waits for a successful auth before opening up. multi-auth lets multiple devices authenticate independently on the same port, which matters for ip phones with a laptop daisy-chained behind them. mab is your fallback for devices that can't speak 802.1x at all, like most printers and older badge readers, they get authenticated by mac address instead. portfast just keeps spanning tree from delaying the port coming up, which matters for user experience but has nothing to do with security here, so don't confuse the two.

the takeaway

if you're defending your own network, go check your access ports right now. run show dot1x all or show authentication sessions on your switches and see what's actually enforcing identity versus what's just open. an unauthenticated port isn't a minor gap, it's a free pass for anyone who gets physical access to a jack, and physical access is easier to get than most people think, a bad badge reader, an unlocked closet, a "friendly" vendor. mab fallback is there for legitimate weird devices, not as an excuse to leave ports unauthenticated because configuring dot1x felt like a hassle. do the config once, watch your ise logs for a week, fix what breaks, and you've closed one of the most overlooked holes in most networks.