Lion Cipher Lab

Enforce 802.1X port access with EAP-TLS — and reject a rogue device

• Cyber / Security Engineer
• Advanced
• ~90 min
• Free · no account required

Why it matters

The oldest hole in any network is the live port. Someone plugs a laptop — or a cheap rogue device — into a conference-room jack, or joins the wired VoIP-phone network, and they are ON: same broadcast domain as your servers, free to scan, sniff, and pivot, having proven nothing about who they are. 802.1X (IEEE port-based network access control) closes that hole by making the PORT itself the gate: until the connecting device authenticates, the port passes nothing but the authentication handshake. This is Network Access Control (NAC), and it is the single highest-leverage control at the…

What you'll learn

• explaining the 802.1X triad — supplicant, authenticator, authentication server — and how EAPOL, EAP, and RADIUS carry the same conversation over different hops
• building a tiny local Certificate Authority with openssl and issuing a server cert and a client cert with the correct extendedKeyUsage (serverAuth / clientAuth)
• understanding EAP-TLS as MUTUAL certificate authentication — the client proves itself to the server AND the server proves itself to the client, with no shared password anywhere
• configuring the FreeRADIUS eap module for TLS (default_eap_type = tls) and registering the authenticator as a RADIUS client with a shared secret
• standing up hostapd in wired-802.1X authenticator mode (driver=wired) and wpa_supplicant as an EAP-TLS supplicant over a virtual Ethernet (veth) pair — no switch or special NIC
• reading the proof of enforcement: Access-Accept + CTRL-EVENT-EAP-SUCCESS for a valid client, and Access-Reject + CTRL-EVENT-EAP-FAILURE for a rogue with no/invalid cert
• the judgment call: EAP-TLS vs PEAP/EAP-TTLS (password methods), why MAC Auth Bypass (MAB) is an insecure fallback, dynamic VLAN assignment, and cert revocation/lifecycle
• knowing when 802.1X is the right control (NAC at the network edge) versus when it is the wrong tool for the job

Steps in this lab

1. The 802.1X triad, and EAPOL vs EAP vs RADIUS
2. Install the stack and wire a veth pair as the 'cable'
3. Build a tiny CA and issue a server cert + a client cert
4. Configure FreeRADIUS for EAP-TLS and register the authenticator
5. Configure the authenticator (hostapd, driver=wired)
6. Prove a VALID client authenticates and the port opens
7. Prove a ROGUE device is REJECTED and stays off the network
8. The judgment: EAP-TLS vs the alternatives, and when NAC fits

Open the full interactive lab →