Campus Switching and Routing

Contributor II
Posts: 66
Registered: ‎01-25-2013

802.1x for wired and wireless



i'm checking for some real life experience here in setting up 802.1x in a wired and wireless production environment.  The goal anyway here is to segment the network by splitting it up in seperate vlans.  One of the nice things is that you can 'steer' a device into a certain vlan.


The problem in our environment is that we have a history of wired networking.  In practice this means that due to lack of utp connections in offices we have a lot of soho switches in offices to bypass this issue.  These switches are not managed and thus not capable of 802.1x.   There are basically no soho switches which are capable of doing 802.1x.  So one thing we've learned is that 802.1x is a 'datacenter' setup.  If you want this for wired networking you need switches in the rack which support this, and endpoints need to be connected to these switches.  In our environment this would mean additional wired networking.  There's also the issue with printers etc... where 802.1x is not really an option (keep those in one single printer vlan i suppose).


Ofcourse then you think about wireless networking.  Haven't tested yet but i'm pretty sure 802.1x will work in our environment.  This would involve extra investments in wireless (no open landscape offices in a lot of buildings so extra ap's needed).


But there is also an alternative, just introduce seperate vlans in seperate buildings (wired and wireless).  On the wireless level use vlan steering, wlan roaming and vlan mobility.


Anyone having experience?  What did you choose?  Full 802.1x?


Contributor I
Posts: 32
Registered: ‎02-09-2017

Re: 802.1x for wired and wireless

For security reason I choose full dot1x if all the access switches are ready. If not better to do planning to rollout switch that not supported dot1x

Posts: 1,412
Registered: ‎11-30-2011

Re: 802.1x for wired and wireless

it would not call dot1x a datacenter technology. for me the datacenter is where your servers and such are but not clients, dot1x is mainly a client technology.


like you say it does mean your switches have to support it. with most enterprise switches this is the case. if you are using soho switches in an enterprise setting then not doing dot1x is probably not your only issue, think loops, oversubscription, ...


it comes down on your requirements and budget. if you can go with enterprise switches and enterprise APs. if you can't then determine what is most important for your company.

Search Airheads
Showing results for 
Search instead for 
Did you mean: