TOI Author :: Manish Singhvi

802.1X supplicant feature supports different Extensible Authentication Protocol( EAP ) methods for 802.1X authentication. This document specifically talks about support for supplicants doing EAP Password ( EAP-PWD ) based authentication. Defined in RFC5931, EAP-PWD is an EAP method that uses a shared password for authentication. Furthermore, this feature allows EOS devices to interoperate with systems that rely on EAP-PWD for deriving MACsec CAK/CKN from the EAP Master Session Key (MSK) and EAP Session ID as per 802.1X-2020.

802.1X dynamic interface configuration allows for dynamic interface configuration on the 802.1X authenticator based on device profiling performed by a Network Access Controller (NAC). Traditionally, 802.1X authenticators require static interface configuration. This enhancement extends dynamic capabilities beyond existing features like dynamic VLAN assignment and ACL programming, enabling any type of interface configuration to be applied dynamically via the CLI.

MAC security uses MACsec Key Agreement ( MKA ) protocol for negotiation between peers using pre-shared key or 802.1X based CAK/CKN and eventually derives Secure Association Key ( SAK ).

Media Access Control Security (MACsec) is an industry standard encryption mechanism that protects all traffic

Support for Media Access Control Security (MACsec) was added in EOS 4.15.4. It introduced the concept of configuring