NAC: who gets onto the port, with what proof and with what rights

TL;DR

NAC means a port (or an SSID) doesn't give access just because someone has connected. 802.1X closes the port and lets only EAPOL through: the client (the supplicant) proves who it is through an EAP method, the switch (the authenticator) relays the conversation in RADIUS to ISE, and ISE answers not just “yes” or “no”, but also with what the client gets — VLAN, downloadable ACL, voice domain, SGT. For devices without a supplicant there's MAB (the MAC address as the identity), for guests the web portal (CWA), and for failures three safety nets: the guest, auth-fail and critical VLANs. CoA lets ISE change the policy in the middle of the session, based on profiling or posture; TrustSec turns the result of authentication into a group tag that follows the user throughout the network. Most incidents come from a wrong RADIUS secret, from default timers that are too long, from single-host host mode with a phone and a PC, and from attributes the switch can't apply.

How to read the notes: red = critical for the exam, green = theory, blue = numbers, yellow = pitfalls, cyan = differences between standards, platforms and configuration styles. In the animations, the configuration lines used in the current step are highlighted automatically; the ← → arrows change the step when the animation is selected.