Skip to main content
Português
Preços

Configurar Políticas RADIUS para Controlo de Acesso à Rede Granular

Este guia abrangente fornece a gestores de TI, arquitetos de rede e diretores de operações de espaços um plano técnico completo para configurar políticas RADIUS e alcançar um controlo de acesso à rede granular. Abrange a arquitetura 802.1X, atribuição dinâmica de VLAN, seleção de métodos EAP e estratégias de implementação faseada. Cenários de implementação reais da hotelaria e retalho demonstram como estas técnicas proporcionam conformidade, segurança e ROI operacional mensuráveis.

📖 6 min read📝 1,468 words🔧 2 worked examples❓ 3 practice questions📚 9 key definitions

Listen to this guide

View podcast transcript
Welcome to the Purple Technical Briefing. I'm your host, and today we're diving deep into a critical topic for enterprise network architects and IT directors: Configuring RADIUS Policies for Fine-Grained Network Access Control. If you're managing the infrastructure for a hotel chain, a retail network, or a large public venue, you know that the days of relying on a simple pre-shared key are long gone. Security, compliance, and user experience demand a more sophisticated approach. Today, we'll break down the architecture of context-aware access, explore implementation strategies, and discuss how to avoid the most common and costly pitfalls. Let's start with the context. Why are we talking about RADIUS and 802.1X? Because the perimeter has dissolved. You have corporate laptops, guest smartphones, contractor tablets, and a massive influx of IoT devices all hitting the same physical access points. You need a mechanism to dynamically segment this traffic, enforce compliance, and still deliver a seamless user experience. That's exactly where RADIUS policies come in. By leveraging 802.1X, you move from a model of 'who knows the password' to 'who are you, what device are you on, and what is your context?' That shift is fundamental. The architecture relies on three components. First, the supplicant — the software client on the end-user device. Second, the authenticator — usually your wireless access point or your switch. And third, the authentication server — your RADIUS server. When a device connects, the authenticator passes the EAP messages to the RADIUS server. The RADIUS server checks the credentials against your identity store, such as Active Directory, LDAP, or a cloud-based provider like Entra ID. But here is the crucial part: a properly configured RADIUS server doesn't just return a simple yes or no. It returns Vendor-Specific Attributes — VSAs — that tell the network infrastructure exactly how to handle that specific session. The most powerful application of this is dynamic VLAN assignment. Imagine a high-density environment like a stadium or a large conference centre. Broadcasting multiple SSIDs for different user groups creates massive beacon overhead and degrades RF performance. Every SSID you broadcast consumes valuable airtime. With RADIUS, you broadcast one secure SSID. When a finance manager authenticates, RADIUS tells the access point to drop their traffic onto VLAN 10. When a POS terminal connects, it gets placed onto VLAN 20. When a contractor authenticates, they land on VLAN 30 with restricted access. It's clean, it's efficient, and it drastically reduces your attack surface. Now, let's move into the technical deep-dive. The key attributes you'll be configuring in your RADIUS enforcement profiles are Tunnel-Type, set to VLAN; Tunnel-Medium-Type, set to 802; and Tunnel-Private-Group-Id, which is your actual VLAN ID. These three attributes, returned together in an Access-Accept message, instruct the authenticator to place the session into the correct network segment. For authentication protocols, you have several options. EAP-TLS is the gold standard. It uses client certificates for authentication, which eliminates the risk of credential theft and password fatigue entirely. It's the right choice for corporate-managed devices where you have an MDM platform to automate certificate provisioning. PEAP-MSCHAPv2 is a solid choice for BYOD scenarios where deploying certificates is impractical — it uses a server certificate to establish a TLS tunnel and then passes username and password credentials inside that tunnel. Avoid legacy protocols like LEAP or EAP-MD5 entirely; they are cryptographically weak and should not be used in any modern deployment. Let's talk about implementation. I always recommend a phased approach. Phase one is Identity Source Integration. Your RADIUS policies are only as good as your underlying directory. Ensure your Active Directory or Entra ID groups are logical, well-structured, and map directly to your intended network segments. Audit your groups before you start. Remove stale accounts, consolidate overlapping groups, and establish clear access tiers: Executive, Staff, Contractor, Guest, and IoT. For public-facing networks, platforms like Purple act as an identity provider, bridging the gap between public guest access and secure authentication frameworks. Phase two is Policy Configuration. Build policies that evaluate multiple contextual factors, not just credentials. Evaluate the NAS-IP-Address — that's the authenticator's IP — to understand which physical location the request is coming from. Evaluate the Called-Station-Id, which contains the SSID name, to understand which network the user is connecting to. Evaluate the time of day. A contractor's access profile at two in the morning should look very different from their access at nine in the morning. Layer these conditions to build truly context-aware policies. Phase three is the rollout. And I cannot stress this enough: never deploy 802.1X enforcement across an entire enterprise simultaneously. Start in monitor mode. In monitor mode, authentication failures are logged but access is still granted. This gives you visibility into misconfigured supplicants, devices with expired certificates, and legacy equipment that doesn't support 802.1X. Spend two to four weeks in monitor mode, resolve the issues you find, and then begin enforcing policies location by location. Now, let's talk about best practices and the pitfalls that catch teams out. The number one cause of a catastrophic authentication failure in an 802.1X environment is an expired certificate. Either the RADIUS server certificate expires, or the root CA certificate expires. When that happens, every device that validates the server certificate will fail to connect. Implement robust certificate lifecycle management. Set up automated alerts at ninety days, sixty days, and thirty days before expiration. Make certificate renewal a scheduled operational task, not a reactive emergency. The second major challenge is IoT. Many devices — printers, cameras, medical equipment, building management systems — simply don't support 802.1X. For these, you must use MAC Authentication Bypass, or MAB. The device's MAC address is used as its credential. But remember this rule: never trust the MAC. MAC addresses can be spoofed trivially. Only use MAB when absolutely necessary, and always place those devices into heavily restricted, isolated VLANs with strict ACLs that permit only the specific traffic those devices need to function. The third pitfall is supplicant misconfiguration. End-user devices may be configured to validate the server certificate but lack the necessary root CA in their trust store. This results in the device rejecting the server certificate and failing to connect. The fix is to use MDM to push standardised wireless profiles to all corporate devices, ensuring the correct root CA is trusted and the correct EAP method is configured. Finally, consider your network path. High latency between the authenticator and the RADIUS server can cause EAP timeouts, resulting in failed connections. For distributed enterprises with many remote locations, ensure your WAN architecture provides low-latency connectivity to your centralised AAA services. Let's move to the ROI and business impact. Why go through all of this effort? First, reduced operational overhead. Consolidating multiple SSIDs into a single 802.1X network with dynamic VLAN assignment improves wireless performance and reduces management complexity. Fewer SSIDs means less beacon overhead, more available airtime, and better throughput for your users. Second, compliance. If you're in retail, strict network segmentation is a PCI DSS requirement. If you're in healthcare, it's required for HIPAA. RADIUS policies provide the verifiable, auditable controls you need to pass compliance audits and avoid significant financial penalties. Third, user experience. Seamless, secure authentication — particularly via EAP-TLS or OpenRoaming — eliminates the friction of captive portals for returning corporate users and VIP guests. In hospitality and transport environments, this directly impacts satisfaction scores and repeat business. Now for our rapid-fire Q&A. Question: 'We have a lot of legacy devices. Should we stick with WPA2-PSK for simplicity?' Answer: No. Transition your capable devices to 802.1X and use MAB for the legacy devices, placing them in isolated segments. A single compromised PSK puts your entire network at risk. That is not a trade-off worth making. Question: 'How does Purple fit into a RADIUS deployment?' Answer: Purple provides deep analytics on authentication trends, session durations, and roaming behaviour, which is critical for optimising your deployment. Plus, as an identity provider for OpenRoaming, it streamlines secure access for guests without the friction of a traditional captive portal. Question: 'What is the quickest win for a team just starting this journey?' Answer: Deploy RADIUS in monitor mode this week. You will immediately gain visibility into your authentication landscape and identify the devices and users that will need attention before you enforce policies. Knowledge is the first step. In summary, configuring RADIUS policies for fine-grained network access control is a strategic investment in your network's security, performance, and compliance posture. Start with a clean, well-structured identity directory. Leverage dynamic VLAN assignment to consolidate your SSIDs and optimise your RF environment. Prioritise certificate-based authentication for corporate devices. Use MAB sparingly and securely for IoT. And always roll out in phases, starting with monitor mode. Thank you for joining this Purple Technical Briefing. For more detailed guides, implementation strategies, and to explore how Purple's guest WiFi and analytics platform can integrate with your network access control architecture, visit purple dot ai.

header_image.png

Resumo Executivo

Para espaços empresariais — desde grandes complexos de retalho a estádios de alta densidade — a segurança da rede e a experiência do utilizador estão intrinsecamente ligadas. A configuração de políticas RADIUS para controlo de acesso à rede granular fornece o mecanismo para segmentar o tráfego dinamicamente, garantindo que os ativos corporativos permanecem isolados das redes de convidados e de dispositivos IoT vulneráveis. Esta já não é uma atualização discricionária; é um requisito fundamental impulsionado por mandatos de conformidade, incluindo PCI DSS e GDPR.

Este guia oferece um plano técnico aprofundado para implementar controlo de acesso baseado em RADIUS. Examinamos a arquitetura da autenticação IEEE 802.1X, a mecânica da atribuição dinâmica de VLAN através de Atributos Específicos do Fornecedor (VSAs) e a integração de fornecedores de identidade, incluindo Active Directory, Entra ID e o fornecedor de identidade OpenRoaming da Purple. Ao ir além das chaves pré-partilhadas (PSKs) básicas para a aplicação de políticas sensíveis ao contexto, os líderes de TI podem mitigar riscos, otimizar operações e aproveitar plataformas como a Purple para transformar o WiFi de convidados de um centro de custos num ativo estratégico. O foco principal é em estratégias acionáveis e neutras em relação ao fornecedor que proporcionam ROI mensurável e resiliência operacional.

Análise Técnica Aprofundada

A Arquitetura de Acesso Sensível ao Contexto

Na sua essência, a configuração de políticas RADIUS para controlo de acesso à rede granular baseia-se na norma IEEE 802.1X. Esta estrutura facilita o controlo de acesso à rede baseado em portas, garantindo que apenas dispositivos autenticados e autorizados obtêm acesso a segmentos de rede específicos. A arquitetura consiste em três componentes principais: o suplicante (dispositivo cliente), o autenticador (ponto de acesso sem fios ou switch) e o servidor de autenticação (RADIUS).

radius_architecture_overview.png

Quando um dispositivo se conecta, o autenticador encapsula as mensagens do Extensible Authentication Protocol (EAP) e as encaminha para o servidor RADIUS. O servidor RADIUS avalia as credenciais em relação a um repositório de identidade — como Active Directory, LDAP ou um fornecedor de identidade baseado na cloud. Crucialmente, as implementações modernas de RADIUS não retornam apenas uma mensagem de Access-Accept ou Access-Reject. Elas retornam Atributos Específicos do Fornecedor (VSAs) que ditam o contexto de rede do utilizador: atribuição de VLAN, aplicação de Lista de Controlo de Acesso (ACL) e parâmetros de limitação de largura de banda.

Para implementações empresariais, compreender Frequências Wi-Fi: Um Guia para Frequências Wi-Fi em 2026 é essencial, pois as características da camada física impactam diretamente o desempenho dos handshakes de autenticação em ambientes de alta densidade.

Atribuição Dinâmica de VLAN e Micro-Segmentação

A aplicação mais poderosa das políticas RADIUS é a atribuição dinâmica de VLAN. Em vez de difundir múltiplos SSIDs para diferentes grupos de utilizadores — o que degrada o desempenho de RF devido à sobrecarga de beacons — um único SSID ativado para 802.1X pode servir todos os utilizadores corporativos. O servidor RADIUS determina a VLAN apropriada com base na pertença do utilizador a um grupo e em fatores contextuais.

Por exemplo, quando um membro da equipa financeira se autentica, o servidor RADIUS instrui o ponto de acesso a colocar o seu tráfego na VLAN 10. Quando um dispositivo IoT se autentica via MAC Authentication Bypass (MAB), é colocado numa VLAN 40 isolada com ACLs rigorosas. Esta abordagem reduz drasticamente a superfície de ataque e simplifica o ambiente de RF simultaneamente. Para implementações de fornecedores específicos, consulte Como Configurar Políticas NAC para Direcionamento de VLAN no Cisco Meraki .

radius_policy_decision_flow.png

Seleção do Método EAP

A escolha do método EAP tem implicações significativas tanto para a postura de segurança quanto para a complexidade operacional. A tabela abaixo resume as principais opções:

Método EAP Mecanismo de Autenticação Caso de Uso Recomendado Nível de Segurança
EAP-TLS Baseado em certificado mútuo Dispositivos corporativos geridos com MDM Mais Elevado
PEAP-MSCHAPv2 Certificado de servidor + nome de utilizador/palavra-passe BYOD, dispositivos de funcionários Elevado
EAP-TTLS Certificado de servidor + credenciais internas Ambientes mistos Elevado
MAB Endereço MAC como credencial IoT sem interface, dispositivos legados Baixo (usar com ACLs rigorosas)

Evite totalmente protocolos legados como LEAP e EAP-MD5; são criptograficamente fracos e não devem aparecer em nenhuma implementação moderna.

Guia de Implementação

A implementação de uma infraestrutura RADIUS robusta requer planeamento meticuloso e execução faseada. Os passos seguintes descrevem uma abordagem neutra em relação ao fornecedor para configurar políticas RADIUS para controlo de acesso à rede granular.

Fase 1: Integração da Fonte de Identidade

A base de qualquer política é um diretório de identidade limpo e bem estruturado. Quer utilize o Active Directory no local ou soluções nativas da cloud como Entra ID ou Okta, os grupos do diretório devem mapear diretamente para os seus segmentos de rede pretendidos.

  1. Auditar Grupos Existentes: Garanta que os grupos de utilizadores são lógicos e mutuamente exclusivos, sempre que possível. Remova contas inativas e consolide grupos sobrepostos.
  2. Definir Níveis de Acesso: Estabeleça níveis claros — Executivo, Pessoal, Contratado, Convidado, IoT — com direitos de acesso documentados para cada um.
  3. Integre o Purple como um Fornecedor de Identidade: Para redes de acesso público, o Purple atua como um fornecedor de identidade gratuito para serviços como o OpenRoaming sob a licença Connect. Isto preenche a lacuna entre o acesso público Guest WiFi e as estruturas de autenticação seguras, eliminando a necessidade de um Captive Portal tradicional para utilizadores recorrentes.

Fase 2: Configuração de Políticas e Mapeamento de Atributos

Configure o servidor RADIUS para avaliar os pedidos recebidos com base em múltiplos fatores contextuais, e não apenas nas credenciais.

  • Protocolos de Autenticação: Torne o EAP-TLS obrigatório para dispositivos corporativos. Implemente o PEAP-MSCHAPv2 para BYOD. Aplique estas medidas através da política RADIUS, rejeitando ligações que tentem métodos mais fracos.
  • Correspondência de Condições: Crie políticas que avaliem o NAS-IP-Address (o IP do autenticador), o Called-Station-Id (o SSID) e a hora do dia. O perfil de acesso de um contratado às 02:00 deve diferir materialmente do seu perfil às 09:00.
  • Perfis de Aplicação: Defina os atributos RADIUS a serem devolvidos. Os atributos padrão de atribuição de VLAN são: Tunnel-Type=VLAN, Tunnel-Medium-Type=802 e Tunnel-Private-Group-Id=[VLAN_ID].

Fase 3: Implementação Faseada e Monitorização

Nunca implemente a aplicação 802.1X em toda uma empresa simultaneamente.

  1. Modo de Monitorização: Implemente políticas em modo de monitorização ou auditoria, onde as falhas de autenticação são registadas, mas o acesso ainda é concedido. Isto identifica suplicantes mal configurados e dispositivos legados antes do início da aplicação.
  2. Aplicação Direcionada: Ative a aplicação por localização ou por departamento, resolvendo problemas antes de expandir o âmbito.
  3. Integração de Análises: Utilize plataformas como o WiFi Analytics da Purple para monitorizar as taxas de sucesso de autenticação, durações de sessão e comportamento de roaming. Estes dados são críticos para identificar lacunas de cobertura e gargalos de autenticação.

Melhores Práticas

Ao configurar políticas RADIUS para controlo de acesso à rede granular, a adesão aos padrões da indústria garante estabilidade e segurança a longo prazo.

Autenticação Baseada em Certificados (EAP-TLS): Sempre que possível, implemente o EAP-TLS. Elimina os riscos associados ao roubo de credenciais e à fadiga de palavras-passe. As plataformas de Gestão de Dispositivos Móveis (MDM) podem automatizar o aprovisionamento de certificados em escala.

Implemente a Mitigação da Aleatorização de MAC: Os sistemas operativos móveis modernos utilizam a aleatorização de endereços MAC para proteger a privacidade do utilizador. Para implementações de Guest WiFi , garanta que o seu Captive Portal e os sistemas de contabilidade RADIUS lidam com a alteração de endereços MAC de forma elegante — por exemplo, confiando em tokens de sessão ou perfis de dispositivo persistentes gerados durante o onboarding inicial.

Redundância e Failover: O RADIUS é um componente crítico da infraestrutura. Implemente servidores RADIUS em clusters de alta disponibilidade em locais geograficamente diversos. Configure autenticadores com IPs de servidor primários e secundários, e estabeleça valores agressivos de tempo limite e repetição para minimizar atrasos de autenticação durante eventos de failover.

Aproveite Dados Contextuais: Incorpore dados de localização nas decisões de política. Um contratado pode ter acesso a recursos internos quando ligado a um AP no bloco de engenharia, mas restrito a acesso apenas à internet quando ligado na cafetaria. As tecnologias discutidas em BLE Low Energy Explained for Enterprise podem aumentar este contexto de localização com dados de posicionamento de precisão.

Resolução de Problemas e Mitigação de Riscos

A complexidade das implementações 802.1X introduz modos de falha específicos. A mitigação proativa de riscos é essencial para manter o tempo de atividade.

Modos de Falha Comuns

Modo de Falha Causa Raiz Mitigação
Falha de autenticação em massa Certificado do servidor RADIUS ou CA raiz expirado Gestão do ciclo de vida do certificado com alertas automáticos aos 90/60/30 dias
Falhas de dispositivos individuais Má configuração do suplicante ou CA raiz em falta Perfis sem fios enviados por MDM com armazenamento de confiança correto
Tempo limite EAP Alta latência WAN para RADIUS centralizado Otimizar o caminho WAN; considerar RADIUS distribuído ou proxy RADIUS
Falhas de dispositivos IoT O dispositivo não suporta 802.1X Implementar MAB com isolamento VLAN rigoroso e ACLs

Para empresas distribuídas, a arquitetura discutida em SD WAN vs MPLS: The 2026 Enterprise Network Guide é diretamente relevante para garantir conectividade de baixa latência a serviços AAA centralizados em vários locais.

ROI e Impacto no Negócio

Investir o esforço de engenharia necessário para configurar políticas RADIUS para controlo de acesso à rede granular produz retornos substanciais e mensuráveis em múltiplas dimensões.

Redução da Sobrecarga Operacional: A consolidação de múltiplos SSIDs numa única rede 802.1X com atribuição dinâmica de VLAN reduz a interferência de RF, melhora o tempo de antena disponível e simplifica a gestão contínua. As equipas relatam uma redução significativa nos tickets de helpdesk relacionados com a conectividade WiFi assim que uma implementação 802.1X está em vigor.

Postura de Conformidade Melhorada: Para setores como Retail e Healthcare , a segmentação rigorosa da rede é um requisito regulamentar — PCI DSS e HIPAA, respetivamente. As políticas RADIUS fornecem os controlos verificáveis e auditáveis necessários para passar auditorias de conformidade e evitar penalidades financeiras substanciais. Para organizações do setor público, as obrigações GDPR relativas à segregação de dados são abordadas de forma semelhante.

Experiência do Utilizador Melhorada: A autenticação segura e sem interrupções — particularmente via EAP-TLS ou OpenRoaming — elimina o atrito dos Captive Portals para utilizadores corporativos recorrentes e convidados VIP. Em locais de Hospitality e Transport , isto impacta diretamente as métricas de satisfação e o envolvimento repetido.

Key Definitions

RADIUS (Remote Authentication Dial-In User Service)

A networking protocol that provides centralised Authentication, Authorisation, and Accounting (AAA) management for users who connect and use a network service. Defined in RFC 2865.

The core engine for enterprise network access control, determining who gets on the network, what they can access, and logging the activity for audit purposes.

IEEE 802.1X

An IEEE Standard for port-based Network Access Control (PNAC). It provides an authentication mechanism to devices wishing to attach to a LAN or WLAN, blocking all traffic until authentication is complete.

The standard that forces a device to prove its identity before it is allowed to send any data traffic on the network. The enforcement mechanism that makes RADIUS policies actionable.

EAP (Extensible Authentication Protocol)

An authentication framework frequently used in wireless networks and point-to-point connections. It provides a transport layer for authentication methods (EAP methods) such as TLS or MSCHAPv2.

The envelope that carries the actual authentication credentials between the client and the RADIUS server. The choice of EAP method determines the security level of the authentication exchange.

VSA (Vendor-Specific Attribute)

Attributes within a RADIUS message that allow vendors to support extended attributes not defined in the base RADIUS RFCs. Used to convey network policy instructions from the RADIUS server to the authenticator.

The mechanism by which RADIUS instructs network hardware to assign a user to a specific VLAN, apply a firewall role, or enforce bandwidth limits. Without VSAs, RADIUS can only permit or deny access.

Dynamic VLAN Assignment

The process where a RADIUS server instructs an access point or switch to place a user's traffic onto a specific Virtual LAN based on their identity, group membership, or contextual attributes.

The key technique for network micro-segmentation. Allows a single physical infrastructure to securely support multiple distinct user groups without broadcasting multiple SSIDs.

Supplicant

The software client on an end-user device (laptop, smartphone, IoT device) that initiates and negotiates the 802.1X authentication exchange with the network authenticator.

Built into modern operating systems (Windows, macOS, iOS, Android). Misconfigured supplicants — particularly incorrect certificate trust settings — are the most common source of 802.1X connectivity issues.

Authenticator

The network device (wireless access point or Ethernet switch) that acts as the enforcement point in an 802.1X deployment. It relays EAP messages between the supplicant and the RADIUS server, and enforces the policy decision.

The gatekeeper. The authenticator blocks all traffic from a port or wireless association until the RADIUS server returns an Access-Accept message, at which point it applies the returned VSAs.

MAB (MAC Authentication Bypass)

A fallback authentication method where the network device's MAC address is submitted as its credential to the RADIUS server. Used for devices that do not support 802.1X supplicants.

A necessary operational tool for legacy and headless IoT devices, but inherently less secure than cryptographic authentication. Should always be paired with strict VLAN isolation and ACLs.

EAP-TLS (EAP Transport Layer Security)

A certificate-based EAP method that provides mutual authentication between the client and the RADIUS server using X.509 certificates. Considered the most secure EAP method available.

The recommended authentication method for corporate-managed devices. Eliminates password-based credential risks entirely. Requires a PKI infrastructure and MDM for certificate provisioning.

Worked Examples

A large conference centre needs to provide secure, segmented WiFi access for event staff, exhibitors, and general attendees. They currently broadcast three separate SSIDs, which is causing significant co-channel interference and poor performance in high-density exhibition halls.

The venue transitions to a single, 802.1X-enabled SSID named 'Conference_Secure'. They implement a RADIUS server integrated with their event management database.

  1. Event staff authenticate using their corporate credentials via PEAP-MSCHAPv2. The RADIUS policy matches their Active Directory group and returns Tunnel-Private-Group-Id=10 (Staff VLAN), granting access to internal AV management systems.
  2. Exhibitors are provided unique, time-limited credentials tied to their stand booking. Upon authentication, the RADIUS server returns Tunnel-Private-Group-Id=20 (Exhibitor VLAN), which has ACLs permitting access to specific presentation servers and internet egress.
  3. General attendees use a separate open SSID with a captive portal integrated with Purple for marketing data collection, consent management, and basic internet access.

The result is a 40% reduction in management frame overhead, measurably improved throughput in exhibition halls, and a clear audit trail for compliance purposes.

Examiner's Commentary: This approach solves the RF interference issue by reducing SSID overhead from three to two (one secure, one open for guests). Dynamic VLAN assignment achieves strict network segmentation without sacrificing user experience. The integration of Purple for the general attendee network ensures marketing objectives are met while maintaining security for internal operations. The time-limited credentials for exhibitors are a particularly strong practice — they automatically expire, eliminating the risk of credential reuse after the event.

A retail chain needs to secure thousands of wireless Point of Sale (POS) terminals across 500 locations. They are currently using WPA2-PSK, and IT is concerned about the operational risk of rotating the pre-shared key across 500 sites, as well as PCI DSS audit findings.

The IT team deploys a centralised RADIUS infrastructure and configures the POS terminals for EAP-TLS authentication.

  1. An MDM solution pushes a unique client certificate to each POS terminal during provisioning.
  2. The wireless access points at each store are configured to forward authentication requests to the central RADIUS servers over the SD-WAN fabric.
  3. The RADIUS policy verifies the client certificate against the internal PKI and returns attributes to place the device on the isolated POS VLAN (VLAN 50), satisfying PCI DSS network segmentation requirements.
  4. A certificate revocation list (CRL) is maintained, allowing IT to instantly quarantine a lost or stolen terminal by revoking its certificate — without impacting any other device.
Examiner's Commentary: Migrating from PSK to EAP-TLS for headless devices is a significant security upgrade that directly addresses PCI DSS requirements for network segmentation and access control. The certificate revocation capability is a major operational advantage over PSK — instead of rotating a shared secret across 500 sites, a single certificate can be revoked in seconds. The use of unique per-device certificates also provides a complete audit trail of which specific terminal connected, when, and from which location.

Practice Questions

Q1. A hospital needs to deploy new wireless infusion pumps across three wards. These devices do not support 802.1X supplicants. The CISO requires that these devices are completely isolated from the corporate network and can only communicate with the specific clinical management server at 10.5.1.20. How should you configure the network access control policy?

Hint: Consider how devices without 802.1X capabilities can be identified and the principle of least privilege when defining the ACL.

View model answer

Implement MAC Authentication Bypass (MAB). Register the MAC addresses of all infusion pumps in the RADIUS database during the provisioning process. Create a specific RADIUS policy that matches these MAC addresses and returns VSAs assigning them to an isolated IoT VLAN (e.g., VLAN 60). Apply strict ACLs to this VLAN permitting outbound traffic only to 10.5.1.20 on the required clinical management ports, and blocking all other inter-VLAN and internet traffic. Additionally, configure DHCP snooping and dynamic ARP inspection on the IoT VLAN to prevent spoofing attacks.

Q2. Following a recent acquisition, an enterprise now has two distinct Active Directory domains: corp.acme.com and corp.legacy.com. They want all employees from both entities to use the same 'ACME_Corporate' SSID without migrating the legacy domain. How can RADIUS facilitate this?

Hint: Think about how RADIUS handles authentication routing based on the identity realm and how policy servers can proxy requests to different backend directories.

View model answer

Configure the RADIUS infrastructure (using a policy server such as Cisco ISE, Aruba ClearPass, or a RADIUS proxy) to evaluate the realm suffix provided in the user's EAP identity — for example, user@corp.acme.com versus user@corp.legacy.com . Create routing policies that forward authentication requests to the appropriate backend Active Directory domain based on the realm. Define standardised enforcement profiles that return consistent VLAN VSAs regardless of the backend domain, ensuring users from both entities receive the correct network placement. This approach avoids a disruptive directory migration while maintaining a unified user experience.

Q3. You are designing the WiFi for a 60,000-seat stadium. The client's current design specifies 8 separate SSIDs for different staff functions: Ticketing, Security, Concessions, Medical, Media, Operations, VIP, and Maintenance. What is your recommendation and why?

Hint: Consider the impact of management frame overhead on wireless performance in a high-density RF environment.

View model answer

Strongly advise against broadcasting 8 SSIDs. In a high-density environment, each SSID generates beacon frames on every access point at regular intervals, consuming significant airtime and reducing the capacity available for actual data traffic. The recommendation is to consolidate all staff functions onto a single 802.1X-enabled SSID. Utilise RADIUS dynamic VLAN assignment to segment the traffic on the backend — when a ticketing device authenticates, RADIUS places it on the Ticketing VLAN; when a medical device authenticates, it goes to the Medical VLAN with appropriate ACLs. This provides the required logical separation while optimising the physical RF environment. A separate open SSID with a captive portal can handle general public access.