802.1x Port-Based Network Access Control Overview

​

Introduction

802.1x port-based network access control (PNAC) with Simple Certificate Enrollment Protocol (SCEP) support enables nodes to authenticate with enterprise network switches using X.509 certificate-based identity before being granted access to production network traffic. This allows organizations to meet enterprise security requirements when deploying nodes in factory and corporate environments.

​

How It Works

When a node connects to a switch port with 802.1x enabled, the switch requires the device to authenticate before allowing production network traffic. EVE-OS uses EAP-TLS (Extensible Authentication Protocol with Transport Layer Security) as the authentication method. EAP-TLS uses X.509 digital certificates to prove the device’s identity to the network’s RADIUS server.

​

Authentication workflow

The following sequence describes the complete flow from first boot through authenticated network access:

1. The node sends a DHCP discovery packet that includes the vendor class identifier LFEDGE-EVE (DHCP Option 60), identifying the device as an EVE-OS node to the network infrastructure.
2. The switch places the port in a non-authenticated bootstrap VLAN. Because the switch or DHCP server recognizes the LFEDGE-EVE vendor class identifier, it allows the device to reach Edge Infrastructure Services and the SCEP server from this restricted VLAN.
3. EVE-OS fetches its network and SCEP configuration from Edge Infrastructure Services, then follows the configured enrollment profile to request a certificate from the SCEP server, either directly or through a controller-provided SCEP proxy.
4. EVE-OS uses the enrolled certificate to authenticate the port via 802.1x EAP-TLS. The switch validates the certificate against the RADIUS server and, on success, moves the port to the authenticated VLAN.
5. After a configurable delay (default: 5 seconds), EVE-OS sends a new DHCP request to obtain an IP address from the authenticated VLAN’s address range.

EVE-OS publishes the port authentication status, enrolled certificate details, and EAPOL metrics to Edge Infrastructure Services after each step.

​

Certificate bootstrapping

The first authentication challenge for a new device is obtaining an initial certificate before 802.1x authentication can succeed. EVE-OS solves this through a quarantine VLAN approach:

1. When a new node connects without a certificate, 802.1x authentication fails and the switch places the device in a quarantine VLAN.
2. EVE-OS uses the LFEDGE-EVE vendor class identifier to help the network infrastructure identify the device type and route it to an onboarding VLAN where it can reach Edge Infrastructure Services.
3. From the onboarding VLAN, the node connects to Edge Infrastructure Services and completes device onboarding.
4. As part of onboarding, Edge Infrastructure Services acts as the SCEP client on behalf of the device. The device generates a private/public key pair and a Certificate Signing Request (CSR) locally, keeping the private key on the device. Edge Infrastructure Services submits this CSR to the configured SCEP server.
5. After the SCEP server issues a signed certificate, Edge Infrastructure Services deploys it to the node.
6. With the certificate installed, EVE-OS re-authenticates to the network using 802.1x EAP-TLS, and the switch moves the port to the production VLAN.

​

Certificate renewal

Edge Infrastructure Services continuously monitors certificate expiration dates on all managed nodes. When a certificate approaches its configured renewal window (expressed as a percentage of the certificate’s total validity period), Edge Infrastructure Services automatically triggers a renewal request. The device generates a new key pair and CSR, signs the renewal request with the existing certificate’s private key, and submits it to the SCEP server.

​

Expired certificate recovery

If a node comes back online with an expired certificate (for example, after an extended offline period), it cannot pass 802.1x authentication. The PNAC backend places the device back in the quarantine VLAN. Edge Infrastructure Services detects the expired certificate and initiates a new enrollment flow to issue a fresh certificate, after which the device re-authenticates to the production network.

​

Per-port configuration

You can designate individual Ethernet ports and Wi-Fi interfaces as 802.1x-eligible at the network adapter level. 802.1x eligibility is enabled at the project level, so you can maintain separate configurations for staging and production environments. A single device certificate is shared across all 802.1x-enabled ports on the device. Cellular interfaces do not support 802.1x authentication.

​

Key Benefits

• Meets enterprise security requirements. Nodes authenticate to the network using certificate-based identity, satisfying 802.1x enforcement policies required by enterprise and factory environments.
• Automates certificate lifecycle management. Edge Infrastructure Services handles initial certificate acquisition, proactive renewal, and expired certificate recovery without manual intervention, even across large fleets of nodes.
• Simplifies CA integration. Edge Infrastructure Services acts as the SCEP client for all managed devices, so your Certificate Authority only needs to allow access from a single endpoint rather than from every individual node.
• Supports environment-based policy control. 802.1x authentication is enabled at the project level, allowing you to enforce authentication in production while keeping it disabled in lab or staging environments.

​

Next Steps