802.1X is an IEEE-standardized port-based network access control protocol that verifies a device's identity before it is truly allowed onto a wired or wireless network. Until authentication completes, the switch port or wireless access point keeps the device blocked for regular traffic; access is opened only to verified users and devices. This approach guards the network entrance at the port level and stops unauthorized devices from reaching the internal network.
This content is for general information only and does not constitute legal advice; assess your Law-5651 obligations specifically for your organization.
How 802.1X Works: Three Core Components
The 802.1X architecture is built on three roles that talk to one another. Each forms a link in the authentication chain:
- Supplicant (Client): The client software running on the device that wants to join the network. Windows, macOS, Linux, and mobile operating systems ship with built-in supplicant support.
- Authenticator: The network hardware the device connects to — a switch port on a wired network, an access point (AP) on a wireless one. It keeps the port open "for authentication traffic only" until verification succeeds.
- Authentication Server: The decision-making core, almost always a RADIUS server. It validates user credentials or a device certificate and reports the result back to the authenticator.
In short, the flow is: the client connects to the port, the authenticator requests identity, the client sends it via EAP messages, the RADIUS server validates it and returns an accept or reject. On accept, the port opens and the device is typically placed on the correct VLAN.
The Role of EAP and RADIUS
802.1X does not define the authentication method itself, but rather the framework that carries it. The carried content is expressed through EAP (Extensible Authentication Protocol). EAP lets different verification methods run over the same infrastructure:
- EAP-TLS: Based on client and server certificates — passwordless and considered the strongest option.
- PEAP and EAP-TTLS: Carry username/password validation inside an encrypted tunnel; common in enterprise networks.
The conversation between the authenticator and the authentication server runs over RADIUS. This distinction matters: wired and wireless 802.1X use EAP, which is fundamentally different from captive portal logic that redirects the user to a web page.
802.1X vs. Captive Portal
Both approaches answer the question "who is connecting," but they operate at different layers and suit different scenarios. The comparison below helps you choose:
| Criterion | 802.1X | Captive Portal |
|---|---|---|
| Time of verification | Before the network link forms, at the port level | After the link forms, via the browser |
| Carrier method | EAP (EAP-TLS, PEAP, EAP-TTLS) | Web form; RADIUS auth is PAP only |
| Typical use | Corporate staff, managed devices | Guest/hotspot access, identified internet |
| User experience | Silent, automatic sign-on | Welcome page and a login step |
| Device requirement | Supplicant support required | A web browser is enough |
In practice the two complement each other: 802.1X for managed corporate devices, captive portal for guests and personal devices. For end-to-end management of guest access, our hotspot management solution covers that second scenario.
802.1X with SignLogger NAC
SignLogger positions 802.1X as part of a broader network access control (NAC) strategy. The product is vendor-independent: it works with any RADIUS-capable switch, access point, and firewall, so you are never locked into a single manufacturer. All components run on your own infrastructure (VMware / Hyper-V), and both authentication and log data stay on-premises.
While 802.1X controls which device enters the network, SignLogger also collects those access records. The records are handled under Law-5651 obligations and are signed every day with an authorized certificate authority, TÜBİTAK Kamu SM, using its timestamp and e-signature (Kamu SM works on a credit / kontör basis). This turns "who connected, when, and through which port" into tamper-evident evidence. For details, see our network access control (NAC) solution page.
Frequently Asked Questions
What is the difference between 802.1X and MAC-based authentication?
802.1X validates user identity or a device certificate and is very hard to spoof. MAC-based authentication only checks the device's hardware address; because MAC addresses are easily cloned, it is noticeably weaker than 802.1X. MAC authentication is usually a fallback for devices that lack supplicant support, such as printers.
Does 802.1X also work on wireless networks?
Yes. 802.1X is the foundation of enterprise Wi-Fi security (WPA2-Enterprise / WPA3-Enterprise). In this scenario the access point acts as the authenticator, and verification again runs through the RADIUS server over EAP.
Which EAP method is considered the most secure for 802.1X?
Certificate-based EAP-TLS is generally the strongest option; because it contains no password, it removes password-leak and brute-force risks. If a certificate infrastructure is hard to deploy, PEAP or EAP-TTLS using an encrypted tunnel are reasonable alternatives.
Can captive portal and 802.1X be used together on the same network?
Yes, and it is a common approach. Managed corporate devices authenticate silently with 802.1X, while guests and personal devices sign in through a captive portal welcome page. The two mechanisms can run in parallel across different VLANs.
What hardware is required for 802.1X to work?
You need an 802.1X-capable switch or wireless access point (the authenticator) and a RADIUS server. On the client side, most operating systems include a built-in supplicant, so additional software is usually unnecessary.
Does SignLogger meet Law-5651 obligations using 802.1X records?
SignLogger collects access and internet-usage records and signs them every day with a Kamu SM timestamp and e-signature, making their integrity provable. Exact figures such as the legal retention period and accepted identity methods can vary, so verify these details separately.