How to Secure Non-802.1X Devices on Enterprise Networks Using Cisco ISE, MAB, and Catalyst 9200/9300

As enterprises move toward identity-based network access, IEEE 802.1X has become the standard for securing wired and wireless connections. By authenticating endpoints before granting network access, organizations can enforce security policies, segment devices, and prevent unauthorized connections.

However, in real-world enterprise environments, deploying 802.1X across the entire LAN quickly reveals a challenge: many devices simply cannot authenticate.

Printers, IP cameras, building automation controllers, and industrial IoT systems often lack an EAP supplicant, meaning they cannot respond to EAPOL (Extensible Authentication Protocol over LAN) authentication requests. If strict 802.1X enforcement is applied, these devices will fail authentication and lose network connectivity.

To address this gap, enterprises typically deploy a hybrid authentication architecture that combines:

• 802.1X authentication for managed endpoints
• MAC Authentication Bypass (MAB) for non-802.1X devices
• Identity-based policy enforcement through Cisco Identity Services Engine (ISE)

When implemented on enterprise access platforms such as Cisco Catalyst 9200 and Catalyst 9300 switches, this approach allows organizations to maintain strong security while still supporting legacy and IoT devices.

This guide explains how to design secure wired access for non-802.1X devices using Cisco ISE, device profiling, and policy-based network segmentation.

Table of Contents

• Part 1: The 802.1X Reality Problem
• Part 2: Reference Architecture – 802.1X with MAB Fallback
• Part 3: Cisco ISE Device Profiling
• Part 4: Policy Enforcement with dACLs and VLAN Segmentation
• Part 5: Security Risks and Mitigation Strategies
• Part 6: Deployment Playbook for Secure Wired Access
• Part 7: Frequently Asked Questions

Part 1: The 802.1X Reality Problem

The IEEE 802.1X standard requires endpoints to run an EAP supplicant that can exchange authentication messages with a RADIUS server. Managed corporate devices such as Windows laptops, macOS systems, and Linux workstations typically support this natively.

But enterprise networks include many headless or embedded devices that cannot participate in 802.1X authentication.

Common examples include:

• Office printers and multifunction devices
• IP surveillance cameras
• Smart TVs and conferencing systems
• IoT sensors and building automation controllers
• Medical equipment
• Industrial control or OT systems

These devices usually run embedded firmware with limited networking capabilities. Many lack the ability to install certificates or run authentication clients.

If administrators enforce 802.1X closed mode on all switch ports, these devices will fail to respond to EAPOL authentication requests and be blocked from accessing the network.

This creates an operational dilemma:

• Leaving ports open introduces security risks
• Enforcing strict authentication breaks essential services

A practical enterprise design must therefore provide secure fallback authentication.

Part 2: Reference Architecture – 802.1X with MAB Fallback

To support both modern and legacy endpoints, most enterprise networks use an 802.1X-first authentication strategy.

When a device connects to a switch port, the authentication process typically works as follows:

1. The switch sends an EAPOL challenge to initiate 802.1X authentication.
2. If the device supports 802.1X, it responds with credentials or certificates.
3. If the device does not respond, the switch waits for a configurable timeout.
4. The switch then falls back to MAC Authentication Bypass (MAB).
5. The endpoint’s MAC address is sent to Cisco ISE in a RADIUS Access-Request.

In the RADIUS request, the MAC address is typically used as both the username and password, often tagged with attributes such as:

Example RADIUS attribute used during MAB authentication:

Service-Type = Call Check

This architecture enables the network to authenticate managed devices securely while still allowing non-802.1X devices to connect under controlled conditions.

Enterprise access switches such as Cisco Catalyst 9200 and Catalyst 9300 are commonly used in this role because they support:

• 802.1X authentication
• MAC Authentication Bypass
• Dynamic VLAN assignment
• Downloadable ACL enforcement
• Integration with Cisco official site

A simplified switch configuration typically prioritizes 802.1X before MAB.

Example CLI configuration enabling 802.1X with MAB fallback:

authentication order dot1x mab
authentication priority dot1x mab
mab
dot1x pae authenticator

Part 3: Cisco ISE Device Profiling

While MAB allows connectivity, MAC addresses alone cannot be trusted. They are easy to spoof and difficult to manage manually.

Instead of relying on static MAC whitelists, Cisco ISE provides a device profiling engine that automatically identifies endpoints using multiple data sources.

Common profiling techniques include:

• DHCP fingerprinting
• MAC OUI analysis
• SNMP probes
• Network traffic behavior analysis

DHCP inspection is especially useful. Cisco ISE can analyze DHCP options such as:

• DHCP Option 60 (Vendor Class Identifier)
• DHCP Option 77 (User Class)

SNMP queries can also reveal device information such as system descriptions.

Example SNMP attributes retrieved from network devices:

sysDescr
sysObjectID

By correlating these signals, Cisco ISE can classify devices into identity groups such as printers, cameras, VoIP phones, or IoT endpoints.

Part 4: Policy Enforcement with dACLs and VLAN Segmentation

After identifying a device, Cisco ISE must enforce restrictions on what that device can access.

Two common mechanisms are Downloadable ACLs (dACLs) and dynamic VLAN assignment.

Downloadable ACLs

A downloadable ACL is dynamically pushed from Cisco ISE to the switch during authorization.

Instead of granting full network access, the ACL restricts traffic to only required services.

Example dACL policy allowing a printer to reach only specific services:

permit tcp any host 10.10.10.50 eq 9100
permit udp any host 10.10.10.10 eq 53
deny ip any any

Best practice is to keep dACL policies relatively small to prevent excessive TCAM usage on access switches.

The following table shows a simplified enterprise segmentation example.

Part 5: Security Risks and Mitigation Strategies

While MAB provides a practical way to support legacy devices, it introduces several security concerns.

MAC Spoofing

Attackers can change their MAC address to impersonate trusted devices.

Mitigation strategies include:

• Device profiling verification
• Strict access control policies
• Network segmentation

Rogue Device Connections

Open switch ports may allow unauthorized devices to connect.

Security teams can reduce risk through:

• Port security
• Endpoint monitoring
• Authentication logging

Lateral Movement

Compromised IoT devices may attempt to access internal resources.

Using dACL restrictions and VLAN segmentation significantly reduces the attack surface.

Part 6: Deployment Playbook for Secure Wired Access

Implementing 802.1X and MAB across an enterprise network requires careful planning. Many organizations follow a phased rollout strategy.

Phase 1: Visibility and Discovery

Authentication is enabled in monitoring mode to collect endpoint information and build accurate profiling rules.

• Identify device types
• Monitor authentication attempts
• Create identity groups

Phase 2: Controlled Authentication

802.1X authentication is enforced for managed endpoints while MAB remains available for unsupported devices.

• Validate certificate authentication
• Confirm VLAN segmentation policies
• Test authorization rules

Phase 3: Full Policy Enforcement

Once policies are stable, organizations enable full enforcement.

• Unknown devices are quarantined
• Unauthorized devices are blocked
• IoT devices receive restricted network access

Organizations upgrading their enterprise access networks often rely on suppliers such as Router-switch for switching infrastructure and use tools like IT-Price to compare network hardware pricing and availability.

Part 7: Frequently Asked Questions

What is MAC Authentication Bypass (MAB)?

MAB is a fallback authentication method used when devices do not support 802.1X. The switch sends the device’s MAC address to Cisco ISE, which determines whether the endpoint should be granted network access.

Is MAB secure enough for enterprise environments?

MAB is less secure than certificate-based authentication because MAC addresses can be spoofed. However, when combined with device profiling, segmentation, and strict access policies, it provides a practical way to support legacy devices.

Why are Catalyst 9200 and 9300 switches commonly used for secure wired access?

These switches support advanced authentication features including 802.1X, MAB fallback, dynamic VLAN assignment, and downloadable ACL enforcement. They also integrate closely with Cisco ISE for identity-based access control.

Can IoT devices be secured without 802.1X?

Yes. Enterprises often secure IoT devices using a combination of MAB authentication, Cisco ISE profiling, VLAN segmentation, and restrictive access control policies.