Arista SD-Branch Part 8: Wired 802.1X and MAB Policy with AGNI on EOS

14 October 2026 CloudVisionAGNISD-BranchArista Campus802.1XEAP-TLSNAC

With RadSec up, the switch can ask AGNI for decisions. This post builds the wired policy: the EOS 802.1X configuration, the AGNI network and segment that match it, and how to confirm a session worked. The EOS lines come from published EOS 802.1X configurations, and the AGNI flow comes from Arista’s lab material. I have not run any of it.

The EOS side

Global configuration points 802.1X at a RADIUS server group and turns on port authentication. In Part 7 the group was AAA-AGNI-GROUP, so authentication uses that group in place of the generic radius keyword.

logging level DOT1X informational
aaa authentication dot1x default group AAA-AGNI-GROUP
aaa accounting dot1x default start-stop group AAA-AGNI-GROUP
dot1x system-auth-control

The accounting line follows the same pattern as the authentication line. Arista’s lab configlet sets both methods to the AGNI group, but I could not quote an accounting line from a public source, so check it against the command reference for your release.

Access ports then need the authenticator role:

interface Ethernet5
   dot1x pae authenticator
   dot1x reauthentication
   dot1x port-control auto
   dot1x host-mode single-host
   dot1x timeout quiet-period 10

For devices that cannot do 802.1X, add MAC-based authentication to the same port:

interface Ethernet5
   dot1x pae authenticator
   dot1x port-control auto
   dot1x mac based authentication

Those lines are the ones that appear in the DISA STIG audit for EOS. They are the baseline syntax. In CloudVision you would not type them per port. Part 4’s port profile is where 802.1X and MAC-based authentication get switched on, and a change control pushes it.

The AGNI side

Three objects make the wired policy.

  1. An access device group containing the switch, for example one named for the wired estate.
  2. A wired network with EAP-TLS client certificate authentication. Turn on MAC fallback, and set it to allow registered clients only. Onboarding can be on if you want AGNI’s PKI to issue certificates.
  3. A segment with two conditions, the network name and the EAP-TLS authentication type, and the action Allow Access.

The “registered clients only” setting on MAC fallback is the important one. A bare MAC fallback lets any device that knows an allowed address walk in. Restricting it to registered clients means a device must already be a known entry.

A second segment for MAC-authenticated devices would match on a different network and assign a more restricted role profile, so that a printer that falls back to MAB ends up in a printer VLAN and not the user VLAN.

What happens on a port

The sequence on a port set to port-control auto is:

  1. The link comes up and the switch sends EAPOL to the endpoint.
  2. If the endpoint has a supplicant, it starts EAP-TLS and the switch relays the exchange to AGNI over RadSec.
  3. If nothing answers, and MAB is configured, the switch learns the source MAC and authenticates that.
  4. AGNI evaluates its segments and returns accept or reject, with a role.
  5. The switch opens the port with the result, and sends accounting records.

Verifying a session

On the switch:

show dot1x host
show dot1x host mac 0050.56ab.cd12 detail

The first gives a port summary. The second shows the session for one endpoint, and a successful one shows the supplicant state as SUCCESS. The MAC there is an example.

In AGNI, the Sessions view shows the same client connecting. In CloudVision, Endpoint Overview shows authentication state and traffic flows for the endpoint. Checking all three matters, because a fault can sit at any hop.

Where it breaks

SymptomFirst thing to check
Switch shows no response from the serverRadSec session state in AGNI’s access device list, then the SSL profile state on the switch
Authentication fails for a corporate laptopThe client certificate chain and that the network allows EAP-TLS
Device lands in the wrong roleThe segment conditions and their order
Port stays unauthorizedport-control setting and whether MAB is enabled for non-supplicant devices

Port authentication is the control that closes the empty-port attacks I walked through in Five Minutes and an Empty Port. With MAB limited to registered clients and profiling on, the cheap tricks from that series get a lot harder.

Sources