A fire district is documenting wired 802.1X at closet switches. Which role mapping is correct for the endpoint, the access switch, and the RADIUS/ISE server?
Select an answer to reveal the explanation.
Short Explanation
Picture a badge reader at the station door: the firefighter is the one presenting credentials (supplicant), the door gear is the authenticator, and HQ verifies the badge (authentication server). Wired 802.1X uses the same three roles—endpoint, switch, and RADIUS/ISE.
Full Explanation
Wired 802.1X on fire-district closet switches uses a fixed role mapping that CCIE Enterprise Infrastructure candidates must recite without mixing terms. The endpoint (laptop, phone, or other client) runs the supplicant and presents credentials. The access switch is the authenticator: it exchanges EAPOL with the endpoint and encapsulates the conversation toward RADIUS. ISE (or another RADIUS server) is the authentication server that evaluates identity and returns authorization. That three-party model is the foundation of every wired 802.1X design review in municipal buildings.
Calling the closet switch the supplicant and the laptop the authenticator reverses the roles and incorrectly treats ISE as optional. Labeling the laptop as authenticator and ISE as supplicant while claiming the switch only forwards EAPOL also scrambles the standard mapping. Treating ISE as the authenticator and the switch as the authentication server leaves the PC as a passive bystander, which contradicts how EAPOL terminates on the authenticator port.
Exam caveat: wireless architectures still use the same conceptual roles, but the authenticator may sit in a WLC or FlexConnect path; do not let wireless topology distract from the wired closet mapping asked here. Operational check: on a pilot desk drop, confirm EAPOL counters and session state on the access switch while RADIUS live logs show Access-Request and Access-Accept from ISE, documenting the supplicant–authenticator–server path in the fire-district runbook.