An engineer is configuring access switches and Cisco ISE to authenticate employee laptops with 802.1X before granting them network access. Which AAA protocol carries the EAP exchange between the switch and ISE?
Select an answer to reveal the explanation.
Short Explanation
In 802.1X the switch is a go-between: the laptop speaks EAP to the switch, and the switch wraps it in RADIUS to send to ISE. TACACS+ is for administrators logging in to devices, not for endpoints getting on the network. That's the classic swap the exam wants to catch you on.
Full Explanation
802.1X defines three roles: the supplicant on the endpoint, the authenticator on the switch, and the authentication server. Between the supplicant and the switch, EAP messages travel as EAP over LAN. Between the switch and Cisco ISE, the switch encapsulates the EAP messages in RADIUS Access-Request packets using the EAP-Message attribute, and ISE responds with Access-Challenge, Access-Accept or Access-Reject, often including authorization attributes such as a VLAN, a downloadable ACL or a security group tag. RADIUS is therefore the protocol for network access. TACACS+ encrypts the full packet body, but it is designed for device administration, such as command authorization on routers and switches, and does not carry EAP for endpoint authentication. LDAP may be used by ISE behind the scenes to query an identity store, but the switch does not talk LDAP to a directory during 802.1X; ISE is the authentication server. SNMPv3 is a management and monitoring protocol and plays no role in the authentication exchange. Exam caveat: RADIUS accounting messages, sent over the accounting port, report session start, interim updates and stop, which ISE uses for session tracking. Operational check: on the switch, confirm the RADIUS server is reachable and the session shows as authenticated by dot1x, and on ISE review the live logs for the laptop's authentication and the authorization result returned.