A new engineer is mapping the 802.1X roles in a deployment where a laptop connects to a Catalyst switch port and Cisco ISE makes the access decision. Which mapping of supplicant, authenticator and authentication server is correct?
Select an answer to reveal the explanation.
Short Explanation
Picture a nightclub: you're the supplicant asking to get in, the bouncer at the door is the authenticator, and the manager with the list is the authentication server. The switch just relays your request to ISE; it doesn't make the call. Mixing up the door and the decision maker is the classic slip.
Full Explanation
IEEE 802.1X defines three roles. The supplicant is software on the endpoint, here the laptop, that provides credentials. The authenticator is the network access device, here the Catalyst switch, which controls the port and relays authentication messages. The authentication server, here Cisco ISE, validates the credentials and returns the authorization decision. Between the supplicant and the switch, EAP is carried over LAN as EAPOL frames; between the switch and ISE, the EAP messages are encapsulated in RADIUS. The authenticator does not validate credentials itself; it opens the port or applies the returned VLAN, dACL or SGT based on ISE's answer. Mapping the switch as supplicant reverses the roles, since the switch is not the device requesting access. Mapping ISE as authenticator confuses relaying with deciding; ISE never controls the switch port directly. Making the switch the authentication server ignores that the switch forwards credentials to RADIUS rather than checking them. Exam caveat: on wireless, the WLC acts as authenticator in the same way. Operational check: on the switch, display the authentication session for the port and confirm the method is dot1x and the server is the ISE node, then match it to the ISE live log entry.