300-430 Question 318
Single answerAn enterprise network administrator is implementing 802.1X authentication for access points to enhance security. The organization uses a combination of RADIUS servers and Cisco switches to enforce authentication. During testing, the access points fail to authenticate. What is the MOST likely reason for the failure?
- A
The shared secret between the access point and RADIUS server is mismatched.
- B
The switch is not configured to support 802.1X on the port connected to the access point.
- C
The access point is configured with a static IP address instead of DHCP.
- D
The RADIUS server is not configured to verify the MAC address of the access point.
Show answer and explanation
Correct answer: A
Explanation
802.1X authentication relies on a secure EAP exchange between the access point, switch, and RADIUS server. A common oversight during configuration is mismatching the shared secret used to establish trust between the access point and the RADIUS server. Ensuring these values match is critical for successful authentication.
- A. Correct.
A mismatched shared secret between the access point and the RADIUS server is a common cause of 802.1X authentication failures. The shared secret must be identical on both the RADIUS server and the access point for authentication to succeed.
- B. Incorrect.
While it is necessary for the switch port to support 802.1X, this would generally result in the port being disabled rather than an authentication failure if improperly configured.
- C. Incorrect.
The IP address configuration (static or DHCP) of the access point is not directly related to 802.1X authentication. This option is irrelevant in this context.
- D. Incorrect.
RADIUS servers typically authenticate devices using credentials or certificates, not the MAC address, unless MAC Authentication Bypass (MAB) is specifically configured. MAB is not part of 802.1X authentication.