How to authenticate endpoints lacking 802.1X supplicant support?
Short answer
A MAC Authentication Bypass
Question
Key Takeaways
The exam tests knowledge of 802.1X fallback methods; the common trap is confusing MAB with port security or WebAuth, which do not perform AAA server authentication in the same way.
When endpoints cannot run an 802.1X supplicant, MAC Authentication Bypass (MAB) allows the switch to authenticate the device against an AAA server using its source MAC address. The community unanimously confirms MAB as the correct fallback mechanism for non-802.1X-capable devices.
Common mistake: Option D (port security) is often chosen because it also uses MAC addresses, but port security only limits MAC learning on a port and does not authenticate against an AAA/RADIUS server.
Expert Analysis
Why the Answer Is Correct
MAC Authentication Bypass (MAB) sends the endpoint's source MAC address to a RADIUS/AAA server as the username and password when the device cannot participate in 802.1X EAP exchanges. The AAA server validates the MAC against its database and returns an accept or reject decision, effectively providing network access authentication without a supplicant. This makes MAB the standard Cisco-recommended fallback for printers, IP phones, and IoT devices that lack 802.1X support.
Why the Other Options Are Wrong
MACsec (B) provides link-layer encryption but does not perform authentication against an AAA server; it typically relies on 802.1X for key exchange. Private VLANs (C) isolate traffic within a VLAN but offer no authentication capability whatsoever. Port security (D) restricts which MAC addresses may use a switch port but operates locally on the switch and never communicates with a RADIUS/AAA server, so it cannot enforce centralized authentication.
Community Comment Notes
Comment [1] correctly highlights that MAB offers lower security than 802.1X because MAC addresses can be spoofed, and notes that WebAuth is another viable fallback for devices with a browser. Comment [2] provides a useful NetworkLessons reference for MAB configuration details. Comment [3] reinforces the unanimous community agreement on option A.
Official Reference
https://networklessons.com/cisco/ccie-routing-switching-written/mac-authentication-bypass-mab
This link opens the official vendor documentation in a new tab.
Exam Strategy
When a question mentions 'no supplicant' or 'non-802.1X endpoint,' immediately look for MAC Authentication Bypass or Web Authentication as the answer. Eliminate options that operate locally (port security, private VLANs) because the question explicitly requires AAA server authentication.
Community Votes
100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 3 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 3
-
chiacche 👍 2 Answered A1. MAC addresses can easily be spoofed, so MAB (MAC Authentication Bypass) offers lower security compared to 802.1X. 2. MAB must be configured on both the authenticator and the AAA server. 3. Web Authentication (WebAuth) can also serve as a fallback mechanism for 802.1X, especially for devices that do not support 802.1X but can display a web page.
-
nj1999 👍 2https://networklessons.com/cisco/ccie-routing-switching-written/mac-authentication-bypass-mab
-
cloud29 👍 3 Answered AIt's defintely A
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All 350-401 Questions
Access 218 questions with complete answers and detailed explanations.
View Full 350-401 Practice Test →