Which Action Configures 802.1X Flexible Authentication for Layer 3 Methods?

350-701 By islever Editorial Last updated

Configure network access control mechanisms such as 802.1X and MAB with Cisco Identity Services Engine

Short answer

D Configure WebAuth so hosts are redirected to a web page — WebAuth is the only Layer 3 method in 802.1X Flexible Authentication.

Question

Which action configures the iEEE 802.1X Flexible Authentication feature to support Layer 3 authentication mechanisms?
  1. Modify the Dot1x configuration on the VPN server to send Layer 3 authentications to an external authentication database.
  2. Identify the devices using this feature and create a policy that allows them to pass Layer 2 authentication.
  3. Add MAB into the switch to allow redirection to a Layer 3 device for authentication.
  4. Configure WebAuth so the hosts are redirected to a web page for authentication. Correct Answer

Key Takeaways

The exam tests whether you can map each 802.1X Flexible Authentication method to its OSI layer; the trap is assuming MAB or a VPN-side dot1x tweak provides Layer 3 authentication, when both dot1x and MAB are strictly Layer 2.

Cisco's 802.1X Flexible Authentication supports three methods — dot1x, MAB and WebAuth — and only WebAuth is a Layer 3 mechanism. This page explains why enabling WebAuth redirection (option D) is the action that satisfies a Layer 3 authentication requirement.

Common mistake: Many candidates pick MAB (option C) thinking that MAB 'bypasses' 802.1X and therefore hands authentication up to a Layer 3 device — but MAB is itself a Layer 2 method and only identifies endpoints by MAC address.

Expert Analysis

Why the Answer Is Correct

Cisco's IEEE 802.1X Flexible Authentication feature lets a single switch port run an ordered set of authentication methods: dot1x, MAB and webauth. In the Cisco IOS XE documentation, dot1x is described as a Layer 2 method, MAB as a Layer 2 method, and only webauth — HTTP/HTTPS redirection of the host to a web portal — is described as a Layer 3 method. Therefore, to support Layer 3 authentication mechanisms under Flexible Authentication, you must configure WebAuth so the host is redirected to a web page for credential entry (option D). The web portal exchange happens over IP after the host has obtained an address, which is precisely what makes it Layer 3 rather than a Layer 2 EAP exchange. Enabling WebAuth in the authentication method list completes the fallback chain that Flexible Authentication is designed to provide.

Why the Other Options Are Wrong

Option A is a distractor built from a different product domain: 802.1X Flexible Authentication is a switch-port feature, not a VPN server setting, and there is no 'Dot1x configuration on the VPN server' that sends Layer 3 authentications to an external database. Option B describes the prerequisite of identifying non-802.1X-capable devices and letting them pass Layer 2 authentication — that is what MAB does, and it is still Layer 2, so it cannot satisfy a Layer 3 requirement. Option C misreads MAB as a redirection mechanism to a Layer 3 device; MAB simply learns the MAC address and queries the AAA server, and the Cisco documentation explicitly classifies MAB as a Layer 2 method. Comments from learners such as madboy2 argue for MAB on the assumption it redirects hosts, which is not how MAB works.

Community Comment Notes

Consensus among commenters lands firmly on WebAuth. klu16 quotes the documentation directly, noting that "webauth--Web authentication is a Layer 3 authentication method" while dot1x and MAB are both Layer 2. Premium_Pils links the Cisco configuration guide and summarizes the same point, and KnightHeart's short verdict — "Only D is layer 3" — captures the discriminator the exam is testing. ITVI adds a useful nuance: the phrase 'flex authentication' implies an ordered method list where WebAuth must be configured so the Layer 2 attempts can fall through to a Layer 3 portal. luismg reinforces this by pointing out that WebAuth in Cisco Web Authentication is tunneled at Layer 3.

Official Reference

https://www.cisco.com/en/US/docs/ios-xml/ios/sec_usr_8021x/configuration/15-2mt/sec-ieee-802x-fa.html

This link opens the official vendor documentation in a new tab.

Exam Strategy

When a question names an OSI layer, immediately classify every technology in the options by layer before reading the scenario details — dot1x and MAB are Layer 2, WebAuth is Layer 3. If an option describes configuration on a device that does not own the feature (for example a VPN server for a switch-port feature), eliminate it fast.

Frequently Asked Questions

Why is MAB not the Layer 3 method in 802.1X Flexible Authentication?

MAB authenticates an endpoint by its MAC address in the Layer 2 frame exchange, so Cisco classifies it as a Layer 2 method. It identifies devices but does not redirect them to an IP-based portal.

How does WebAuth provide Layer 3 authentication on a switch port?

After the host receives an IP address, it is redirected by HTTP/HTTPS to a web portal where the user submits credentials, so the authentication traffic is IP-based Layer 3 rather than an EAPoL exchange.

More 350-701 FAQ →

Discussion 8 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 8

  1. KnightHeart 👍 3 Answered D
    Only D is layer 3
  2. klu16 👍 2
    A & C are Layer 2. IEEE 802.1X Flexible Authentication Methods The IEEE 802.1X Flexible Authentication feature supports three authentication methods: dot1X--IEEE 802.1X authentication is a Layer 2 authentication method. mab--MAC-Authentication Bypass is a Layer 2 authentication method. webauth--Web authentication is a Layer 3 authentication method. So, it's D imo.
  3. ITVI 👍 2 Answered D
    Keyword is 'flex authentication' so you need to setup WebAuth even if you have MAB, EAP, etc. to work, then after that it sends to WebAuth. So yeah, you need WebAuth configured. so answer D is correct.
  4. Premium_Pils 👍 2 Answered D
    https://www.cisco.com/en/US/docs/ios-xml/ios/sec_usr_8021x/configuration/15-2mt/sec-ieee-802x-fa.html WebAuth is Layer 3, the rest is layer 2.
  5. madboy2 👍 1 Answered C
    The IEEE 802.1X Flexible Authentication feature allows for Layer 3 authentication mechanisms (such as web-based or other IP-based mechanisms) in addition to the standard Layer 2 authentication. By configuring MAC Authentication Bypass (MAB), devices that cannot support 802.1X can be redirected to Layer 3 authentication methods such as web authentication or other external methods. 🔹 MAB is used to redirect devices to a Layer 3 device (like a web server or a different authentication service) for authentication when 802.1X authentication fails (or when the device cannot perform Layer 2 authentication). This action is especially useful when integrating non-802.1X-capable devices into a secure network environment where they must be authenticated using Layer 3 mechanisms.
Show 3 more comments
  1. XBfoundX 👍 1 Answered D
    IEEE 802.1X Flexible Authentication Methods The IEEE 802.1X Flexible Authentication feature supports three authentication methods: dot1X--IEEE 802.1X authentication is a Layer 2 authentication method. mab--MAC-Authentication Bypass is a Layer 2 authentication method. webauth--Web authentication is a Layer 3 authentication method.
  2. Premium_Pils 👍 1
    https://www.cisco.com/en/US/docs/ios-xml/ios/sec_usr_8021x/configuration/15-2mt/sec-ieee-802x-fa.html I agree with klu16, only WebAuth is layer 3, so I go for D.
  3. luismg 👍 1
    WebAuth in CWA is Layer 3 tunneled.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

What Is a Feature of an Endpoint Detection and Response Solution?

S-grade

Which Two Methods Belong in an AAA Authentication Method List?

S-grade

Preventing Unauthorized DHCP Servers on Cisco Switches

S-grade

What Is Considered a Cloud Data Breach in Cisco 350-701?

S-grade

← Back to 350-701 Study Guide