Which Action Configures 802.1X Flexible Authentication for Layer 3 Methods?
Which action configures the iEEE 802.1X Flexible Authentication feature to support Layer 3 authentication mechanisms?
Community Insight
The exam tests whether you can map each 802.1X Flexible Authentication method to its OSI layer; the trap is assuming MAB or a VPN-side dot1x tweak provides Layer 3 authentication, when both dot1x and MAB are strictly Layer 2.
Cisco's 802.1X Flexible Authentication supports three methods — dot1x, MAB and WebAuth — and only WebAuth is a Layer 3 mechanism. This page explains why enabling WebAuth redirection (option D) is the action that satisfies a Layer 3 authentication requirement.
Many candidates pick MAB (option C) thinking that MAB 'bypasses' 802.1X and therefore hands authentication up to a Layer 3 device — but MAB is itself a Layer 2 method and only identifies endpoints by MAC address.
Community Discussion (8 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Cisco's IEEE 802.1X Flexible Authentication feature lets a single switch port run an ordered set of authentication methods: dot1x, MAB and webauth. In the Cisco IOS XE documentation, dot1x is described as a Layer 2 method, MAB as a Layer 2 method, and only webauth — HTTP/HTTPS redirection of the host to a web portal — is described as a Layer 3 method. Therefore, to support Layer 3 authentication mechanisms under Flexible Authentication, you must configure WebAuth so the host is redirected to a web page for credential entry (option D). The web portal exchange happens over IP after the host has obtained an address, which is precisely what makes it Layer 3 rather than a Layer 2 EAP exchange. Enabling WebAuth in the authentication method list completes the fallback chain that Flexible Authentication is designed to provide.Why the Other Options Are Wrong
Option A is a distractor built from a different product domain: 802.1X Flexible Authentication is a switch-port feature, not a VPN server setting, and there is no 'Dot1x configuration on the VPN server' that sends Layer 3 authentications to an external database. Option B describes the prerequisite of identifying non-802.1X-capable devices and letting them pass Layer 2 authentication — that is what MAB does, and it is still Layer 2, so it cannot satisfy a Layer 3 requirement. Option C misreads MAB as a redirection mechanism to a Layer 3 device; MAB simply learns the MAC address and queries the AAA server, and the Cisco documentation explicitly classifies MAB as a Layer 2 method. Comments from learners such as madboy2 argue for MAB on the assumption it redirects hosts, which is not how MAB works.Community Comment Notes
Consensus among commenters lands firmly on WebAuth. klu16 quotes the documentation directly, noting that "webauth--Web authentication is a Layer 3 authentication method" while dot1x and MAB are both Layer 2. Premium_Pils links the Cisco configuration guide and summarizes the same point, and KnightHeart's short verdict — "Only D is layer 3" — captures the discriminator the exam is testing. ITVI adds a useful nuance: the phrase 'flex authentication' implies an ordered method list where WebAuth must be configured so the Layer 2 attempts can fall through to a Layer 3 portal. luismg reinforces this by pointing out that WebAuth in Cisco Web Authentication is tunneled at Layer 3.Official Reference
Exam Strategy
When a question names an OSI layer, immediately classify every technology in the options by layer before reading the scenario details — dot1x and MAB are Layer 2, WebAuth is Layer 3. If an option describes configuration on a device that does not own the feature (for example a VPN server for a switch-port feature), eliminate it fast.
Frequently Asked Questions
Why is MAB not the Layer 3 method in 802.1X Flexible Authentication?
MAB authenticates an endpoint by its MAC address in the Layer 2 frame exchange, so Cisco classifies it as a Layer 2 method. It identifies devices but does not redirect them to an IP-based portal.
How does WebAuth provide Layer 3 authentication on a switch port?
After the host receives an IP address, it is redirected by HTTP/HTTPS to a web portal where the user submits credentials, so the authentication traffic is IP-based Layer 3 rather than an EAPoL exchange.