Cisco APIC Security Configuration Guide, Release 6.2(x)

802.1X and RADIUS configuration

Updated: April 17, 2026

Want to summarize with AI?

Describes how Cisco APIC activates 802.1X and RADIUS processes and uses their configurations to authenticate endpoints on network interfaces.

802.1X and RADIUS configuration is a port-based authentication setup that associates an 802.1X-enabled interface with a reachable RADIUS server group.

This setup has these characteristics:

Cisco APIC starts the 802.1X and RADIUS processes only when the corresponding configurations are present.
You must enable 802.1X authentication on each interface that authenticates connected endpoints.
RADIUS server configuration is separate from 802.1X configuration.
Successful authentication requires both 802.1X and RADIUS configuration.

Configuration relationships

The 802.1X and RADIUS components interact in these ways:

Table 1. 802.1X and RADIUS configuration components
Component	Behavior
802.1X process	Cisco APIC starts the `dot1x` process when the 802.1X instance managed object is created.
RADIUS process	Cisco APIC starts the `radius` process when the RADIUS entity is created.
Interface authentication	802.1X authentication must be enabled on each interface that authenticates connected endpoints. Interfaces without 802.1X enabled retain their existing behavior.
RADIUS server configuration	Defines the RADIUS servers and the connectivity information that the system uses to reach them.
RADIUS group association	The 802.1X configuration references a configured RADIUS server group or the default RADIUS server group for authentication.

Note

You can configure 802.1X and RADIUS in either order. However, 802.1X authentication cannot succeed until both configurations are complete.

Configure 802.1X port authentication using the Cisco APIC GUI

The host mode in an 802.1X port authentication policy determines how the system authenticates endpoints that connect through the associated leaf access ports.

Before you begin

Configure a RADIUS provider policy before you begin.

Procedure

On the menu bar, choose Fabric > External Access Policies > Policies > Interface > 802.1X Port Authentication.
Right-click 802.1X Port Authentication, and choose Create 802.1X Port Authentication Policy.

The Create 802.1X Port Authentication Policy dialog box appears.
In the Name field, enter a name for the policy.

From the Host Mode drop-down list, choose a host mode.

The available host modes provide these authentication behaviors:

Table 2. Host modes
Mode	Description
Multi Auth	Allows multiple endpoints and authenticates each endpoint separately. All endpoints must use the same EPG and VLAN information.
Multi Domain	Provides separate data and voice domains, typically for a port that connects an IP phone and a data endpoint.
Multi Host	Allows multiple endpoints but authenticates only the first endpoint.
Single Host	Allows one endpoint on the port.

If an endpoint does not support 802.1X, from the MAC Auth drop-down list, choose EAP_FALLBACK_MAB.

This option uses MAC Authentication Bypass (MAB) as the fallback authentication method.
Click Submit.

The 802.1X port authentication policy is created.
Choose Fabric > External Access Policies > Interfaces > Leaf Interfaces > Policy Groups > Leaf Access Port.
Right-click Leaf Access Port, and choose Create Leaf Access Port Policy Group.

The Create Leaf Access Port Policy Group dialog box appears.
In the Name field, enter a name for the policy group.
From the 802.1X Port Authentication Policy drop-down list, choose the policy that you created.
Click Submit.

The 802.1X port authentication policy is associated with the leaf access port policy group.

Configure 802.1X node authentication using the Cisco APIC GUI

The node authentication policy defines the EPG and VLAN that the system uses when authentication fails. Associate the policy with a leaf switch policy group to deploy it to the required switches.

Before you begin

Configure a RADIUS provider policy before you begin.

Procedure

On the menu bar, choose Fabric > External Access Policies > Policies > Switch > 802.1X Node Authentication.
Right-click 802.1X Node Authentication, and choose Create 802.1X Node Authentication Policy.

The Create 802.1X Node Authentication Policy dialog box appears.
In the Name field, enter a name for the policy.
In the Failed-auth EPG field, select the tenant, application profile, and EPG to use when authentication fails.
In the Failed-auth VLAN field, select the VLAN to use when authentication fails.
Click Submit.

The 802.1X node authentication policy is created.
Choose Fabric > External Access Policies > Switches > Leaf Switches > Policy Groups.
Right-click Policy Groups, and choose Create Access Switch Policy Group.

The Create Access Switch Policy Group dialog box appears.
In the Name field, enter a name for the leaf switch policy group.
From the 802.1X Node Authentication Policy drop-down list, choose the node authentication policy that you created.
Click Submit.

The node authentication policy is associated with the leaf switch policy group.
Choose Fabric > External Access Policies > Interfaces > Leaf Interfaces > Profiles.
Right-click Profiles, and choose Create Leaf Interface Profile.

The Create Leaf Interface Profile dialog box appears.
In the Name field, enter a name for the leaf interface profile.
Expand the Interface Selectors table, and create an access port selector.

The Create Access Port Selector dialog box appears.
In the Create Access Port Selector dialog box, enter a selector name and the interface IDs.
From the Interface Policy Group drop-down list, choose the interface policy group that you want to assign.
Click OK.
Click Submit.

The 802.1X node authentication policy is associated with the leaf switch policy group, and the interface policy group is assigned to the selected leaf interfaces.

Configure 802.1X port authentication using the NX-OS-style CLI

This example applies the multi-host host mode to Ethernet interfaces 1/10 through 1/12 on leaf switch 101.

Before you begin

Configure a RADIUS provider policy before you begin.

Procedure

Configure the 802.1X port authentication policy in a policy group:

Example:

apic1# configure
                        apic1(config)# template policy-group mypol
                        apic1(config-pol-grp-if)# switchport port-authentication mydot1x
                        apic1(config-port-authentication)# host-mode multi-host
                        apic1(config-port-authentication)# no shutdown
                        apic1(config-port-authentication)# exit
                        apic1(config-pol-grp-if)# exit

Configure a leaf interface profile and assign the policy group to the required interfaces:

Example:

apic1(config)# leaf-interface-profile myprofile
                        apic1(config-leaf-if-profile)# leaf-interface-group mygroup
                        apic1(config-leaf-if-group)# interface ethernet 1/10-12
                        apic1(config-leaf-if-group)# policy-group mypol
                        apic1(config-leaf-if-group)# exit
                        apic1(config-leaf-if-profile)# exit

Add the required leaf switch to a leaf group:

Example:

apic1(config)# leaf-profile myleafprofile
                        apic1(config-leaf-profile)# leaf-group myleafgrp
                        apic1(config-leaf-group)# leaf 101
                        apic1(config-leaf-group)# exit

Associate the leaf interface profile with the leaf profile:

Example:

apic1(config-leaf-profile)# leaf-interface-profile myprofile
                        apic1(config-leaf-profile)# exit

The 802.1X port authentication policy group is applied to Ethernet interfaces 1/10 through 1/12 on leaf switch 101.

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.