Cisco APIC Security Configuration Guide, Release 6.2(x)

802.1X authentication modes

Updated: April 17, 2026

Want to summarize with AI?

Describes the EAP and MAB authentication modes that Cisco ACI uses to authenticate endpoints and control network access.

Cisco ACI 802.1X supports Extensible Authentication Protocol (EAP) as the primary authentication mode and MAC Authentication Bypass (MAB) as the fallback authentication mode.

Authentication mode behavior

Each authentication mode uses a different method to verify an endpoint.

Table 1. 802.1X authentication modes
Mode	Behavior
EAP	The authenticator sends an `EAP-Request/Identity` frame to request the supplicant's identity. The supplicant returns an `EAP-Response/Identity` frame.
MAB	If EAP authentication is unavailable, MAB provides fallback port-based access control using the endpoint's MAC address.

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.