Explains how 802.1X authentication secures Ethernet ports in vehicle ground access scenarios by validating hardware and managing access through industry-standard protocols.

802.1X authentication on Ethernet ports is a security mechanism designed for vehicle devices that

Validates wired clients through a centralized RADIUS server.
Ensures that only authenticated hardware gains access to network resources.
Secures Ethernet LAN ports in industrial vehicle-to-ground deployment scenarios.

Key features

Authenticating 802.1X on an Ethernet port provides these benefits:

Prevents unauthorized devices from accessing the network by requiring authentication before allowing data traffic on the Ethernet port.
You can validate client credentials using industry-standard protocols such as PEAP, EAP-TLS, and EAP-FAST.
Tailored for Vehicle Ground Access scenarios, including robotic or autonomous vehicle fleets, where physical port security is critical.

Table 1. Hardware and software compatibility
Attribute	Requirement
Software Release	26.2.1 or later
Operating Mode	Wireless Backhaul (URWB)
Hardware Models	Supported on all URWB-capable Cisco Catalyst and Industrial Wireless (IW) series PIDs
Configuration	Managed via Wireless Backhaul Network Profile

Guidelines and limitations

Before you configure 802.1X on Ethernet ports, follow these guidelines:

Only one wired client per LAN port is supported in this release.
Multiple clients behind a single LAN port (e.g., via a switch) are not supported
Authentication protocols supported are limited to PEAP, EAP-TLS, and EAP-FAST.
You can configure a maximum of two RADIUS servers.
The RADIUS server group can be configured only when the URWB mobility role is set to client.
IPv6 is not supported for RADIUS server group configurations.
Extended information parameters such as coa_port, retransmit, interim interval, and timeout are not supported.
The accounting mechanism is also not supported in this context.

Configure a RADIUS server and group

Configure a RADIUS server and group (CLI)

Define a RADIUS server and assign it to a server group to enable authentication services.

This configuration is a prerequisite for enabling 802.1x authentication on Ethernet ports.

Before you begin

Ensure you have the RADIUS server IPv4 address, authentication port, and shared secret (key).

Perform these steps to configure a RADIUS server and group.

Procedure

Use the configure terminal command to enter the global configuration mode.
Example:
```
Device# configure terminal
```
Use the RADIUS server radius_name command to initiate the RADIUS server configuration. Define the server name, IPv4 address, and shared secret.
Example:
```
Device(config)# radius server <radius-name>
```
Use the address ipv4 {ip-address | hostname}[auth-port port-number ] command to specify the server address and ports.
Example:
```
Device(config)# address ipv4 xx.x.x.xx auth-port 1812  
```
Use the key shared_secret command to set the shared secret.
Example:
```
Device(config)# key Cisco123!
```
Use the aaa group server group-name command to create a server group and assign the defined RADIUS server to it.
Example:
```
Device(config)# aaa group server radius <group-name>
```
Use the server name radius-name command to associate a RADIUS server with a RADIUS server group.
Example:
```
Device(config-sg-radius)# server name <radius-name>
```

The RADIUS server is configured and assigned to a server group, enabling authentication services for network devices.

Configure a RADIUS server and group (GUI)

Establish centralized authentication by configuring a RADIUS server and creating server groups for robust network security

Use this task before enabling 802.1x authentication on Ethernet ports. A properly configured RADIUS setup ensures that network devices authenticate users and devices through a central server.

Before you begin

Configure a RADIUS server and group before enabling the 802.1x authentication on Ethernet ports using this procedure.

Procedure

Navigate to Configuration > Security > AAA > Servers/Groups
Under the RADIUS > Servers tab and click Add, define the Server name, IPv4 address, shared secret, and authentication port
Under the RADIUS > Server Groups tab and click Add, name the group and add the previously created RADIUS server to the assigned list.

The device is ready to use the configured RADIUS server and group for authentication processes across network interfaces.

Enable 802.1x authentication on Ethernet ports

Enable 802.1X authentication on Ethernet ports (CLI)

Enable 802.1X authentication for Ethernet LAN ports to enforce secure network access for wired clients.

This task enforces network access control for wired clients (such as robots or onboard controllers) by requiring authentication via a RADIUS server before permitting network access.

Before you begin

Ensure the backhaul network is established.
Have your RADIUS server IP, port, and shared secret ready.
Verify the wired client supports PEAP, EAP-TLS, or EAP-FAST.

To enable 802.1X authentication on Ethernet ports, perform these steps

Procedure

Use the configure terminal and enter the global configuration mode.
Example:
```
Device# configure terminal
```
Use the wireless profile urwb urwb-profile_name command to access the wireless backhaul network profile.
Example:
```
Device(config)# wireless profile urwb <urbw-profile_name>
```
Use the local-auth radius-server-group radius-server-group_name command to add the RADIUS server group to the profile.
Example:
```
Device(config-wireless-urwb-profile)# local-auth radius-server-group <radius-group-name>
```
To remove the RADIUS server group association, use the no local-auth radius-server-group <radius-server-group_name> command.
Use the end write memory command to exit configuration mode and save your settings.
Example:
```
Device(config-wireless-urwb-profile)# end
```
Use the show ap name ap_name urwb info command to confirm that the RADIUS server details and port settings are correctly pushed to the AP.
Example:
```
Device# show ap name <ap_name> urwb info
```
Verify the status of the secondary Ethernet port if the client is connected to port 1.

802.1X authentication is enabled on the specified Ethernet port. Wired clients connecting to this port must successfully authenticate via the configured RADIUS server before gaining network access.

Enable 802.1X authentication on Ethernet ports (GUI)

Enable port-based authentication for wired clients. This ensures that only authorized devices can connect to the network.

802.1X authentication provides port-based network access control for wired clients. The system enforces authentication before granting network access. You must associate the Ethernet ports with a RADIUS server group to handle authentication requests.

Before you begin

Ensure you have the RADIUS server IP address, port number, and shared secret.
Verify that the wired client supports one of the EAP methods: PEAP, EAP-TLS, or EAP-FAST.
Confirm that the RADIUS server is properly configured and reachable from the controller.

Procedure

Navigate to Configuration > Tags and Profiles > URWB Network Profile
Edit the URWB Network Profile and go to Wired Clients > Local Authentication > RADIUS Server Group
Choose your RADIUS Server Group
Click Update and Apply to Device

Wired clients must authenticate with the specified RADIUS server before accessing the network. Only authorized devices will be permitted, enhancing security for your wired infrastructure.

Troubleshoot RADIUS authentication with debug commands

Enable and disable debug commands to gain visibility into the authentication process, helping you pinpoint causes of RADIUS authentication failures.

RADIUS authentication issues may occur during device access via Ethernet ports. Debug commands provide detailed logs to assist in troubleshooting. Use these steps when authentication errors or unexpected network events occur.

Before you begin

Follow these steps to troubleshoot RADIUS authentication on Ethernet ports using debug commands:

Procedure

Use the debug urwb radius eth command to enable specific debugging levels.
Example:
```
Device# debug urwb radius eth {error | events | info | packet}
```
- error: Displays RADIUS authentication error messages.
- events: Logs authentication-related events.
- info: Provides informative authentication details.
- packet: Shows packet-level debugging output.

To disable the debugging, use the no form of the command.

Example:

Device# no debug urwb radius eth {error | events | info | packet}

Debug logs are generated based on the selected level, helping you identify RADIUS authentication problems on Ethernet ports.

Verify RADIUS authentication status on an AP

Ensure that wired client authentication on the AP is correctly configured and operating by checking RADIUS settings and active authentication tables.

Perform this task to maintain network security and troubleshoot authentication issues for wired clients by validating RADIUS configuration and monitoring active client authentication tables.

Before you begin

Ensure that RADIUS authentication is enabled for wired clients on the access point.

Follow these steps to verify RADIUS authentication and view wired client tables on the AP:

Procedure

Use the show urwb wired radius config command to display the current RADIUS configuration settings for the wired interface.
Example:
```
Device# show urwb wired radius config
```
Use the show urwb wired radius tables command to view the active RADIUS authentication tables, which contain information about the wired clients currently being processed or authenticated.
Example:
```
Device# show urwb wired radius tables
```

ou can review the RADIUS configuration and authentication tables, ensuring all settings are correct and wired clients are properly authenticated.

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.