Wired 802.1X AP Authentication - Network as Code Datamodels

This repository contains Infrastructure as Code (IaC) datamodels for implementing standardized wired 802.1X authentication for Cisco Access Points (APs) using Network as Code with Terraform.

Overview

This solution implements the configuration described in Cisco's Techzone Article: Standardize Wired 802.1X AP

The datamodels provision both the network infrastructure (switches) and the authentication infrastructure (Cisco Identity Services Engine) to enable secure wired 802.1X authentication for Access Points.

Key Features

• Automated AAA Configuration: RADIUS server groups, authentication methods, and accounting
• 802.1X Policy Enforcement: Control plane policies with fallback to MAB (MAC Authentication Bypass)
• Dynamic Authorization: RADIUS CoA (Change of Authorization) support
• Flexible AP Deployment: Support for both FlexConnect trunk and multi-auth access port configurations
• ISE Integration: Complete ISE policy sets, authorization profiles, and network device registration
• Critical Authentication: Fallback authentication for AAA server unavailability

Architecture Components

Switch Configuration (switch/datamodel/)

• AAA (aaa.nac.yaml): RADIUS server configuration, authentication/authorization/accounting policies
• Templates (templates.nac.yaml, policy.nac.yaml): Interface templates for different AP deployment models
• Interfaces (interface.nac.yaml): Interface group configurations with 802.1X enforcement
• Variables (variables.nac.yaml): Environment-specific variables
• Devices (devices.nac.yaml): Target switch device definitions

ISE Configuration (ise/)

• Network Devices: Registers switches as RADIUS clients
• Policy Sets: Authentication and authorization policies for wired 802.1X
• Allowed Protocols: EAP methods including EAP-FAST with anonymous PAC provisioning
• Authorization Profiles: Interface templates for AP trunk and access port configurations

Prerequisites

• Terraform >= 1.0
• Cisco IOS-XE switches (Catalyst 9000 series recommended)
• Cisco Identity Services Engine (ISE) 3.x or later
• Network connectivity between switches and ISE
• RADIUS shared secret

Switch prerequisites (example CLI)

Before running Terraform, ensure each switch has the following configured:

aaa new-model
aaa authentication login default local
aaa authorization exec default local

netconf-yang
netconf-yang feature candidate-datastore

username <admin_user> privilege 15 secret <strong_password>

• The NETCONF/YANG feature is required by the IOS-XE Terraform provider.
• Create an admin user with privilege 15 for Terraform/provider access (use a strong password).

ISE prerequisites

1. Navigate to Administration -> Settings -> API Settings.
2. Under API Service Settings, enable ERS (Read/Write) and Open API (Read/Write).
3. Create an ERS API admin user with Read/Write privileges (this account will be used by the Terraform provider).
4. Click Save.

• Ensure the ERS/Open API user credentials are available in your environment (for example, via the .env file) so Terraform can authenticate to ISE.

Repository Structure

.
├── switch/
│   ├── datamodel/
│   │   ├── aaa.nac.yaml           # AAA and RADIUS configuration
│   │   ├── interface.nac.yaml     # Interface group templates
│   │   ├── policy.nac.yaml        # Control plane policies
│   │   ├── templates.nac.yaml     # Interface templates
│   │   ├── variables.nac.yaml     # Variable definitions
│   │   └── devices.nac.yaml       # Switch device inventory
│   └── main.tf                    # Terraform main file
│
├── ise/
│   ├── ise.nac.yaml               # ISE configuration
│   └── main.tf                    # Terraform main file
│
├── .env                           # Environment variables (not committed)
├── LICENSE.md
└── README.md

Environment Variables

Create a .env file in the repository root with the following variables:

# RADIUS Configuration
RADIUS_SHARED_SECRET=your_radius_secret

# AP Credentials (for 802.1X authentication)
AP_USERNAME=ap_username
AP_PASSWORD=ap_password

Switch Specific Variables

Modify variables in switch/datamodel/variables.nac.yaml to match your environment:

# Switch configuration variables

ISE01: 10.10.10.100
DEFAULT_ACCESS_VLAN=1
AP_TRUNK_NATIVE_VLAN=799
CRITICAL_AUTH_VLAN=999

Usage

1. Deploy Switch Configuration

cd switch
terraform init
terraform plan
terraform apply

2. Deploy ISE Configuration

cd ise
terraform init
terraform plan
terraform apply

3. Verify Authentication

On the switch, verify 802.1X sessions:

show authentication sessions
show authentication sessions interface GigabitEthernet1/0/1 details
show dot1x all

On ISE, check RADIUS live logs for authentication attempts.

References

• Cisco: Standardize Wired 802.1X AP
• NetAsCode Documentation
• Cisco IOS-XE Terraform Provider
• Cisco ISE Terraform Provider

License

Check the LICENSE file attached to the project for details.

Contributing

This repository is maintained for lab validation purposes. For production deployments, review and adjust configurations according to your organization's security and network requirements.