300-715 · Question #78
By default, which traffic does an 802.IX-enabled switch allow before authentication?
The correct answer is D. traffic permitted in the default ACL on the switch. Before successful 802.1X authentication, a switch port in an 802.1X-enabled environment typically permits only traffic explicitly allowed by a pre-authentication ACL, often referred to as a default ACL or access list on the switch, to facilitate the authentication process.
Question
By default, which traffic does an 802.IX-enabled switch allow before authentication?
Options
- Aall traffic
- Bno traffic
- Ctraffic permitted in the port dACL on Cisco ISE
- Dtraffic permitted in the default ACL on the switch
How the community answered
(45 responses)- A2% (1)
- B2% (1)
- D96% (43)
Why each option
Before successful 802.1X authentication, a switch port in an 802.1X-enabled environment typically permits only traffic explicitly allowed by a pre-authentication ACL, often referred to as a default ACL or access list on the switch, to facilitate the authentication process.
Allowing all traffic before authentication would bypass the security purpose of 802.1X.
Allowing no traffic would prevent the client from obtaining an IP address via DHCP or communicating with the authentication server (ISE), making authentication impossible.
A dACL (downloadable ACL) is applied after successful authentication or as part of a guest or limited access policy, not as the default pre-authentication filter.
By default, an 802.1X-enabled switch port operates in an 'unauthorized' state prior to successful authentication, applying a pre-authentication ACL configured locally on the switch. This ACL allows only specific traffic, such as DHCP, DNS, and EAP, to enable the client to obtain an IP address and communicate with the authentication server.
Concept tested: 802.1X pre-authentication access control
Source: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3750/software/release/12-2_55_se/configuration/guide/scg/sw8021x.html
Topics
Community Discussion
No community discussion yet for this question.