The architecture separates the endpoint seeking access, the network device controlling the port, and the system that evaluates the authentication exchange and policy.
The endpoint, often called a supplicant or peer, exchanges Extensible Authentication Protocol (EAP) messages with an authenticator such as a switch or wireless access point. The authenticator may evaluate a method locally, but commonly relays the exchange to a backend authentication server using an AAA protocol such as RADIUS. Policy can then deny access or assign a permitted network segment and other controls.
Key points
Endpoint rolePresents an identity and participates in an EAP method, which may use certificates, passwords within a protected tunnel, or another supported credential.
Authenticator roleControls the logical port and passes EAP messages or locally performs authentication; it is not necessarily the system that validates the credential.
Backend roleValidates the EAP exchange and returns an outcome and, where supported, authorization attributes to the authenticator.
Important limitationSuccessful 802.1X authentication is an admission decision, not proof that the endpoint is healthy or subsequent traffic is safe. Data protection requires appropriate wireless security or link encryption, and continuing access still needs segmentation and monitoring.