Design and triage campus 802.1X and MAB with ISE or ClearPass. Use when a port will not authorize, a phone+PC daisy-chain fails, or failed-open policy is being reviewed.
Installs into .claude/skills of the current project.
Are you the author of Campus Nac Dot1x?
Add the live security badge to your README. It updates with every re-scan.
[](https://www.skillsdirectory.com/skills/gesh75-campus-nac-dot1x)
---
name: campus-nac-dot1x
description: Design and triage campus 802.1X and MAB with ISE or ClearPass. Use when a port will not authorize, a phone+PC daisy-chain fails, or failed-open policy is being reviewed.
argument-hint: "[switch] [port]"
allowed-tools: Read Grep
license: MIT
---
# Campus NAC / 802.1X
Do not use for VPN or ZTNA. Not for firewall identity.
## Procedure
1. Host mode: multi-auth for phone+PC, single-host for servers. MAB only for known printers, with a static MAC group.
2. Failed-closed on access except for emergency failed-open that is time-bounded and logged.
3. dACL / SGT downloaded per session. Default VLAN is a quarantine, not corp.
4. Triage: `show auth sess`, RADIUS live logs, certificate SAN, clock skew.
5. Verify a known-good laptop, a phone, and a printer before calling the port done.
```text
interface Gi1/0/24
authentication host-mode multi-auth
authentication periodic
mab
dot1x pae authenticator
```
## Anti-patterns
- Never globally disable 802.1X to "get the auditor in".
- Do not MAB a user's laptop.
## Safety
Failed-open is an incident, not a workaround. Change-guard the template.
