RFC 3580

IEEE 802.1X Remote Authentication Dial In User Service (RADIUS) Usage Guidelines
Standards Track
September 2003
RFC Library > Diameter & AAA > RFC 3580
Abstract: This document provides guidelines for the use of RADIUS in IEEE 802.1X environments, covering VLAN assignment, filter assignment, session management, and key distribution. Defines how RADIUS attributes are used with 802.1X authenticators for wired and wireless LAN access control.
Canonical source: https://www.rfc-editor.org/rfc/rfc3580  |  IETF Datatracker

Overview

▶

RFC 3580 provides operational guidelines for using RADIUS with IEEE 802.1X port-based network access control. It addresses real-world deployment scenarios including VLAN assignment, filter-ID usage, session timeout, and the interaction between 802.1X and RADIUS in both wired Ethernet and wireless LAN environments.

For 3GPP, this is relevant to WLAN interworking scenarios where enterprise or carrier-grade Wi-Fi networks use 802.1X with EAP-AKA/EAP-AKA' for UE authentication.

RADIUS Attributes for 802.1X

▶
Attribute Access-Req Access-Accept Usage
User-Name ✓ — Supplicant identity (NAI for 3GPP)
NAS-IP-Address ✓ — Authenticator IP address
NAS-Port-Type ✓ — 15=Ethernet, 19=Wireless-802.11
Tunnel-Type — ✓ 13=VLAN for dynamic VLAN assignment
Tunnel-Medium-Type — ✓ 6=IEEE-802 for VLAN
Tunnel-Private-Group-ID — ✓ VLAN ID to assign
Session-Timeout — ✓ Re-authentication interval
Termination-Action — ✓ 1=RADIUS-Request for re-auth

VLAN Assignment

▶

Dynamic VLAN assignment allows the RADIUS server to place authenticated users onto specific VLANs based on their identity or group membership. The Tunnel-Type, Tunnel-Medium-Type, and Tunnel-Private-Group-ID attributes work together to specify the target VLAN.

3GPP use case: In carrier WLAN deployments, RADIUS-based VLAN assignment segregates 3GPP-authenticated traffic from guest traffic, directing it toward the EPC/5GC for mobility management.

Session Management

▶
  • Session-Timeout: Forces periodic re-authentication, critical for updating keying material and verifying continued authorization
  • Termination-Action: When set to RADIUS-Request (1), the authenticator performs re-authentication rather than disconnecting when the session times out
  • Acct-Interim-Interval: Configures periodic accounting updates during the session

Key Management Integration

▶

802.1X uses the keying material derived from EAP (MSK) to generate the 4-way handshake keys for WPA2/WPA3. The RADIUS server delivers the MSK via MS-MPPE-Recv-Key and MS-MPPE-Send-Key attributes, which the authenticator uses as the Pairwise Master Key (PMK).