Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
ON THIS PAGE
 

RADIUS-Based IP Tracking for Static IP 802.1X Hosts

Learn how the device tracks the MAC-to-IP binding for 802.1X-authenticated hosts with static IP addresses, using on-box IP learning instead of DHCP snooping-and reports the learned IPv4 address to AAA and policy systems via the RADIUS Framed-IP-Address attribute in Accounting-Start, Interim-Update, and Accounting-Stop messages.

In environments where DHCP snooping is unavailable or endpoints use static IP addressing, you can still provide IP context to authentication, authorization, and accounting (AAA) and policy systems by using RADIUS accounting with 802.1X. The device tracks the authenticated supplicant MAC-to-IP binding by using available on-box IP learning sources and includes the learned IPv4 address in RADIUS accounting records as attribute 8 (Framed-IP-Address). The device can send the attribute in Accounting-Start, Accounting-Stop, and periodic Interim-Update messages as the session state changes.

If multiple IPv4 addresses or learning sources exist for the same authenticated MAC address, the device applies deterministic selection so the RADIUS server receives consistent per-session IP attribution. When DHCP snooping data is present, the device prefers that binding. Otherwise, the device uses the most recently learned IPv4 address.

Benefits

  • Provides authenticated session IP context to AAA and policy systems when DHCP snooping tables are unavailable or empty (for example, when endpoints use static IP addresses).

  • Improves per-user and per-device auditing by associating an IPv4 address with the 802.1X accounting session.

  • Supports event correlation across systems (RADIUS, security information and event management (SIEM), and policy engines) by combining a stable session identifier with the learned IPv4 address in accounting updates.

  • Reduces ambiguity when an endpoint address changes or when the device learns multiple addresses by updating the RADIUS server through interim accounting updates.

  • Ensures predictable IP attribution when learning sources disagree by applying source preference rules (prefer DHCP snooping when present; otherwise use the most recently learned IPv4 address).

How it works

When you enable 802.1X access control and RADIUS accounting, the device can include the authenticated endpoint IPv4 address in RADIUS accounting as attribute 8 (Framed-IP-Address). The device learns a MAC-to-IP binding for the supplicant from supported on-box IP learning mechanisms and associates that binding with the active 802.1X session. The RADIUS server then receives accounting records that include both session identity and endpoint IPv4 address, which supports correlation, logging, and policy workflows in environments that use static addressing or do not populate DHCP snooping tables.

The device adds Framed-IP-Address to Accounting-Start, Accounting-Stop, and Interim-Update messages after it learns an IPv4 address and attaches it to the session state. If the device has not learned an IPv4 address for the supplicant, the accounting stream does not include attribute 8. In that case, the RADIUS server relies on other attributes until the device learns an IPv4 address and sends a subsequent accounting update.

If the device learns multiple IPv4 addresses or conflicting bindings for the same authenticated MAC address, it selects a single address to keep accounting attribution consistent. If multiple IPv4 addresses are learned for one MAC address, the device uses the most recently learned IPv4 address as the session address. If DHCP snooping and another learning source both provide bindings for the same MAC address with different IPv4 values, the device prefers the DHCP snooping IPv4 address and reflects that value in subsequent accounting messages.

Operational notes and prerequisites

To use this behavior, configure 802.1X authentication on the access interface and enable RADIUS accounting so the device sends Accounting-Start and Accounting-Stop records and generates Interim-Update messages according to your accounting configuration.

Ensure your design enables at least one supported MAC-to-IP learning mechanism so the device can learn the endpoint IPv4 address after authentication. Without a learned binding, the device cannot export an IPv4 value in Framed-IP-Address.

To validate operation, check RADIUS server logs or packet captures for accounting records that include attribute 8, and confirm that the value updates when the device learns new MAC-to-IP information and applies source preference rules when DHCP snooping data becomes available.