Site Infrastructure requires 802.1x authentication.

Products

• VMware vSphere ESXi

Issue/Introduction

• Physical Infrastructure requires 802.1x authentication from all network devices including ESXi hosts, VMkernel adapters, and vSphere Distributed Switch (vDS) uplinks
• VMware ESXi hosts do not include a native 802.1X supplicant. Consequently, an ESXi host cannot natively authenticate to a secure network fabric using 802.1X EAPOL frames for its physical uplinks (vmnics) or VMkernel adapters (vmk0, vSAN, vMotion, etc.).

Environment

VMware ESXi

Cause

This is an architectural limitation of the vSphere networking stack. Broadcom documentation and the vSphere Standard/Distributed Switch designs do not include an active 802.1X supplicant capability for the ESXi host itself.

Resolution

To accommodate an ESXi host on a network fabric utilizing 802.1x, the switchport security architecture must be modified on the physical switch:

• MAC Authentication Bypass (MAB): The physical switch ports connected to the ESXi uplinks must bypass standard 802.1X authentication. The MAC addresses of the ESXi physical NICs and VMkernel adapters must be explicitly whitelisted within the authentication server's endpoint database (e.g., Cisco ISE).
  • Whitelist the MAC addresses of all ESXi physical NICs and VMkernel adapters

• Multi-Auth Host Mode: If guest Virtual Machines require 802.1X authentication, the vSphere switch (vSS or vDS) will transparently pass the EAPOL frames from the guest OS to the physical switch. The physical switch port must be configured in multi-auth mode to allow individual VMs to authenticate while the ESXi host relies on MAB.

• Authentication Timers and Priority: To prevent network isolation delays for the ESXi management interface during host boot sequences or uplink link-state toggles, the authentication priority and timers must be tuned:
  • Set the switch port to attempt MAB prioritization, or reduce the standard 802.1X timeout (TxPeriod) thresholds. Standard 802.1X timeouts can delay the MAB fallback process, which can disrupt vCenter Server connectivity, NSX overlay initialization, or vSphere High Availability (HA) host isolation response mechanisms.