Which switches do 802.1X properly, and which ignore re-authentication?

Passbeam works with any switch that does 802.1X with a RADIUS server. But switches differ in one thing that matters once a device is connected: whether they re-authenticate. This table is what we've measured on our own equipment.

Why re-authentication matters. A certificate is checked when a device connects. Revoking it stops the next connection, not one that's already up. So Passbeam asks the switch to check again on a timer, by sending Session-Timeout with Termination-Action = RADIUS-Request on every accept. If the switch does this, a revoked certificate is off the network within the hour. If it doesn't, the device keeps its access until the port goes down, and the dashboard can't show this. It shows the certificate as revoked while the device is still connected.

If a switch ignores the timer, suspending the person or device still works, but only from their next authentication. If that matters at a site, bounce the port to force a new authentication.

Check your own switches. Set a re-authentication interval on the client's Access rules, then count the accepts for one device in the authentication log over a few hours. You need at least two accepts to see an interval. If a device that's been connected all day has only one accept, that switch isn't re-authenticating.

Anything not in the table is almost certainly fine. The table lists the exceptions. See “Which switches and access points does Passbeam support?”.