Experimental Implementation of Network Access Control with Dynamic VLAN Assignment Using Active Directory, Windows NPS, RADIUS, and IEEE 802.1X

In the digital world of a large organization, the network is an invisible highway that carries every email, file transfer, and video call. For decades, network access management was relatively simple and static: a physical cable connected to a wall port determined which part of the network a computer could access. If that port was connected to a specific network segment, anyone who plugged a device into it could potentially gain access to that segment, regardless of their identity. This approach relied heavily on physical security. If an unauthorized person could access an exposed network jack, they might gain access to network resources without first being authenticated. As organizations grew more complex, with employees, students, and guests requiring different levels of access, this traditional approach became a significant security concern. A more secure solution is to make the network verify a user's identity before granting access and then direct the user to the appropriate network segment according to their authorized role.
This is the challenge addressed by a study conducted by Abdulraheem Hamoud Mohammed Almaweri in Djibouti. The researcher set out to build and evaluate a system that replaces static network access assignments with a dynamic, identity-based approach. In this model, a computer connects to the network, and the network requests authentication. If the user provides valid credentials, the system verifies their role within the organization and dynamically assigns the connection to the appropriate network segment. Staff members are directed to the staff network, while students are directed to the student network. If authentication fails or the authentication server becomes unavailable, the system is designed to restrict access and direct affected connections to an isolated quarantine network, where connectivity issues can be investigated and resolved without exposing sensitive network resources.
To evaluate whether this process could operate reliably, the researcher built a virtual laboratory representing an enterprise network. Rather than relying on a single computer, the experiment used a simulated network environment incorporating a central server for identity management, a policy server for defining and enforcing access rules, and a network switch for controlling access through physical ports. The researcher created two distinct user groups representing staff and students. Each group was associated with a separate virtual local area network (VLAN), providing logical separation between the two groups within the same physical network infrastructure. The staff group was mapped to one VLAN, while the student group was mapped to another. The system used an authentication framework in which the client and network infrastructure exchanged authentication messages to verify user identity before granting network access.
The researcher then conducted twenty-five tests to evaluate the system under different conditions. In the initial tests, authorized users from both the staff and student groups attempted to authenticate using valid credentials. In each tested case, the system successfully authenticated the users and assigned their connections to the appropriate VLAN. Staff users were directed to the staff network, while student users were assigned to the student network. The authentication and access-assignment process was also measured. From the time a user connected the device to the network until access was granted, the process took approximately one and a half seconds, according to the reported experimental results. This relatively short interval suggests that dynamic network access control can be implemented without necessarily introducing a substantial delay for users in the tested environment.
The study also examined how the system responded to authentication failures. In one scenario, a user supplied the correct username but an incorrect password. In another, a user attempted to authenticate with an account that did not belong to an authorized group. In both scenarios, the system rejected the authentication attempt and assigned the affected connection to the designated quarantine VLAN. This isolated network segment was intended to prevent unauthorized connections from reaching sensitive network resources while allowing administrators to investigate authentication failures or assist users. The system successfully enforced the configured quarantine behavior in all tested cases involving invalid credentials or unauthorized accounts.
Another important test examined the system's response to the unavailability of the central authentication server. The researcher simulated a server failure to evaluate how the network switch would behave when it could no longer communicate with the authentication service. Depending on the configuration, such a failure can result in either unauthorized access or the denial of legitimate access. In this experiment, the switch was configured to apply a restrictive fallback policy. When the authentication server became unreachable, new connections were directed to the quarantine VLAN after the configured response interval. This behavior demonstrated how a fail-secure configuration can help maintain network isolation when the central authentication service is unavailable. The precise scope of this behavior, including its effect on existing sessions, depends on the implemented configuration and the scenarios tested.
The results of the twenty-five tests showed consistent behavior across the evaluated scenarios. The system assigned authorized users to their designated network segments, rejected unauthorized authentication attempts, and directed affected connections to the quarantine VLAN under the tested failure conditions. However, the limited number of trials and the use of a controlled virtual environment mean that further testing would be needed to evaluate long-term reliability, scalability, and performance in large production networks. The study did not claim to address every possible network security threat or evaluate every authentication method. Instead, it focused on demonstrating the feasibility of dynamically linking user identity and authorization status to network access assignments using standard network components and established authentication technologies.
These findings provide a practical example of how organizations can move beyond static, port-based network access assignments toward more flexible, identity-based access control. By demonstrating that a user's network assignment can be determined by their authenticated identity and organizational role rather than solely by their physical connection point, the study illustrates a practical approach to improving network segmentation and access management. The experimental results indicate that a network can authenticate users, assign them to appropriate network segments, and apply restrictive policies when authentication fails or the authentication service becomes unavailable. Although deployment in production environments would require additional validation, the experiment provides a foundation for further research into dynamic network access control using established enterprise networking technologies.