An Ethernet port on a RUCKUS ICX switch can be configured to perform two distinct and primary 802.1X functions.

1. Supplicant: The port can act as a client (Supplicant) to another 802.1X-aware device that is functioning as an authenticator. This is typically used for authenticating switch-to-switch connections.

2. Authenticator: The port's most common function is to act as an Authenticator, controlling network access for connected clients (supplicants). The Authenticator role has several operational modes, with Port-based Authenticator being the fundamental and default mode. In this mode, once a single supplicant successfully authenticates, the entire port is authorized for traffic.

These two options represent the primary, mutually exclusive roles a port can be configured to perform within an Ethernet Port Profile.

B. Authentication Server: The switch acts as a pass-through authenticator; it forwards credential checks to a separate Authentication Server (e.g., RADIUS), but never performs this role itself.

D. Host-based Authenticator: This is a specific mode of the authenticator role, not a fundamentally different role from Port-based Authenticator for the purpose of this question's scope.

E. MAC-based Authenticator: This is another specific mode of the authenticator role (also known as multi-supplicant), not a distinct primary role like "Supplicant" or "Authenticator".

1. RUCKUS FastIron Security Configuration Guide, 08.0.95 (Document Part Number: 53-1005233-01)

Page 33, Section "802.1X supplicant support": "The 802.1X supplicant feature allows a RUCKUS device to act as a supplicant to another 802.1X-aware device that is acting as an authenticator." This confirms the Supplicant role.

Page 34, Section "802.1X authentication modes": This section details the different modes for the authenticator role, listing "Port-based authentication" as the first and most basic mode. It states, "In port-based authentication, the port is the supplicant. Once the port is authenticated by the RADIUS server, all traffic from the host or hosts connected to the port is allowed on the port." This confirms the Port-based Authenticator role/mode.