802.1x, VLANs, and jumping headfirst into a space you're not familiar with

Hi everyone,

I'm starting to look into 802.1x for wired and wireless and I want to make sure I understand at least the basics before I go implementing things:

Internet | | | ASA 5516-x | | | Cisco Catalyst 29xx (handles the VLANs) | | | | | | M. Switch 1 M. Switch 2 M. Switch 3 | | | PCs PCs PCs 

Now-

VLANs and port authentication- is this normally dealt with by the closest managed switch? Or is this dealt with from the main backplane switch?

Port security best practice is setting specific ports to only be used by a set MAC address (and other auth methods) and also used in addition to RADIUS (NPS) for authenticating the user/machine as well.

I am just confused as to how we need to set this up and where I need to get started. If someone had a map of an example network so I could see it, I think i'd be much better off understanding what is going on.

My biggest hanging up points are understanding proper port security and where VLANs are assigned. (subnets are another story for another day)

Any help would be amazing.

Thanks!