I'd like to authenticate clients connecting to LAN/Ethernet port, just like we authenticate users connecting using W-LAN.
We have a Radius server, and the W-LAN authentication is working. I can't seem to find any description how to do this on LAN.
Is that possible?
There's a "wired" driver that supposedly does it, but you may need some extra glue for the switchport integration.
Someone else is currently trying here: Setting Up Wired 802.1X
...and as to that extra glue code see here: https://serverfault.com/questions/783670/hostapd-wired-802-1x-with-bridge
The caveat is that you don't get to let the switch bridge in hardware, so you'll be sending a lot more
traffic through the CPU.
Not just a lot more, but absolutely all traffic - which most general purpose routerds won't be able to cope with (unless you're fine with pretty bad throughput over LAN).