topic mab request format in Network Access Control

mab request format

bwedel1234 — Mon, 11 Mar 2019 03:26:56 GMT

We are getting our cisco switches up and running with 802.1x and mab. We have some other switches from another vendor that have been working great with our radius server (Microsoft NPS). Our problem we are having is that cisco sends the mac address for mab in lower case, while the other switch and our AD accounts are al in upper case.

Is there a way to have the cisco switch (2960) send the mac in upper case or does anyone know of a way to have the NPS server check for both ways (although that really isn't what we want).

Thanks

Re: mab request format

Jatin Katyal — Mon, 20 May 2013 19:24:12 GMT

By default, the Access-Request message is a Password Authentication Protocol (PAP) authentication request, The request includes the source MAC address in three attributes: Attribute 1 (Username), Attribute 2 (Password), and Attribute 31 (Calling-Station-Id). Although the MAC address is the same in each attribute, the format of the address differs. This feature is important because different RADIUS servers may use different attributes to validate the MAC address. Some RADIUS servers may look at only Attribute 31 (Calling-Station-Id), while others will actually verify the username and password in Attributes 1 and 2.

RADIUS Attribute	Format	Example
1 (Username)	12 hexadecimal digits, all lowercase, and no punctuation	0018f809cfd7
2 (Password)	Same as the username but encrypted	\xf2\xb8\x9c\x9c\x13\xdd#,\xcaT\xa1\xcay=&\xee
31(Calling-Station-Id)	6 groups of 2 hexadecimal digits, all uppercase, and separated by hyphens	00-18-F8-09-CF-D7

Because MAB uses the MAC address as a username and password, you should make sure that the RADIUS server can differentiate MAB requests from other types of requests for network access.

Jatin Katyal
- Do rate helpful posts -

mab request format

bwedel1234 — Mon, 20 May 2013 20:25:11 GMT

Thanks for the reply Jatin.

The reason why I want to find out of if it's possible to change the way the swtich passes the mac is that I don't want to have to add all of our phone mac addresses (about 2600) twice into AD. Once with upper case and once with lower case in order for it to work. So from the sound of your reply. It sounds like you can't change the letters from lower case to upper case. Is that correct?

Thanks again!

mab request format

Jatin Katyal — Tue, 21 May 2013 19:27:24 GMT

Uw !!! I couldn't find a way /command to convert the case and send it to radius server.

Jatin Katyal

- Do rate helpful posts -

mab request format

bwedel1234 — Wed, 22 May 2013 12:15:39 GMT

Again, thanks for the help Jatin.

Yep, this is really annoying.

The one thing that is holding back this project from going live is the capital letters.

I think we'll probably move away from mab and try eap-tls through cucm.

-blake

Re: mab request format

manjeets — Fri, 12 Jul 2013 14:39:25 GMT

Kindly review the attachment:

and the link:

http://www.cisco.com/en/US/prod/collateral/iosswrel/ps6537/ps6586/ps6638/config_guide_c17-663759.html

Re: mab request format

manjeets — Wed, 28 Aug 2013 13:12:00 GMT

Kindly review the attached :