topic ISE MAB Host Lookup - PAP or EAP-MD5 in Network Access Control

ISE MAB Host Lookup - PAP or EAP-MD5

cpaquet — Mon, 11 Mar 2019 02:43:01 GMT

In the docs, it says that MAB uses PAP/ASCII or EAP-MD5 to pass the MAC as username / password.

In the attached setup, MAB is talking place successfully for an iPhone, without having PAP or EAP-MD5 enabled as Allowed Protocols.

Is the "Host Lookup" under allowed protocols, provides for the MAC address to be passed in PAP / EAP-MD5 even if these two protocols are not enabled below under the Authentication Protocols section of the configuration?

How could we dictate to our switch to start using EAP-MD5 to pass the MAC? If you look at the attached authentication details output, it lists in the AV Pair a EAP-Key. Is that it?

Thank you.

Cath.

ISE MAB Host Lookup - PAP or EAP-MD5

nspasov — Wed, 24 Oct 2012 23:07:40 GMT

Hello Cath-

Question #1: Yes, I think you are correct. I believe that the "Host Lookup" is type of "protocol" used to process the MAB. If you look at the top of the authenticaiton session what do you under "Authentication Protocol?" My guess is that you see "Lookup" (see attached screen shot)

Question #2: You can force the switch to use EAP-MD5 by appending "EAP" to the "MAB" command under the individual ports:

interface fa0/1

mab eap

Things to conisider:

1) If you make that change the default/built-in condition in ISE "Wired-MAB" will have to be changed since the

service-type radius attribute will change from "Call Check" to "Framed." Thus, your MAB devices can easily skip the MAB authenticaiton rule and be denied on the network

2) Because the MAC address is sent in the clear text "Attribute 31" (Calling-Station-Id), MAB EAP does not offer any additional security by encrypting the MAC address in the password

3) Because the service type for MAB EAP is the same as an IEEE 802.1X request, the RADIUS server will not be able to easily differentiate MAB EAP requests from IEEE 802.1X requests

Here is a good document that you can reference as well:

http://www.cisco.com/en/US/prod/collateral/iosswrel/ps6537/ps6586/ps6638/config_guide_c17-663759.html

Hope this helps...

Thank you for rating!

ISE MAB Host Lookup - PAP or EAP-MD5

cpaquet — Thu, 25 Oct 2012 10:55:56 GMT

Thanks for the explanation and for the mab eap command. I didn't know.

Thanks also for the link to the MAB deployment guide.

Regards,

Cath.