topic Re: MAB equivalent for the wireless clients in Wireless

MAB equivalent for the wireless clients

Muhammed Adnan — Mon, 05 Jul 2021 17:23:01 GMT

Hello Experts,

MAB ==> For Wired Client only ==> If dot1x authentication fails, then Mac authentication is tried.

MAC Authentication Failover to 802.1X ==> If mac authentication fails, then try dot1x authentication.

1. Is there not any MAB equivalent in wireless, wherein if dot1x authentication fails for wireless clients than MAB is tried?

2. If we enable mac authentication on a WLAN, will it consume any end point license from ISE?

Re: MAB equivalent for the wireless clients

patoberli — Mon, 13 May 2019 12:45:46 GMT

1. I don't think that is possible on wireless.
2. No idea.

Re: MAB equivalent for the wireless clients

Muhammed Adnan — Tue, 14 May 2019 08:02:33 GMT

Thanks Patoberli for the response.

Is MAC authentication with Radius for WPA2-PSK SSID even supported?

Re: MAB equivalent for the wireless clients

patoberli — Tue, 14 May 2019 08:35:10 GMT

Not that I know of, not without supplying a correct PSK.

You can use iPSK to have a custom PSK per MAC address, but that needs creating a policy per client(group).

Re: MAB equivalent for the wireless clients

Sathiyanarayanan Ravindran — Tue, 14 May 2019 09:26:32 GMT

MAB and dot1.x can't be configure on the same SSID.

Please check the doc for IPSK Deployment Cisco WLC and ISE

Re: MAB equivalent for the wireless clients

Muhammed Adnan — Tue, 14 May 2019 11:09:48 GMT

Hi Ravindran,

Thanks for the response and the link.

I am not looking for dot1x and MAB on the same SSID.

The combination that I am looking out for is wpa2-psk + mac authentication via Radius.

Re: MAB equivalent for the wireless clients

patoberli — Tue, 14 May 2019 11:59:10 GMT

It's either PSK or 802.1x. Now with iPSK you have the possibility to have a different PSK per Mac address, this wasn't possible before.

What you could do, you can block / permit the specific mac addresses directly on the WLC, but that is usually a very bad idea (Mac addresses don't offer any security and can be cloned by everybody!!!).

Re: MAB equivalent for the wireless clients

Sathiyanarayanan Ravindran — Tue, 14 May 2019 12:08:18 GMT

Yes, That can be done.

You have to configure the SSID with WPA2+PSK and MAC filtering , In the AAA server you have to map the radius server which you want to use for MAB.