topic Re: Cisco Aironet 1600 (AP) - problem with Mac-Authentication in Wireless

Cisco Aironet 1600 (AP) - problem with Mac-Authentication

PatrykIT — Mon, 02 Oct 2023 11:09:39 GMT

Hello
We encountered an unusual problem with our Cisco Aironet 1600 access point device.
Our goal is to enable authorizations using mac-filtering.
When entering the Access point in Security -> Advanced Security there is a 'Local MAC Address List' which is supplemented by our already defined MAC addresses that will have access to this access point.

Then, in SSID Manager, select the appropriate network (from the SSID list), select the 'Open Authentication' option with the 'With Mac Authentication' option.

And unfortunately, here is our problem... when this option is enabled, the user tries to connect... it asks him for a login and password :).
When the option is disabled, it only asks him for the WPA Pre-shared Key.

Has anyone ever encountered such a problem?
The goal is for the user to be able to enter the pre-shared key as usual, but for the AP to allow only those devices that are defined on the mac-addresse's list mentioned above.
I've also attached few screen-shot that maybe could make a much clear point of what we've set.

Thank you for all your time and help

Exact model of our AP / Cisco AIR-SAP1602I-E-K9

Re: Cisco Aironet 1600 (AP) - problem with Mac-Authentication

balaji.bandi — Mon, 02 Oct 2023 11:44:33 GMT

so what version of code running, what mode the AP running ?

you are looking fall back mechanish, if the PSK fails and you like to use MAC authentication ?

check some guide lines :

https://www.cisco.com/c/en/us/td/docs/wireless/access_point/15-3-3/configuration/guide/cg15-3-3/cg15-3-3-chap11-authtypes.html

Re: Cisco Aironet 1600 (AP) - problem with Mac-Authentication

PatrykIT — Mon, 02 Oct 2023 12:23:53 GMT

It's

Product/Model Number:

AIR-SAP1602I-E-K9

System Software Version:

15.2(2)JB

I want the main authorization to be authorization via PSK along with MAC authorization.
This means that when the client connects and is asked for a password and provides it (correctly), but it is not on the white list, it will not be allowed.

If such a thing is impossible, I would like it to be only authorization via mac-address (without PSK enabled).

I also read the guide you linked and performed the steps according to the manual, here is the quote: "If you do not have a RADIUS server on your network, you can create a list of allowed MAC addresses on the access point's Advanced Security: MAC Address Authentication page. Devices with MAC addresses not on the list are not allowed to authenticate."

Re: Cisco Aironet 1600 (AP) - problem with Mac-Authentication

Rich R — Mon, 02 Oct 2023 23:51:24 GMT

In theory I think it should work but the problem you have is that the AP and the software are both already past end of support: https://www.cisco.com/c/en/us/products/collateral/wireless/aironet-1600-series/eos-eol-notice-c51-737506.html

You could try upgrading to the last release of software 15.3(3)JF15:
https://software.cisco.com/download/home/284366503/type/284180979/release/15.3.3-JF15
but there's no guarantee that will solve the problem, and there are known bugs in the GUI in that release (which will never be fixed).

I'd suggest rather checking your config on the CLI because the autonomous AP IOS was known to have some bugs in the GUI interface.

Re: Cisco Aironet 1600 (AP) - problem with Mac-Authentication

PatrykIT — Wed, 04 Oct 2023 07:54:02 GMT

I'll come back with an answer of update with the result.
If this doesn't fix the problem, I'll do it from the CLI and let you know if I can solve it this way.

Perhaps someone else could use the information if they have simillar problem.

Re: Cisco Aironet 1600 (AP) - problem with Mac-Authentication

PatrykIT — Thu, 12 Oct 2023 08:14:20 GMT

Unfortunately, I was unable to update due to the inability to download the update from the manufacturer's website, as a license is required? to be able to download it.
However, when it comes to CLI, I was not able to click it to achieve the intended effect.
Unfortunately, the ticket is closed as unresolved. All that remains is to purchase a new access point.

Thank you for your help.