topic Re: Meraki Wireless + Dot1x + Mac address in Wireless

Meraki Wireless + Dot1x + Mac address

ShahrulEzwvn — Tue, 16 Apr 2024 05:26:41 GMT

Hi,

Require help on how to configure authentication dot1x using user account + mac address. I believe this requires to be done on NPS side. Does anyone have any ideas on this?

Re: Meraki Wireless + Dot1x + Mac address

Philip D'Ath — Tue, 16 Apr 2024 08:09:00 GMT

You won't be able to perform dual MAC+dot1x authentication using NPS (as in, MAC authenticate a machine and then dot1x authenticate a user).

However - that should not be required. Instead use something like EAP-TLS. Configure your environment to deploy certificates to machines (and/or users) and authenticate using that.

This is much stronger than stronger than using MAC-based authentication.

If instead you mean you want to be able to support devices doing EITHER MAC-based authentication or username/password authentication (for example), then that can be done with NPS - but it is pretty ugly. You have to create AD accounts where the username and password are the MAC address of the device.

https://documentation.meraki.com/MR/Encryption_and_Authentication/MAC-Based_Access_Control_Using_Microsoft_NPS_-_MR_Access_Points

Re: Meraki Wireless + Dot1x + Mac address

ShahrulEzwvn — Tue, 16 Apr 2024 08:19:44 GMT

thanks for your explaination. already checked on the MAC as username/password but it cant be done as the AD policy requires special character as the password.

for the first option, the environment includes the scanner as well. so it seems impossible to generate cert.

Re: Meraki Wireless + Dot1x + Mac address

Philip D'Ath — Tue, 16 Apr 2024 08:27:21 GMT

If you go down this path you need to limit yourself to buying hardware that meets your security posture. There are plenty of scanners and printers out there that support EAP-TLS.

You could also consider not enabling 802.1x on that port and simply using a sticky MAC address. You can search for the feature on this page:
https://documentation.meraki.com/MS/Port_and_VLAN_Configuration/Switch_Ports

Re: Meraki Wireless + Dot1x + Mac address

ShahrulEzwvn — Tue, 16 Apr 2024 09:53:26 GMT

I see. Is it possible to bind the user with mac address on the AD side?

Or could we Whitelist all the mac addresses and deny the rest. Could we achieve this using the meraki wireless?

Re: Meraki Wireless + Dot1x + Mac address

Philip D'Ath — Tue, 16 Apr 2024 18:39:29 GMT

No with Microsoft NPS. To be able to do something like this you need to use an authentication protocol called TEAP, and Microsoft NPS does not support this.

But no one does this. Everyone uses certificate-based authentication instead that needs this kind of security.

Re: Meraki Wireless + Dot1x + Mac address

ShahrulEzwvn — Wed, 17 Apr 2024 09:27:49 GMT

Noted. Any documentation on the meraki setup with the dot1x with certificate-based?

Re: Meraki Wireless + Dot1x + Mac address

Philip D'Ath — Wed, 17 Apr 2024 19:08:24 GMT

Not that I am aware of, and it is quite a project. You might want to consider getting someone in to help you with this.