802.1x mac based authentication

[Billy Dodson]

We have Cisco ACS 3.3 is there a way to do authentication based on mac address, instead of username and password? We are looking to stop things such as user purchased access points and what not. Any info would be great.

[scottosan]

The ACS will do Mac authentication, but it will not solve the rouge AP problem. To accomplish MAC authentication it is neccessary to configure the ACS and the AP. Any attemps made to connect through an AP that has been configured for MAC authentication will not be allowed unless they hav an account on ACS. As for controlling the rouges, I can only suggest using port security on your swtiches.

[Billy Dodson]

If the ACS will do Mac authentication, I am confused as to why this would not solve the rouge AP problem. If any device was plugged into the switch that was not configured for access in the ACS server, could you not force it into some sort of guest vlan?

[scottosan]

Yes you are right, I misunderstood you. I was under the impression that you were talking about doing MAC based authentication on your AP's, not the switches. That is why I made mention to port security.

The 2 options would be standard port security or 802.1x port security if you switches support this.

In order to use the 802.1X port security, your switch would need to support it and the clients connecting to the switch would require a supplicant (EAP-TLS, EAP-TTLS, etc) in order for them to work, not by MAC address alone.

You can configure standard port security on the switch which will accomplish your intentions and not even need to use the ACS server.

standard port base security by MAC:

http://www.cisco.com/en/US/products/hw/switches/ps663/products_configuration_guide_chapter09186a008007d3ce.html

802.1x port based security:

http://www.cisco.com/en/US/products/hw/switches/ps628/products_configuration_guide_chapter09186a00801a6c72.html