mab request format

[bwedel1234]

We are getting our cisco switches up and running with 802.1x and mab.  We have some other switches from another vendor that have been working great with our radius server (Microsoft NPS).  Our problem we are having is that cisco sends the mac address for mab in lower case, while the other switch and our AD accounts are al in upper case. 

Is there a way to have the cisco switch (2960) send the mac in upper case or does anyone know of a way to have the NPS server check for both ways (although that really isn't what we want).

Thanks

[Jatin Katyal]

By  default, the Access-Request message is a Password Authentication  Protocol (PAP) authentication request, The request includes the source  MAC address in three attributes: Attribute 1 (Username), Attribute 2  (Password), and Attribute 31 (Calling-Station-Id). Although the MAC  address is the same in each attribute, the format of the address  differs. This feature is important because different RADIUS servers may  use different attributes to validate the MAC address. Some RADIUS  servers may look at only Attribute 31 (Calling-Station-Id), while others  will actually verify the username and password in Attributes 1 and 2.

RADIUS Attribute	Format	Example
1 (Username)	12 hexadecimal digits, all lowercase, and no punctuation	0018f809cfd7
2 (Password)	Same as the username but encrypted	\xf2\xb8\x9c\x9c\x13\xdd#,\xcaT\xa1\xcay=&\xee
31(Calling-Station-Id)	6 groups of 2 hexadecimal digits, all uppercase, and separated by hyphens	00-18-F8-09-CF-D7

Because MAB uses the MAC address as a username and password, you should make sure that the RADIUS server can differentiate MAB requests from other types of requests for network access.

Jatin Katyal
- Do rate helpful posts -

[bwedel1234]

Thanks for the reply Jatin.

The reason why I want to find out of if it's possible to change the way the swtich passes the mac is that I don't want to have to add all of our phone mac addresses (about 2600) twice into AD.  Once with upper case and once with lower case in order for it to work.  So from the sound of your reply.  It sounds like you can't change the letters from lower case to upper case.  Is that correct?

Thanks again!

[Jatin Katyal]

Uw !!! I couldn't find a way /command to convert the case and send it to radius server.

Jatin Katyal


- Do rate helpful posts -

[bwedel1234]

Again, thanks for the help Jatin.

Yep, this is really annoying.  

The one thing that is holding back this project from going live is the capital letters. 

I think we'll probably move away from mab and try eap-tls through cucm.

-blake

[manjeets]

Kindly review the attachment:

       and the link:

http://www.cisco.com/en/US/prod/collateral/iosswrel/ps6537/ps6586/ps6638/config_guide_c17-663759.html

[manjeets]

Kindly review the attached :