MAC Authentication on ASA

[angel-moon]

Hello,

Can an ASA allow or deny Internet access based on MAC addresses of the hosts in a standalone fashion? Without ACS or any other server or software.  I am pretty sure it is a better practice to to MAC authentication on the switches but this is the requirement this time around.

Thanks in advance!  All replies rated.

[Maykol Rojas]

Hello,

The ASA currently does not have the ability to do filtering based on MAC-address. However, if your intention is to block internet access Based on MAC-address, you can implement AAA with local Usernames and passwords matching an mac-list.

It will work by authenticating the user located at the specific mac-address that you allow on the list. If the mac-address is not listed, the traffic on port 80 will be permitted to go out to the internet, if the mac-address entry is listed, the user will have to authenticate in order to do web browsing.

Hope this helps.

Mike.