802.1x / ACS 5.4 mac authentication

[Jonn cos]

Hi guys,

I am doing it in a lab so please guide me to understand this concept.

I have Cisco 3560 switch. What i want to achieve is

1. Any device that connects to port 1 of switch, switch should be able to communicate with 802.1x server, tell it the mac address of  connecting device and assign vlan recieved from the server
2. The device connecting on port 1 is mainly a printer, or any other device that doesnt support 802.1x agents.

Is there anyway to do it ? or am i going in the wrong direction. Also, i dont think i need MAB here, cause i want to do authentication based on mac.

[Jonn cos]

In the user guide its mentioned that

Cisco provides two features to accommodate non-802.1x devices. For example, MAC Authentication
Bypass (Host Lookup) and the Guest VLAN access by using web authentication.

But if i have a switch that doesnt support MAB, then what shall i do in that case ?

[nspasov]

Yes, MAB is used for devices that do not support 802.1x which is EAPoL (EAP over LAN). If the switch doesn't support MAB then you can configure its ports to automatically authorize devices on a VLAN specified by you. You can accomplish this with the following port command:

authentication event fail action authorize vlan vlan_id

Hope this helps!

Thank you for rating helpful posts!

[Jonn cos]

Cant we authenticate devices just using their MAC address and Radius Server ?

[nspasov]

Yes you can, it is called MAB :) (Mac Authentication Bypass), which is used for devices that are not capable of performing 802.1x.

[Jonn cos]

Hi Neno,

I think i am not clear in my question. I want to do authentication from Radius server using mac address. I dont want to use MAB and the command that you have said, is assigning vlan locally, i want to authenticate device using its mac address. And since my switch doesnt support MAB so leave it out of the equation :-)

Is such a thing possible

[nspasov]

Hi Jonn, your question is clear and what I am trying to explain to you is that the authentication method (mac address authentication against Radius) is MAB. That is the method :) If your NAD does not support MAB then you will have to find another method. In the Cisco world, this is done via Radius attribute 6 (Service-Type) which is set to "Call-Check" 

Here the link to Cisco's MAB deployment guide for more technical details:

http://www.cisco.com/c/en/us/products/collateral/ios-nx-os-software/identity-based-networking-services/config_guide_c17-663759.html

Thank you for rating helpful posts!