802.1x MAB

[tedauction]

Hello, I am trying to use wired 802.1x authentication from my switches, authenticating against Windows NAS server.

Is anyone else doing this using the Windows object class ' ieee802Device' to store the MAC addresses ?

...or does it only work if you use AD user accounts as MAC address containers ? (then there is a fine grained  password problem ?)

Thank you.

[Austin Sabio · Accepted solution]

True. according to cisco documentation as of 2011 its possible with object class 'ieee802Device' 

"Starting with Microsoft Windows Server 2003 Release 2 (R2) and Windows Server 2008, Microsoft Active Directory provides a special object class for MAC addresses called ieee802Device. By using this object class, you can streamline MAC address storage in Active Directory and avoid password complexity requirements."

http://www.cisco.com/c/en/us/products/collateral/ios-nx-os-software/identity-based-networking-services/config_guide_c17-663759.html

http://www.cisco.com/c/en/us/solutions/collateral/enterprise-networks/trustsec/whitepaper_C11-717280.pdf

Apparently, that was not the case below.  

https://supportforums.cisco.com/discussion/11213796/8021x-mab-microsoft-nps-ieee802device-object-group

https://social.technet.microsoft.com/Forums/windowsserver/en-US/592048e4-930a-4f04-96b5-120ef3c4dbd6/8021x-microsoft-nps-ieee802device-object-group-mac-authentication-fallback?forum=winserverNAP

I hope this helps. Good luck!