Is it possible to 802.1x MAB via WLC?

[mscherting]

I'm looking for a way to enforce some degree of .1x machine authentication against AD for wireless devices which do not have a robust supplicant and/or cannot join AD.  We're using MAC Authentication Bypass (MAB) on the wired side, and a similar capability on wireless would be advantageous.

Can WLCs do MAB like a switch can?  Alternatives?  Ideas?

Thanks!

[Stephen Rodriguez · Accepted solution]

MAB on wired works, because if the device can't do 802.1x, it can fall to another auth mech, and keep doing so, until it his the Guest profile. 

Wireless doesn't work quite the same way.  For 802.1x you'd want the profile to be built prior to connection, specifiying the EAP type, cert if one is used, as well as credentials, whether cached from login, or a specified set.  WLAN Supplicants can see a broadcasted SSID, and the user could click on it, to start to connect, but that could cause you more issues, than just using a GPO to push the wireless config, if they are domain devices.

As another option, I'd take a look at ISE.  Granted it's a seperate piece, but it allows  you to use device profiling,to determine what is connecting to the network, and then push policy as to what it has access to.

HTH,

Steve

[mscherting]

Thank you.

Funny you should mention ISE.  Our local Cisco reps are pushing it too, especially since ACS5.x doesn't work as advertised.

[csco]

ISE is the way to go, when licensing is no option. You can use a variety of functions to secure your WLAN properly.

We used Username/Password in combination with a Whitelist to enable a select few with private devices on the network. Worked like a charm.