MAC-based access control for WiFi VoIP

[BWalters1128]

Need some assistance on this. I am trying to configure a VoIP SSID using MAC-based access control so that the WiFi phones do not need to authenticate to the network. However, I'm having issues with setting up the users in AD. The phones are Incominc ICW-1000 and require the username/password in AD to be the same. However AD won't let me due to password requirements, even through I disabled the complexity and history in the GPO. Any other way of configuring the SSID to auto-connect these phones with out getting too complex?

Thank you!

Brad W

[ww^]

i think i used this
https://documentation.meraki.com/MR/Encryption_and_Authentication/Creating_an_NPS_Policy_for_MAC-based_Authentication
and this
https://technet.microsoft.com/en-us/library/dd197535(WS.10).aspx
to make it work

[Philip D'Ath]

What would be really cool if there was an option to use WPA2-PSK mode with RADIUS MAC authentication.

So when a device attaches you take their MAC address for their RADIUS username and the PSK they present for their password.

Then you get encryption, and you can authenticate every device individually.

[CARutledge]

Agreed, Kind of a big deal!

[BWalters1128]

Thanks - but I think the big issue is my AD Password requirements - even though I've disabled the policy for complex passwords. The phones require a user account that the username and password are both the mac address - which AD doesn't like.

[ww^]

https://social.technet.microsoft.com/Forums/windowsserver/en-US/6dd983f9-973f-4d23-be0c-032d3a1592d0/nps-override-username-and-user-identity-attribute?forum=winserverNAP

[BWalters1128 · Accepted solution]

Thank you. I actually found that with Windows Server 2012, there is an Active Directory Administrative Center - which allows you to create separate policies based upon groups. If you add the WiFi Phone Users to that group, the policy overrides the Default Domain policy. Phones were added and connected to the network with no issues. Thanks all!