Wireless dot1x order

[hs08]

For wired connection we can set authentication order to dot1x mab for example, can we do same thing in the wireless? So the wireless client will try connect using dot1x first and use mab if authentication failed.

[Kasun Bandara]

@hs08 hi, as i know, cisco WLC cannot handle both (MAB and dot1x) same time. but this can do if you have ISE

[Leo Laohoo]

---

@hs08 wrote:
So the wireless client will try connect using dot1x first and use mab if authentication failed.

---

Why not use MAB so the wireless client does not waste any time trying to authenticate with the wrong credentials.

[aleabrahao]

😖

Just don't forget the detail that the network configured as MAB is L2, so the data will "travel" in plain text. If you don't care about the privacy of your users' data, then okay.

Yes, I know that only those with a registered MAC address will be able to use it, but this information can't be overlooked.

[Rich R]

@aleabrahao a MAB SSID (alone) can still use OWE or PSK so it can still be encrypted if desired.  The problem with that and the desired behaviour which @hs08 has asked about (802.1x with fallback to MAB) is that it expects users on the WLAN to be using 2 different encryption (or not) schemes which is the problem (802.1x + open / 802.1x + OWE / 802.1x + PSK).  It's not possible to accommodate both on the same WLAN.  That's the fundamental difference to LAN where 1x is only being used for authentication/authorisation.

[aleabrahao]

@Rich R False sense of security and control. 😉

[hs08]

Hi All,

sory if i not have full detail in my initial post. Here my details.

I have requirement to use one SSID for employee and guest, the employee will use EAP-TLS for authenticate and if authentication failure because the client no have certificate then the endpoint will access to guest network.

This was done for wired connection (employee and guest) but on wireless connection only employee was work, if the wireless client not have certificate then the client is asked to enter the username and password.

The switch using C2960 abd the NAC we use forti nac.

[Leo Laohoo]

---

@hs08 wrote:
because the client no have certificate then the endpoint will access to guest network.

---

Part of helpdesk troubleshooting unable to connect to WiFi is to "forget the network".  Once the username/password is accepted a new certificate gets downloaded.  

Going to "guest" SSID is not a solution nor a viable workaround because the old certificate is still present and this certificate needs to be manually downloaded.  

[Singhaam]

Employee PCs should have 802.1X configured so that when the EAPOL process starts, the device responds to the EAPOL packets and completes the 802.1X authentication successfully.

Guest PCs usually do not have 802.1X configured in their Wi-Fi settings, so the 802.1X authentication will fail and then fall back to MAB (MAC Authentication Bypass).

Have you allowed the guest PC MAC address? Because if both 802.1X and MAB fail, the PC may be temporarily blacklisted for some time.

[hs08]

Hi All,

Thanks you for your all information, i decided to build separate vlan for employee and guest.