mac-auth

Profile Config Commands

Enables authentication of a client‘s MAC address on wired ports. When configured, MAC authentication will be enabled on devices using this profile.

To enable MAC address authentication on a device, enter the device‘s configuration mode and execute the mac-auth command.

When enabled, the source MAC address of a device, connected to the specified wired port, is authenticated with the RADIUS server. Once authenticated the device is permitted access to the managed network and packets from the authenticated source are processed. If not authenticated the device is either denied access or provided guest access through the guest VLAN (provided guest VLAN access is configured on the port).

Enabling MAC authentication requires you to first configure a AAA policy specifying the RADIUS server. Configure the client‘s MAC address on the specified RADIUS server. Attach this AAA policy to a profile or a device. Finally, enable MAC authentication on the desired wired port of the device or device-profile.

Only one MAC address is supported for every wired port. Consequently, when one source MAC address is authenticated, packets from all other sources are dropped.

To enable client MAC authentication on a wired port:

1. Configure the user on the RADIUS server. The following examples create a RADIUS server user entry.

   <DEVICE>(config)#radius-group <RAD-GROUP-NAME>

   

   <DEVICE>(config-radius-group-<RAD-GROUP-NAME>)#policy vlan <VLAN-ID>

   <DEVICE>(config)#radius-user-pool-policy <RAD-USER-POOL-NAME>

   

   <DEVICE>(config-radius-user-pool-<RAD-USER-POOL-NAME>)#user <USER-NAME> password <PASSWORD> group <RAD-GROUP-OF-STEP-A>

   Note: The <USER-NAME> and <PASSWORD> should be the client‘s MAC address. This address will be matched against the MAC address of incoming traffic at the specified wired port.

   <DEVICE>(config)#radius-server-policy <RAD-SERVER-POL-NAME>

   

   <DEVICE>(config-radius-server-policy-<RAD-SERVER-POL-NAME>)#use radius-user-pool-policy <RAD-USER-POOL-OF-STEP-B>

2. Configure a AAA policy exclusively for wired MAC authentication and specify the authentication (RADIUS) server settings. The following example creates a AAA policy ‘macauth‘ and enters its configuration mode:
   

   <DEVICE-A>(config)#aaa-policy macauth
   <DEVICE-A>(config-aaa-policy-macauth)#...

   Specify the RADIUS server details.

   

   <DEVICE-A>(config)#aaa-policy macauth
   <DEVICE-A>(config-aaa-policy-macauth)#authentication server <1-6> [host <IP>|onboard]

3. Attach the AAA policy to the device or profile. When attached to a profile, the AAA policy is applied to all devices using this profile.
   

   <DEVICE>(config-device-aa-bb-cc-dd-ee)#mac-auth use aaa-policy macauth
   <DEVICE>(config-profile-<DEVICE-PROFILE-NAME>)#mac-auth use aaa-policy macauth

4. Enable mac-auth on the device‘s desired GE port. When enabled on a profile, MAC address authentication is enabled, on the specified GE port, of all devices using this profile.
   

   <DEVICE>(config-device-aa-bb-cc-dd-ee)#interface ge x
   <DEVICE>(config-device-aa-bb-cc-dd-ee-gex)#mac-auth
   
   <DEVICE>(config-profile-<PROFILE-NAME>)#interface ge x
   <DEVICE>(config-profile-<PROFILE-NAME>)#mac-auth

Supported on the following devices:

• Access Points: AP3000/X, AP5010, AP310i/e, AP410i/e, AP505i, AP510i, AP510e, AP560i, AP7602, AP7612, AP7622, AP7632, AP7662, AP8163, AP8533.
• Service Platforms: NX5500, NX7500, NX9500, NX9600
• Virtual Platforms: CX9000, VX9000

Syntax

Parameters

mac-auth use aaa-policy <AAA-POLICY-NAME>

Related Commands