Table Of Contents

Standalone MAB Support

Finding Feature Information

Contents

Prerequisites for Standalone MAB Support

Information About Standalone MAB Support

Overview of the Cisco IOS Auth Manager

Standalone MAB

How to Configure Standalone MAB

Enabling Standalone MAB

Prerequisites

Restrictions

Troubleshooting Tips

Enabling Reauthentication on a Port

Specifying the Security Violation Mode

Configuration Examples for Standalone MAB

Standalone MAB Configuration: Example

Additional References

Related Documents

Standards

MIBs

RFCs

Technical Assistance

Feature Information for Standalone MAB Support

Standalone MAB Support

---

First Published: November 11, 2008

Last Updated: October 12, 2009

Standalone MAC Authentication Bypass (MAB) is an authentication method that grants network access to specific MAC addresses—regardless of 802.1x capability or credentials. As a result, devices such as cash registers, fax machines, and printers can be readily authenticated, and network features that are based on authorization policies can be made available.

Before standalone MAB support was available, MAB could be configured only as a failover method for 802.1x authentication. Standalone MAB is independent of 802.1x authentication.

Finding Feature Information

Your software release may not support all the features documented in this module. For the latest feature information and caveats, see the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the "Feature Information for Standalone MAB Support" section.

Use Cisco Feature Navigator to find information about platform support and Cisco IOS and Catalyst OS software image support. To access Cisco Feature Navigator, go to http://tools.cisco.com/ITDIT/CFN/jsp/index.jsp. An account on Cisco.com is not required.

Contents

•Prerequisites for Standalone MAB Support

•Information About Standalone MAB Support

•How to Configure Standalone MAB

•Configuration Examples for Standalone MAB

•Additional References

•Feature Information for Standalone MAB Support

Prerequisites for Standalone MAB Support

IEEE 802.1x—Port-Based Network Access Control

You should understand the concepts of port-based network access control and have an understanding of how to configure port-based network access control on your Cisco platform. See the Cisco IOS Security Configuration Guide: Securing User Services, Release 15.0 for more information.

RADIUS and ACLs

You should understand the concepts of the RADIUS protocol and have an understanding of how to create and apply access control lists (ACLs). For more information, see the documentation for your Cisco platform and the Cisco IOS Security Configuration Guide: Securing User Services, Release 15.0.

The switch must have a RADIUS configuration and be connected to the Cisco secure access control server (ACS). For more information, see the User Guide for Secure ACS Appliance 3.2.

Information About Standalone MAB Support

To set up standalone MAB, you should understand the following concepts:

•Overview of the Cisco IOS Auth Manager

•Standalone MAB

Overview of the Cisco IOS Auth Manager

The capabilities of devices connecting to a given network can be different, thus requiring that the network support different authentication methods and authorization policies. The Cisco IOS Auth Manager handles network authentication requests and enforces authorization policies, regardless of authentication method. The Auth Manager maintains operational data for all port-based network connection attempts, authentications, authorizations, and disconnections and as such, serves as a session manager.

The possible states for Auth Manager sessions are:

•Idle—In the idle state, the authentication session has been initialized, but no methods have yet been run. This is an intermediate state.

•Running—A method is currently running. This is an intermediate state.

•Authc Success— The authentication method has run successfully. This is an intermediate state.

•Authc Failed—The authentication method has failed. This is an intermediate state.

•Authz Success—All features have been successfully applied for this session. This is a terminal state.

•Authz Failed—At least one feature has failed to be applied for this session. This is a terminal state.

•No methods—No method provided a result for this session. This is a terminal state.

Standalone MAB

MAB uses the MAC address of the connecting device to grant or deny network access. To support MAB, the RADIUS authentication server maintains a database of MAC addresses for devices that require access to the network. MAB generates a RADIUS request with a MAC address in the Calling-Station-Id (attribute 31) and Service-Type (attribute 6) with value 10. After a successful authentication, the Auth Manager enables various authorization features specified by the authorization policy, such as ACL assignment and VLAN assignment.

How to Configure Standalone MAB

This section contains the following tasks:

•Enabling Standalone MAB

•Enabling Reauthentication on a Port

•Specifying the Security Violation Mode

Enabling Standalone MAB

Ports enabled with the Standalone MAB feature can use the MAC address of connecting devices to grant or deny network access. Perform the steps described in this section to enable standalone MAB on individual ports.

Prerequisites

Before you can configure standalone MAB, the switch must be connected to a Cisco Secure ACS server and RADIUS authentication, authorization, and accounting (AAA) must be configured.

Restrictions

Standalone MAB can be configured on switched ports only—it cannot be configured on routed ports.

SUMMARY STEPS

1. enable

2. configure terminal

3. interface type slot/port

4. switchport

5. switchport mode access

6. authentication port-control auto

7. mab [eap]

8. end

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Switch> enable	Enables privileged EXEC mode. •Enter your password if prompted.
Step 2	configure terminal Example: Switch# configure terminal	Enters global configuration mode.
Step 3	interface type slot/port Example: Switch(config)# interface FastEthernet2/1	Enters interface configuration mode.
Step 4	switchport Example: Switch(config-if)# switchport	Places interface in Layer2-switched mode.
Step 5	switchport mode access Example: Switch(config-if)# switchport mode access	Sets a nontrunking, nontagged single VLAN Layer 2 interface.
Step 6	authentication port-control auto Example: Switch(config-if)# authentication port-control auto	Configures the authorization state of the port.
Step 7	mab [eap] Example: Switch(config-if)# mab	Enables MAB.
Step 8	end Example: Switch(config-if)# end	Returns to global configuration mode.

Troubleshooting Tips

The following commands can help troubleshoot standalone MAB:

•debug authentication

•debug mab all

•show authentication registrations

•show authentication sessions

•show mab

Enabling Reauthentication on a Port

By default, ports are not automatically reauthenticated. You can enable automatic reauthentication and specify how often reauthentication attempts are made.

SUMMARY STEPS

1. enable

2. configure terminal

3. interface type slot/port

4. switchport

5. switchport mode access

6. authentication port-control auto

7. mab [eap]

8. authentication periodic

9. authentication timer reauthenticate {seconds | server}

10. end

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Switch> enable	Enables privileged EXEC mode. •Enter your password if prompted.
Step 2	configure terminal Example: Switch# configure terminal	Enters global configuration mode.
Step 3	interface type slot/port Example: Switch(config)# interface FastEthernet2/1	Enters interface configuration mode.
Step 4	switchport Example: Switch(config-if)# switchport	Places interface in Layer2-switched mode.
Step 5	switchport mode access Example: Switch(config-if)# switchport mode access	Sets a nontrunking, nontagged single VLAN Layer 2 interface.
Step 6	authentication port-control auto Example: Switch(config-if)# authentication port-control auto	Configures the authorization state of the port.
Step 7	mab [eap] Example: Switch(config-if)# mab	Enables MAB.
Step 8	authentication periodic Example: Switch(config-if)# authentication periodic	Enables reauthentication.
Step 9	authentication timer reauthenticate {seconds | server} Example: Switch(config-if)# authentication timer reauthenticate 900	Configures the time, in seconds, between reauthentication attempts.
Step 10	end Example: Switch(config-if)# end	Returns to global configuration mode.

Specifying the Security Violation Mode

When there is a security violation on a port, the port can be shut down or traffic can be restricted. By default, the port is shut down. You can configure the period of time for which the port is shut down.

SUMMARY STEPS

1. enable

2. configure terminal

3. interface type slot/port

4. switchport

5. switchport mode access

6. authentication port-control auto

7. mab [eap]

8. authentication violation {restrict | shutdown}

9. authentication timer restart seconds

10. end

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Switch> enable	Enables privileged EXEC mode. •Enter your password if prompted.
Step 2	configure terminal Example: Switch# configure terminal	Enters global configuration mode.
Step 3	interface type slot/port Example: Switch(config)# interface FastEthernet2/1	Enters interface configuration mode.
Step 4	switchport Example: Switch(config-if)# switchport	Places interface in Layer2-switched mode.
Step 5	switchport mode access Example: Switch(config-if)# switchport mode access	Sets a nontrunking, nontagged single VLAN Layer 2 interface.
Step 6	authentication port-control auto Example: Switch(config-if)# authentication port-control auto	Configures the authorization state of the port.
Step 7	mab [eap] Example: Switch(config-if)# mab	Enables MAB.
Step 8	authentication violation {restrict | shutdown} Example: Switch(config-if)# authentication violation shutdown	Configures the action to be taken when a security violation occurs on the port.
Step 9	authentication timer restart seconds Example: Switch(config-if)# authentication timer restart 30	Configures the period of time, in seconds, after which an attempt is made to authenticate an unauthorized port.
Step 10	end Example: Switch(config-if)# end	Returns to global configuration mode.

Configuration Examples for Standalone MAB

This section contains the following example:

•Standalone MAB Configuration: Example

Standalone MAB Configuration: Example

The following example shows how to configure standalone MAB on a port. In this example, the client is reauthenticated every 1200 seconds and the connection is dropped after 600 seconds of inactivity.

enable

 configure terminal

  interface GigabitEthernet2/1

   switchport

   switchport mode access

   switchport access vlan 2

   authentication port-control auto

   mab

   authentication violation shutdown 

   authentication timer restart 30 

   authentication periodic 

   authentication timer reauthenticate 1200 

   authentication timer inactivity 600 

Additional References

The following sections provide references related to the standalone MAB feature.

Related Documents

Related Topic	Document Title
Authentication commands	Cisco IOS Security Command Reference
IEEE 802.1x - Flexible Authentication	Cisco IOS Security Configuration Guide: Securing User Services, Release 15.0.

Standards

Standard	Title
None	—

MIBs

MIB	MIBs Link
•CISCO-AUTH-FRAMEWORK-MIB •CISCO-MAC-AUTH-BYPASS-MIB •CISCO-PAE-MIB •IEEE8021-PAE-MIB	To locate and download MIBs for selected platforms, Cisco IOS releases, and feature sets, use Cisco MIB Locator found at the following URL: http://www.cisco.com/go/mibs

RFCs

RFC	Title
RFC 3580	IEEE 802.1x Remote Authentication Dial In User Service (RADIUS)

Technical Assistance

Description

Link

The Cisco Support website provides extensive online resources, including documentation and tools for troubleshooting and resolving technical issues with Cisco products and technologies. To receive security and technical information about your products, you can subscribe to various services, such as the Product Alert Tool (accessed from Field Notices), the Cisco Technical Services Newsletter, and Really Simple Syndication (RSS) Feeds. Access to most tools on the Cisco Support website requires a Cisco.com user ID and password.

http://www.cisco.com/techsupport

Feature Information for Standalone MAB Support

Table 1 lists the release history for this feature.

Not all commands may be available in your Cisco IOS software release. For release information about a specific command, see the command reference documentation.

Use Cisco Feature Navigator to find information about platform support and software image support. Cisco Feature Navigator enables you to determine which Cisco IOS and Catalyst OS software images support a specific software release, feature set, or platform. To access Cisco Feature Navigator, go to http://tools.cisco.com/ITDIT/CFN/jsp/index.jsp. An account on Cisco.com is not required.

---

Note Table 1 lists only the Cisco IOS software release that introduced support for a given feature in a given Cisco IOS software release train. Unless noted otherwise, subsequent releases of that Cisco IOS software release train also support that feature.

---

Table 1 Feature Information for Standalone MAB Support 

Feature Name	Releases	Feature Information
Standalone MAB Support	12.2(33)SXI	This feature grants network access to devices based on MAC address regardless of 802.1x capability or credentials. The following commands were introduced or modified: authentication periodic, authentication port-control, authentication timer inactivity, authentication timer reauthenticate, authentication timer restart, authentication violation, debug authentication, mab, show authentication interface, show mab, show authentication registrations, show authentication sessions.

CCDE, CCENT, CCSI, Cisco Eos, Cisco HealthPresence, Cisco IronPort, the Cisco logo, Cisco Lumin, Cisco Nexus, Cisco Nurse Connect, Cisco Pulse, Cisco StackPower, Cisco StadiumVision, Cisco TelePresence, Cisco Unified Computing System, Cisco WebEx, DCE, Flip Channels, Flip for Good, Flip Mino, Flipshare (Design), Flip Ultra, Flip Video, Flip Video (Design), Instant Broadband, and Welcome to the Human Network are trademarks; Changing the Way We Work, Live, Play, and Learn, Cisco Capital, Cisco Capital (Design), Cisco:Financed (Stylized), Cisco Store, and Flip Gift Card are service marks; and Access Registrar, Aironet, AllTouch, AsyncOS, Bringing the Meeting To You, Catalyst, CCDA, CCDP, CCIE, CCIP, CCNA, CCNP, CCSP, CCVP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco  IOS, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Cisco Unity, Collaboration Without Limitation, Continuum, EtherFast, EtherSwitch, Event Center, Explorer, Fast Step, Follow Me Browsing, FormShare, GainMaker, GigaDrive, HomeLink, iLYNX, Internet Quotient, IOS, iPhone, iQuick Study, IronPort, the IronPort logo, Laser Link, LightStream, Linksys, MediaTone, MeetingPlace, MeetingPlace Chime Sound, MGX, Networkers, Networking Academy, Network Registrar, PCNow, PIX, PowerKEY, PowerPanels, PowerTV, PowerTV (Design), PowerVu, Prisma, ProConnect, ROSA, ScriptShare, SenderBase, SMARTnet, Spectrum Expert, StackWise, The Fastest Way to Increase Your Internet Quotient, TransPath, WebEx, and the WebEx logo are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the United States and certain other countries.

All other trademarks mentioned in this document or website are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (0908R)

Any Internet Protocol (IP) addresses used in this document are not intended to be actual addresses. Any examples, command display output, and figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses in illustrative content is unintentional and coincidental.

© 2009 Cisco Systems, Inc. All rights reserved.