Home | Skip to Content | Skip to Search | Skip to Navigation | Skip to Footer |
Worldwide [change] |Register |About Cisco
Guest

Hierarchical Navigation

Wireless, LAN (WLAN)

MAC Filters with Wireless LAN Controllers (WLCs) Configuration Example

Downloads

Document ID: 91901


Contents

Introduction
Prerequisites
      Requirements
      Components Used
      Conventions
MAC Address Filter (MAC Authentication) on WLCs
Configure Local MAC Authentication on WLCs
      Configure a WLAN and Enable MAC Filtering
      Configure the Local Database on the WLC with Client MAC Addresses
Configure MAC Authentication using a RADIUS Server
      Configure a WLAN and Enable MAC Filtering
      Configure the RADIUS Server with Client MAC Addresses
      Verify
      Troubleshoot
Use the CLI to Configure the MAC Filter on WLC
Authorize LAPs against an AAA Server
NetPro Discussion Forums - Featured Conversations
Related Information

Introduction

This document explains how to configure MAC filters with wireless LAN controllers (WLCs) with a configuration example. This document also discusses how to authorize lightweight access points (LAPs) against an AAA server.

Prerequisites

Requirements

Ensure that you meet these requirements before you attempt this configuration:

  • Basic knowledge of the configuration of LAPs and Cisco WLCs

  • Basic knowledge of Cisco Unified Wireless Security Solutions

Components Used

The information in this document is based on these software and hardware versions:

  • Cisco 4400 WLC that runs software version 4.0.206.0

  • Cisco 1000 Series LAPs

  • 802.11 a/b/g wireless client adapter with firmware 2.5

  • Aironet Desktop Utility (ADU) version 2.5

The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, make sure that you understand the potential impact of any command.

Conventions

Refer to Cisco Technical Tips Conventions for more information on document conventions.

MAC Address Filter (MAC Authentication) on WLCs

When you create a MAC address filter on WLCs, users are granted or denied access to the WLAN network based on the MAC address of the client they use.

There are two types of MAC authentication that are supported on WLCs:

  • Local MAC authentication

  • MAC authentication using a RADIUS server

With local MAC authentication, user MAC addresses are stored in a database on the WLC. When a user tries to access the WLAN that is configured for MAC filtering, the client MAC address is validated against the local database on the WLC, and the client is granted access to the WLAN if the authentication is successful.

By default, the WLC local database supports up to 512 user entries.

This database is shared by local management users (including lobby ambassadors), net users (including guest users), MAC filter entries, and disabled clients. Together, all of these types of users cannot exceed the configured database size.

In order to increase the local database to 2048, use this command from the CLI:

<Cisco Controller>config database size ?
<count>        Enter the maximum number of entries (512-2048)

Alternatively, MAC address authentication can also be performed using a RADIUS server. The only difference is that the users MAC address database is stored in the RADIUS server instead of the WLC. When a user uses a RADIUS server in order to access the WLAN that is configured for MAC filtering, the WLC forwards the MAC address of the client to the RADIUS server. Then, the RADIUS server validates the MAC address based on the database it has. If the client authentication is successful, the client is granted access to the WLAN. Any RADIUS server which supports MAC address authentication can be used.

Configure Local MAC Authentication on WLCs

Complete these steps in order to configure local MAC authentication on the WLCs:

  1. Configure a WLAN and Enable MAC Filtering

  2. Configure the Local Database on the WLC with Client MAC Addresses

    Note: Before you configure MAC authentication, you must configure the WLC for basic operation and register the LAPs to the WLC. This document assumes that the WLC is already configured for basic operation and that the LAPs are registered to the WLC. If you are a new user trying to set up the WLC for basic operation with LAPs, refer to Lightweight AP (LAP) Registration to a Wireless LAN Controller (WLC).

    Note: There is no special configuration needed on the wireless client in order to support MAC authentication.

Configure a WLAN and Enable MAC Filtering

Complete these steps in order to configure a WLAN with MAC filtering:

  1. Click WLANs from the controller GUI in order to create a WLAN.

    The WLANs window appears. This window lists the WLANs configured on the controller.

  2. Click New in order to configure a new WLAN.

    In this example, the WLAN is named MAC-WLAN and the WLAN ID is 1.

    mac-filters-wlcs-config1.gif

  3. Click Apply.

  4. In the WLAN > Edit window, define the parameters specific to the WLAN.

    1. Under Security Policies -> Layer 2 Security, check the MAC Filtering check box.

      This enables MAC authentication for the WLAN.

    2. Under General Policies -> Interface Name, select the interface to which the WLAN is mapped.

      In this example, the WLAN is mapped to the management interface.

    3. Select the other parameters, which depend on the design requirements of the WLAN.

    4. Click Apply.

      mac-filters-wlcs-config2.gif

The next step is to configure the local database on the WLC with the client MAC addresses.

Refer to VLANs on Wireless LAN Controllers Configuration Example for information on how to configure dynamic interfaces (VLANs) on WLCs.

Configure the Local Database on the WLC with Client MAC Addresses

Complete these steps in order to configure the local database with a client MAC address on the WLC:

  1. Click Security from the controller GUI, and then click MAC Filtering from the left side menu.

    The MAC Filtering window appears.

    mac-filters-wlcs-config3.gif

  2. Click New in order to create a local database MAC address entry on the WLC.

  3. In the MAC Filters > New window, enter the MAC address, WLAN ID, Description and the Interface Name for the client.

    Here is an example:

    mac-filters-wlcs-config4.gif

  4. Click Apply.

  5. Repeat steps 2-4 in order to add more clients to the local database.

    Now, when clients connect to this WLAN, the WLC validates the clients MAC address against the local database and if the validation is successful, the client is granted access to the network.

    Note: Cisco recommends that MAC address authentication should be used along with other Layer 2 or Layer 3 security methods. It is not advisable to use only MAC address authentication to secure your WLAN network because it does not provide a strong security mechanism.

Configure MAC Authentication using a RADIUS Server

Complete these steps in order to configure MAC authentication using a RADIUS server. In this example, the Cisco Secure ACS server is used as the RADIUS server.

  1. Configure a WLAN and Enable MAC Filtering

  2. Configure the RADIUS Server with Client MAC Addresses

Configure a WLAN and Enable MAC Filtering

Complete these steps in order to configure a WLAN with MAC filtering:

  1. Click WLANs from the controller GUI in order to create a WLAN.

    The WLANs window appears. This window lists the WLANs configured on the controller.

  2. Click New in order to configure a new WLAN.

    In this example, the WLAN is named MAC-ACS-WLAN and the WLAN ID is 2.

    mac-filters-wlcs-config5.gif

  3. Click Apply.

  4. In the WLAN > Edit window, define the parameters specific to the WLAN.

    1. Under Security Policies -> Layer 2 Security, check the MAC Filtering check box.

      This enables MAC authentication for the WLAN.

    2. Under General Policies -> Interface Name, select the interface to which the WLAN is mapped.

    3. Under RADIUS servers, select the RADIUS server that will be used for MAC authentication.

      Note: Before you can select the RADIUS server from the WLAN > Edit window, you should define the RADIUS server in the Security > Radius Authentication window and enable the RADIUS server.

      mac-filters-wlcs-config6.gif

    4. Select the other parameters, which depend on the design requirements of the WLAN.

    5. Click Apply.

      mac-filters-wlcs-config7.gif

  5. Click Security > MAC Filtering.

  6. In the MAC Filtering window, choose the type of RADIUS server under RADIUS Compatibility Mode.

    This example uses Cisco ACS.

  7. From the MAC Delimiter pull down menu, choose the MAC delimiter.

    This example uses Colon.

  8. Click Apply.

    mac-filters-wlcs-config8.gif

The next step is to configure the ACS server with the client MAC addresses.

Configure the RADIUS Server with Client MAC Addresses

Complete these steps in order to add a MAC address to the ACS:

  1. Define the WLC as an AAA client on the ACS server. Click Network Configuration from the ACS GUI.

  2. When the Network Configuration window appears, define the name of the WLC, the IP address, the shared secret and the authentication method (RADIUS Cisco Aironet or RADIUS Airespace).

    Refer to the documentation from the manufacturer for other non-ACS authentication servers.

    mac-filters-wlcs-config9.gif

    Note: The shared secret key that you configure on the WLC and the ACS server must match. The shared secret is case sensitive.

  3. From the ACS main menu, click User Setup.

  4. In the User text box, enter the MAC address in order to add to the user database.

    mac-filters-wlcs-config10.gif

    Note: The MAC address must be exactly as it is sent by the WLC for both the username and the password. If authentication fails, check the failed attempts log to see how the MAC is reported by the WLC. Do not cut and paste the MAC address, as this can introduce phantom characters.

  5. In the User Setup window, enter the MAC address in the Secure-PAP password text box.

    mac-filters-wlcs-config11.gif

    Note: The MAC address must be exactly as it is sent by the WLC for both the username and the password. If authentication fails, check the failed attempts log to see how the MAC is reported by the AP. Do not cut and paste the MAC address, as this can introduce phantom characters.

  6. Click Submit.

  7. Repeat steps 2-5 in order to add more users to the ACS database.

    Now, when clients connect to this WLAN, the WLC passes the credentials to the ACS server. The ACS server validates the credentials against the ACS database. If the client MAC address is present in the database, the ACS RADIUS server returns an authentication success to the WLC and the client will be granted access to the WLAN.

Verify

Use these commands in order to verify if the MAC filter is configured correctly:

The Output Interpreter Tool ( registered customers only) (OIT) supports certain show commands. Use the OIT to view an analysis of show command output.

  • show macfilter summary—Displays a summary of all MAC filter entries.

  • show macfilter detail <client MAC Address>—Detailed display of a MAC filter entry.

Here is an example of the show macfilter summary command: 

(Cisco Controller) >show macfilter summary

MAC Filter RADIUS Compatibility mode............. Cisco ACS
MAC Filter Delimiter............................. None

Local Mac Filter Table

MAC Address               WLAN Id          Description
-----------------------   --------------   --------------------------------
00:40:96:ac:e6:57           1              Guest


(Cisco Controller) >show macfilter detail 00:40:96:ac:e6:57

Here is an example of the show macfilter detail command:

(Cisco Controller) >show macfilter detail 00:40:96:ac:e6:57

MAC Address...................................... 00:40:96:ac:e6:57
WLAN Identifier.................................. 1
Interface Name................................... mac-client
Description...................................... Guest

Troubleshoot

You can use these commands to troubleshoot your configuration:

Note: Refer to Important Information on Debug Commands before you use debug commands.

  • debug aaa all enable— Provides debugging of all AAA messages.

  • debug mac addr <Client-MAC-address xx:xx:xx:xx:xx:xx>—In order to configure MAC debugging, use the debug mac command.

Here is an example of the debug aaa all enable command:

Wed May 23 11:13:55 2007: Looking up local blacklist 004096ace657
Wed May 23 11:13:55 2007: Looking up local blacklist 004096ace657
Wed May 23 11:13:55 2007: User 004096ace657 authenticated
Wed May 23 11:13:55 2007: 00:40:96:ac:e6:57 Returning AAA Error 'Success' (0) 
                          for mobile 00:40:96:ac:e6:57
Wed May 23 11:13:55 2007: AuthorizationResponse: 0xbadff97c
Wed May 23 11:13:55 2007: 	structureSize................................76
Wed May 23 11:13:55 2007: 	resultCode...................................0
Wed May 23 11:13:55 2007: 	protocolUsed.................................0x00000008
Wed May 23 11:13:55 2007: 	proxyState...................................
                                00:40:96:AC:E6:57-00:00
Wed May 23 11:13:55 2007: 	Packet contains 2 AVPs:
Wed May 23 11:13:55 2007: 	    AVP[01] Service-Type.............................
                                    0x0000000a (10) (4 bytes)
Wed May 23 11:13:55 2007: 	    AVP[02] Airespace / Interface-Name...............
                                    staff-vlan (10 bytes)
Wed May 23 11:13:55 2007: 00:40:96:ac:e6:57 processing avps[0]: attribute 6
Wed May 23 11:13:55 2007: 00:40:96:ac:e6:57 processing avps[1]: attribute 5
Wed May 23 11:13:55 2007: 00:40:96:ac:e6:57 Applying new AAA override for 
                          station 00:40:96:ac:e6:57
Wed May 23 11:13:55 2007: 00:40:96:ac:e6:57 Override values for station 00:40:96:ac:e6:57	
source: 2, valid bits: 0x200 qosLevel: -1, dscp: 0xffffffff, dot1pTag: 0xffffffff, 
sessionTimeout: -1	dataAvgC: -1, rTAvgC: -1, dataBurstC: 

-1, rTimeBurstC: -1	vlanIfName: 'mac-client'

When a wireless client is not present in the MAC address database on the WLC (local database) or on the RADIUS server tries to associate to the WLAN, that client will be excluded. Here is an example of the debug aaa all enable command for an unsuccessful MAC authentication:

Wed May 23 11:05:06 2007: Unable to find requested user entry for 004096ace657
Wed May 23 11:05:06 2007: AuthenticationRequest: 0xa620e50
Wed May 23 11:05:06 2007: 	Callback.....................................0x807e724
Wed May 23 11:05:06 2007: 	protocolType.................................0x00000001
Wed May 23 11:05:06 2007: 	proxyState...................................
                                00:40:96:AC:E6:57-00:00
Wed May 23 11:05:06 2007: 	Packet contains 14 AVPs (not shown)
Wed May 23 11:05:06 2007: 00:40:96:ac:e6:57 Returning AAA Error 'No Server' (-7) 
                          for mobile 00:40:96:ac:e6:57
Wed May 23 11:05:06 2007: AuthorizationResponse: 0xbadff7e4
Wed May 23 11:05:06 2007: 	structureSize................................28
Wed May 23 11:05:06 2007: 	resultCode...................................-7
Wed May 23 11:05:06 2007: 	protocolUsed.................................0xffffffff
Wed May 23 11:05:06 2007: 	proxyState...................................
                                00:40:96:AC:E6:57-00:00
Wed May 23 11:05:06 2007: 	Packet contains 0 AVPs:

Wireless Clients that Try to Authenticate by MAC Address are Rejected; Failed Authentication Report Shows Internal Errors

When you use ACS 4.1 that runs on a Microsoft Windows 2003 Enterprise server, clients that try to authenticate by the MAC address are rejected. This occurs when an AAA client sends the Service-Type=10 attribute value to the AAA server. This is because of Cisco bug ID CSCsh62641 ( registered customers only) . AAA clients affected by this bug include WLCs and switches that use MAC Authentication Bypass.

The workarounds are:

  • Downgrade to ACS 4.0.

    or

  • Add the MAC addresses to be authenticated to a Network Access Protection (NAP) under the internal ACS DB MAC address table.

Not able to add a MAC filter using the WLC GUI

This can happen becaue of the Cisco bug ID CSCsj98722 ( registered customers only) . The bug is fixed in 4.2 release of code. If you are running versions earlier than 4.2, you can upgrade the firmware to 4.2 or use these two workarounds for this issue.

  • Use the CLI in order to configure the MAC Filter with this command:

    config macfilter add <MAC address>  <WLAN ID#> <Interface>

  • From the Web GUI of the controller, choose Any WLAN under the Security tab and enter the MAC address to be filtered.

Use the CLI to Configure the MAC Filter on WLC

This document previously discussed how to use the WLC GUI to configure MAC filters. You can also use the CLI in order to configure MAC filters on the WLC. You can use these commands in order to configure the MAC filter on WLC:

  • config macfilter add command:

    The config macfilter add command lets you add a macfilter, interface, descripton, and so forth.

    Use the config macfilter add command in order to create a MAC filter entry on the Cisco Wireless LAN controller. Use this command in order to add a client locally to a wireless LAN on the Cisco Wireless LAN controller. This filter bypasses the RADIUS authentication process.

    config macfilter add MAC_address wlan_id [interface_name] 
[description] [IP address]

    Example:

    Enter a static MAC-to-IP address mapping. This can be done to support a passive client, that is, one that does not use DHCP and does not transmit unsolicited IP packets.

    >config macfilter add 00:E0:77:31:A3:55 1 lab02 "labconnect" 10.92.125.51

  • config macfilter ip-address command

    The config macfilter ip-address command lets you map an existing MAC-filter to an IP address. Use this command in order to configure an IP address into the local MAC filter database:

    config macfilter ip-address 
	 MAC_address IP address

    Example: 

    >config macfilter add 00:E0:77:31:A3:55 1 lab02 "labconnect" 10.92.125.51

Authorize LAPs against an AAA Server

This section explains how to configure the WLC to authorize LAPs using an AAA server. This example uses Cisco Secure ACS as the AAA server.

Complete these steps in order to configure the WLC for an external RADIUS server:

  1. Click Security and RADIUS Authentication from the controller GUI in order to display the RADIUS Authentication Servers page. Then, click New in order to define a RADIUS server.

  2. Define the RADIUS server parameters in the RADIUS Authentication Servers > New page. These parameters include the RADIUS Server IP Address, Shared Secret, Port Number, and Server Status.

  3. Click Apply.

Complete these steps in order to configure the WLC so the APs authenticate against the ACS:

  1. Click Security and AP Policies from the AAA menu on the left side.

  2. Check the Authorize APs against AAA server checkbox.

Next, you need to configure the ACS server to authorize the LAPs. Complete these steps:

  1. Define the controller as an AAA client on the ACS server. On the ACS server, click Network Configuration and choose Add entry.

  2. Add the WLC hostname, IP address and matching shared key. For authenticate using, choose RADIUS Cisco Aironet or Cisco Airespace if you use ACS 4.0.

  3. From the ACS main menu, click User Setup.

  4. In the User text box, enter the MAC address of the LAP in order to add to the user database.

    Note: The MAC address must be exactly as it is sent by the WLC for both the username and the password. If authentication fails, check the failed attempts log to see how the MAC is reported by the WLC. Do not cut and paste the MAC address, as this can introduce phantom characters.

  5. In the User Setup window, enter the MAC address in the Secure-PAP password text box.

  6. Click Submit.

  7. Repeat these steps in order to add more users to the ACS database.

    Now, when the LAPs try to register with the WLC, the MAC address of the LAP is validated against the AAA server. Upon successful validation, the LAPs can register with the controller.

NetPro Discussion Forums - Featured Conversations

Networking Professionals Connection is a forum for networking professionals to share questions, suggestions, and information about networking solutions, products, and technologies. The featured links are some of the most recent conversations available in this technology.
NetPro Discussion Forums - Featured Conversations for Wireless
Wireless - Mobility: WLAN Radio Standards
Wireless - Mobility: Security and Network Management
Wireless - Mobility: Wireless IP Voice and Video
Wireless - Mobility: Getting Started with Wireless
Wireless - Mobility: General

Related Information

Updated: May 29, 2007Document ID: 91901