Client Connection Control

A Media Access Control (MAC) address is a hardware address that uniquely identifies each node of a network. All IEEE 802 network devices share a common 48-bit MAC address format, usually displayed as a string of 12 hexadecimal digits separated by colons, for example 00:DC:BA:09:87:65. Each wireless network interface card (NIC) used by a wireless client has a unique MAC address.

You can use the Administrator UI on the AP or use an external RADIUS server to control access to the network through the AP based on the MAC address of the wireless client. This feature is called MAC Authentication or MAC Filtering. To control access, you configure a global list of MAC addresses locally on the AP or on an external RADIUS server. Then, you set a filter to specify whether the clients with those MAC addresses are allowed or denied access to the network. When a wireless client attempts to associate with an AP, the AP looks up the MAC address of the client in the local Stations List or on the RADIUS server. If it is found, the global allow or deny setting is applied. If it is not found, the opposite is applied.

On the Virtual Access Point Settings page, the MAC Auth Type setting controls whether the AP uses the station list configured locally on the Client Connection Control page or the external RADIUS server. The Allow/Block filter setting on the Client Connection Control page determines whether the clients in the station list (local or RADIUS) can access the network through the AP.

Note: Global MAC Authentication settings apply to all VAPs.

Field	Description
Filter	To set the MAC Address Filter, select one of the following options: Allow only stations in list. Any station that is in the Stations List is allowed access to the network through the AP; all other stations are denied. Block all stations in list. Only the stations that appear in the list are denied access to the network through the AP. All other stations are permitted access. Note: The filter you select is applied to the clients in the station list, regardless of whether that station list is local or on the RADIUS server.
Stations List	This is the local list of clients that are either permitted or denied access to the network through the AP. To add a MAC Address to the local Stations List, enter its 48-bit MAC address into the MAC Address text boxes, then click Add. To remove a MAC Address from the Stations List, select its 48-bit MAC address, then click Remove. The stations in the list will either be allowed or denied access based on how you set the filter in the previous field. Note: If the MAC authentication type for the VAP is set to Local, the AP uses the Stations List to permit or deny the clients access to the network. If the MAC authentication type is set to RADIUS, the AP ignores the MAC addresses configured in this list and uses the list that is stored on the RADIUS server. The MAC authentication type is set on the VAP configuration page.

Note: After you configure local MAC Authentication settings, you must click Apply to apply the changes and to save the settings. Changing some settings might cause the AP to stop and restart system processes. If this happens, wireless clients will temporarily lose connectivity. We recommend that you change AP settings when WLAN traffic is low.

Configuring MAC Authentication on the RADIUS Server

If you use RADIUS MAC authentication for MAC-based access control, you must configure a station list on the RADIUS server. The station list contains client MAC address entries, and the format for the list is described in the following table.

RADIUS Server Attribute	Description	Value
User-Name (1)	MAC address of the client station.	Valid Ethernet MAC Address.
User-Password (2)	A fixed global password used to lookup a client MAC entry.	NOPASSWORD