With the Cisco IOS-XE 17.18 release, APs support MAC address authorization using different delimiter formats to enhance the controller’s support, which previously did not accept any delimiter.

IOS AAA config mac-delimiter and subscriber mac-filtering security-mode <> under AAA group server RADIUS is enabled for this feature for wireless AP join cases.

Note

To authenticate an AP using its MAC address:

Set the mac-filter flag to yes. This setting configures AAA to send the username with the specified delimiter and sets the MAC filter flag.

Configure AAA server groups that include the IP addresses of the selected server hosts. This configuration allows you to group existing server hosts, select a subset of the configured server hosts, and use them for a particular service.

By arranging server groups and configuring them using the global server-host list, you can manage services with a more structured and secure approach.

Feature history for AP MAC authorization

This table provides release and related information for the feature explained in this module.

This feature is also available in all the releases subsequent to the one in which they are introduced in, unless noted otherwise.

Table 1. Feature history for access point upgrade management enhancements
Release	Feature Information
Cisco IOS XE 17.18.1	AP MAC authorization enables APs to gain support for MAC address authorization using various delimiter formats. The feature improves the controller's support for this security feature. To enable this functionality for wireless AP join cases, the mac-delimiter and subscriber mac-filtering security-mode configurations under the AAA group server RADIUS are utilized.

Create a AAA RADIUS server (GUI)

Configure a AAA RADIUS server using the GUI.

Procedure

	1.	Choose Configuration > Security > AAA > Server Groups > RADIUS.
	2.	Click the Add button. The Create AAA Radius Server Group dialog box is displayed.
	3.	Enter a name for the RADIUS server in the Name field.
	4.	Enter the IPv4/IPv6 server address in the Server Address.
	5.	(Optional) Choose Clear Text from the Key Type drop-down list.
	6.	Add Key. Note If global encryption is enabled, then all keys or passwords are encrypted.
	7.	Match the Key with the Confirm Key field.
	8.	Click Apply to Device.

Configure a AAA RADIUS server (CLI)

Configure a AAA RADIUS server using the CLI.

Procedure

Enter the global configuration mode.

Example:

Device# configure terminal

Configure the RADIUS server name to enter the RADIUS server configuration mode.

Example:

Device(config)# radius server ISE

ISE is the user-defined string.

Specify the RADIUS server parameters.
Example:
```
Device(config-radius-server)# address ipv4 209.165.201.1 auth-port 1812 acct-port 1813
```
For auth-port port number, specify the UDP destination port for authentication requests. The range is from 0 to 65536 and the default is 1812.

For acct-port port number, specify the UDP destination port for accounting requests. The default is 1813.
Configure the RADIUS per-server encryption key.
Example:
```
Device(config-radius-server)#  key rad123
```

Save the configuration, exit configuration mode, and return to privileged EXEC mode.

Example:

Device(config-sg-radius)# end

Create a AAA Group configuration (GUI)

Create a new AAA group using the GUI.

Procedure

	1.	Choose Configuration > Security > AAA > Server Groups > RADIUS > Server Groups.
	2.	Click the Add button. The Create AAA Radius Server Group dialog box is displayed.
	3.	Enter a name for the RADIUS server in the Name field.
	4.	Add RADIUS as Group Type.
	5.	Select a MAC-Delimiter from the drop-down list. The available options are colon, hyphen, single-hyphen, and none.
	6.	Select MAC-Filtering from the drop-down list. The available options are mac, key, and none. The option none is supported only when both MAC-Delimiter and MAC-Filtering are set to the same value.
	7.	Add the newly created AAA group from Available Servers to Assigned Servers.
	8.	Click Apply to Device.

Configure a AAA Group configuration (CLI)

Configure a AAA group configuration using the CLI.

Procedure

	1.	Enter the global configuration mode. Example: `Device# configure terminal`
	2.	Configure the RADIUS server group name and server group configuration. Example: `Device(config)# aaa group server radius MY-SERVER-GROUP`
	3.	Re-format the delimiter of the username attribute. Example: `Device(config-sg-radius)# mac-delimiter {colon \| hyphen \| none \| single-hyphen}` The options are: colon : Sets the delimiter to colon (for example, xx:xx:xx:xx:xx:xx). hyphen : Sets the delimiter to hyphen (for example, xxxxxxxxxxxx). none : Sets the delimiter to none (for example, xx-xx-xx-xx-xx-xx). single-hyphen : Sets the delimiter to single-hyphen (for example, xxxxxx-xxxxxx). Note The default delimiter is none . If nothing is configured, none is set to the username, that is, the MAC address goes without any delimiter to the respective RADIUS server.
	4.	Set the MAC address as the password. Example: `Device(config-sg-radius)#subscriber mac-filtering security-mode {mac \| none \| shared secret}` The options are: mac : The delimiter format of the MAC address in the RADIUS user password attribute is same as that of the MAC address string in the RADIUS username attribute. none : MAC address string without any delimiter is sent as RADIUS user password. shared-secret : The shared-secret option is not supported for the AP join use case. Note The default delimiter is none . If nothing is configured, the user password attribute is sent as the MAC address without delimiter. If mac is configured as the delimiter, then the delimiter format of the username attribute is applied to the MAC address string of the user password attribute.
	5.	Associate the RADIUS server to the server group. Example: `Device(config-sg-radius)# server name ISE`
	6.	Configure the authorization method list with the named RADIUS server group. Example: `Device(config)# aaa authorization credential-download MY-METHOD-LIST group MY-SERVER-GROUP`
	7.	Save the configuration, exit configuration mode, and return to privileged EXEC mode. Example: `Device(config-sg-radius)# end`

Create a AAA Group Server configuration (GUI)

Create a AAA Group My Server configuration using the GUI.

Procedure

	1.	Choose Configuration > Security > AAA > AAA Method List > Authorization.
	2.	Click the Add button. The Quick Setup: AAA Authorization dialog box is displayed.
	3.	Enter a name in the Method List Name field.
	4.	Select Type as Credential-Download from the drop-down list.
	5.	Select Group Type as Group from the drop-down list.
	6.	Add the newly created AAA group from Available Server Groups to Assigned Server Groups.
	7.	Click Apply to Device.

Create a AAA Group Method List configuration (GUI)

Create a AAA group method Method List configuration using the GUI.

Procedure

	1.	Choose Configuration > Security > AAA > AAA Advanced > AP Policy.
	2.	Use the toggle button to enable Authorize APs against MAC and configure ap auth-list authorize-mac on your controller.
	3.	Select AP-MAC-Method for Authorization Method List from the drop-down list to configure ap auth-list method-list MY-METHOD-LIST on your controller.
	4.	Click Apply.

Configure AP MAC authorization (CLI)

Configure AP MAC authorization using the CLI.

Procedure

	1.	Enter the global configuration mode. Example: `Device# configure terminal`
	2.	Configure AP authorization list. Example: `Device(config)# ap auth-list {authorize-mac \| method-list method-list-name}` The options are: authorize-mac : Sets AP authorization policy with MAC. method-list : Sets AP authorization method-list.
	3.	Enter the method-list to be used for AP MAC authorization. Example: `Device(config)# ap auth-list method-list MY-METHOD-LIST mac`
	4.	Save the configuration and return to privileged EXEC mode. Example: `Device(config-ap-auth-list)# exit`

Verify MAC authorization details

Verify AP authentication list

To verify if the controller has enabled the AP authentication list, run the show ap auth-list command.

Device# show ap auth-list

Authorize APs against MAC : Disabled
Authorize APs against Serial Num : Enabled
Authorization Method List : <auth-list-name>

Verify AP status summary

To verify the status summary of all Cisco lightweight APs attached to the device, run the show ap summary command.

Device# show ap summary

Number of APs: 1

Global AP User Name: Cisco
Global AP Dot1x User Name: Not configured

AP Name                           AP Model  Ethernet MAC    Radio MAC       State         
----------------------------------------------------------------------------------------
3602a                             3502I     003a.99eb.3fa8  d0c2.8267.8b00  Registered

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.