- MAC Authentication Bypass or MAB,
does exactly what the name implies.
This is a method of fallback for bypassing 802.1x
access control, using the MAC address of an endpoint.
The main thing to note about MAB,
is that there is no standard for implementing this.
It's vendor specific, and is implemented
in many different ways.
In a working EEP configuration, we would have a supplicant,
an authenticator and an authentication server.
If you don't remember how that process works,
I would encourage you to go back and watch the 802.1x
overview video, in this module.
Or check out the EEP overview and configuration
in the wireless security module.
For more insight into that.
I'm assuming that you're already familiar with this process,
when we discuss MAB here.
In the case of using MAB as a fallback method,
that would come into play when we have an endpoint
with no supplicant software installed.
In this case, when the client connects to the network,
let's say, that's a printer,
because that's a fairly common device,
that might not have the supplicant capabilities.
We can see the MAC address listed for that printer
here as well.
Now by default, with 802.1x enabled, every 30 seconds,
the authenticator or the witch, in our case,
that's going to send out,
an EEP over LAN identity request message, to the printer.
After that timeout period, which is going to be
three attempts at 90 seconds each,
for a total of 90 seconds.
After that timeout,
the switch is going to make the determination,
that the client does not
have a supplicant software installed.
And it can then begin the MAB process,
if it's configured to do so.
The authenticator switch will need to have MAB enabled,
for the specific port that the device is connected to,
in order to begin the bypass procedure.
The switch will begin this process by accepting
a single packet on the connected port.
It's going to use this packet to learn the MAC address
of the connected client.
So any packets that will be sent during the .1x
authentication attempt, those are going to be discarded.
So it can't glean the MAC address from those packets.
The switch will learn the MAC, and it will then discard
the single packet that it used
to learn the MAC address from.
The switch can use almost any layer two or layer three
packet to learn those MAC addresses,
with the exception being, frames such as,
Cisco Discovery Protocol, Link Layer Discovery Protocol,
Spanning Tree and Dynamic Trunking Protocol.
The authenticator will then create
a RADIUS access-request message.
Using the endpoints MAC address for the identity.
It's going to forward that, to the authentication server,
which is a RADIUS server.
The RADIUS authentication server, is then going to make
a determination, as to whether or not the device
is allowed on the network.
That could be learned from sticky MAC address
assignment on the port, or that could be checked
against an access control list for MAC addresses,
if we're using a Cisco ISE, as we see in this case.
Or that could allow all MAC's as well.
So there are several options there.
But once that's determined, a RADIUS access accept message
is going to be sent from the authentication server,
to the authenticator.
And the authenticator is either going to permit or deny
access to the network, based on that message.
Now a couple of things to know here,
that are relevant to MAB.
First, MAC addresses are very easily spoofed.
So it's not a good idea to provide full access
to devices that have MAB configured.
You might want to isolate those to their own V LAN,
or security group.
Also, since MAB uses standard RADIUS messaging,
there's really no limit to the type of results that can
be sent from the authentication server
during the authorization process.
So you could do, many, many things here.
For example, if the client is deemed to be a
valid network endpoint.
You could configure Cisco ISE to assign them
to a specific V LAN.
You could add a security group tag.
Or you could use, per user access control lists as well.
You do want to know that MAB is not a very secure
technology though, so you'll want to be very choosy
with how, and where you implement that.
So that's an overview of MAC authentication bypass, or MAB.