Administrator Guide

324 Authentication, Authorization, and Accounting
• Considers the client to be 802.1X unaware client (if it does not receive an
EAP response packet from that client)
The authenticator sends a request to the authentication server with the MAC
address of the client in a hexadecimal format as the username and the MD5
hash of the MAC address as the password. The authentication server checks
its database for the authorized MAC addresses and returns an Access-Accept
or an Access-Reject response, depending on whether the MAC address is
found in the database. MAB also allows 802.1X-unaware clients to be placed
in a RADIUS-assigned VLAN or to apply a specific Filter ID to the client
traffic.
The following information is sent to the RADIUS authenticator for MAB
clients using EAP-MD5 authentication:
1 - User-Name — MAC address of MAB device (AA:BB:CC:DD:EE:FF)
Attribute 2 is not sent if Auth type is EAP-MD5.
4 - NAS-IP-Address — IP address of the switch
5 - NAS-Port — switch internal port number (ifIndex)
6 - Service Type 10 (Call-Check)
12 - Framed-MTU - port/switch MTU - header length (e.g. 1500)
30 - Called Station ID — MAC address of device (xx:xx:xx:xx:xx:xx format)
31 - Calling Station ID — Switch MAC address
61 - NAS-Port-Type (Ethernet 15)
80 - Message Authenticator
87- NAS-Port-Id (such as Gigabitethernet 1/0/15)
79-EAP-Message
The format of the Calling-Station-ID for MAB clients may be altered using
the attribute 31 command. The format of the User-Name attribute for MAB
clients may be altered using the attribute 1 command.
By default, MAB clients are authenticated to the authentication server using
EAP-MD5. MAB clients may optionally be configured to use CHAP or PAP to
authenticate the MAB device. For CHAP or PAP, the following attributes are
sent to the RADIUS server:
1 - User-Name — MAC address of MAB device
2 - User Password (PAP only)