MAC Authentication

[Chad5]

Hello,

Am looking into enabling NAC on our network and unfortunately, I have to use MAC AUTH for some end devices that don’t support 802.1X. OF course, using MAC AUTH is nothing but a deterrent as it’s very easy to spoof MACs… 

However, I find when I enable MAC AUTH on XMC, the first question is what password to use. I am wondering what is the use of using a password or no password? My radius communication is protected by the shared key, in PAP (which EXOS does) anyways… it’s only between switch and NAC so what point is it to add a password? if someone uses a device with the same MAC, they get access to network anyways.

Any insight would be great 🙂

Thanks,

[Chad5]

Thank you for the replies.

I am familiar with the various options for MAC auth user/password. what I was eluding to is that having a password does not add to the security of MAC AUTH (if a key is chosen for example). It only adds a password between switch and radius server, where is already a shared key. It does not add any benefit on the client side (between client and switch). MAC spoofing is very simple to do. not much we can do about it.

Thanks,

[Miguel-Angel_RO]

Hi Chad,

You have to look on both sides for this.

On XMC what is possible AND on your switch to see what password options are common to both devices.

You’ll use the one you prefer, usually people stick to the MAC address as password.

Here a screenshot from an ERS switch:

Mig

[Stefan_K_]

Does this help: XMC MAC Authentication Settings | Extreme Networks Support Community ?

“when the new MAC is seen on the port the switch does generate radius request to the radius server. The request does have username and password. The username is the mac address. The password is what you can define.”