Technical Tip: How to enable MAC address bypass on FortiGate interfaces
Description
This article describes how to enable a MAC address bypass on FortiGate interfaces. MAC Authentication Bypass (MAB) is supported to accept non-802.1X compliant devices onto the network using their MAC address as authentication.
Scope
All FortiOS versions
Solution
MAB can be enabled on FortiGate as below:
config sys interface
edit "someinterface"
set vdom "root"
set ip 192.168.1.1 255.255.255.0
set allowaccess ping radius-acct
set security-mode captive-portal
set security-mac-auth-bypass enable <----- Can be enabled only via the CLI.
set security-external-web "https://<FAC-fqdn>/portal/ "
set security-groups "radius-group"
set security-exempt-list "FAC-exempt-list"
set device-identification enable
set role lan
next
end
With MAB enabled like this, when client attempts a connection, FortiGate will generate a RADIUS authentication Access-Request using the endpoint's MAC address as the username (and password) to the FortiAuthenticator (set up as RADIUS server).
FortiAuthenticator will verify the MAB request against Authentication -> User management -> MAC Devices. It will return an Access-Accept response with authorized group name RADIUS attributes if the MAC address is authorized, or an Access-reject otherwise. Additional Attributes can be returned, if this MAC Device is member of a group with the required attributes.
Upon an Access-Accept response and correct group membership, the end-user browser bypasses the captive portal and is allowed through to the requested website.
If an Access-Reject is received, the normal captive portal workflow will continue according to the captive portal flow mentions in this Troubleshooting Tip: General captive portal explanation, flow and troubleshooting.
Refer to the following for more details on setup with respect to FortiAuthenticator:
Technical Tip: FortiAuthenticator MAC Address Bypass (MAB) implementation
