Description
This article describes FortiAuthenticator MAC Address Bypass (MAB) implementation.
MAC Address Bypass (MAB) offers network access control for endpoints/hosts that do not support IEEE 802.1X.
This is the case for devices such as printers, cameras, IP phones and other IoT devices. These types of devices are considered 'headless' which means there is no User associated with them. In cases where 802.1x fails, we can enable MAB on the switches as a fallback.
MAB configuration requires extra configuration steps on the third party switch (Authenticator/Client) which will forward access-requests to FortiAuthenticator (Authentication Server). This is out of the scope of this KB since different vendors have their own documentation for MAB.
For FortiSwitch MAB configuration check Fortinet Documentation:
Scope
FortiAuthenticator
MAB
Solution
The Implementation of MAB in FortiAuthenticator consists in importing the MAC device addresses and creating groups for different device types and VLANs.
As an example, we will create two groups (Printers, and Access Points) and authorize them in the RADIUS Policies.
In the end, the Radius Client (FortiGate) will be configured which will forward the authentication requests to FortiAuthenticator (Authentication Server).
1) Import the MAC devices in User Management -> MAC Devices.
Devices can be imported manually or through a CSV file.
Need to define two Fields: Name, MAC Address.
2) Create a group for Printers and add the required MAC addresses.
Expand the Radius Attributes field and add the needed VLAN attributes to match these printers:
The RADIUS user attributes used for VLAN ID assignment are:
- (Tunnel Type) - Set this value to 'VLAN'.
- (Tunnel Medium Type): Set this value to '802'.
- (Tunnel Private Group ID) Set this to the VLAN access value. In this example, the printers are in VLAN 100.
*** Repeat the same steps for another group named 'MAP FortiAP' of which the access points will be part. Assign another VLAN access value for this group in the Radius Attributes.
3) Add the third-party switch as Radius Client.
In this case, add a FortiGate.
The secret entered here must match the one on the FortiGate side. Verify that a connectivity test gives a successful outcome.
4. Configure the RADIUS policy for MAB.
a) Specify the name and Client list.
b) (Optional) attribute criteria to be matched in the access-request.
c) Select MAB as the authentication type.
d) Authorize the MAB groups created before.
e) RADIUS response for Unauthorized devices.
For debugging and troubleshooting check the following articles:
