FortiSwitch: secure, simple and scalable Ethernet solutions
Article Id 258040
Description This article describes the constraints and requirements related to MAB in FortiSwitch.
Scope All FortiSwitch models.

MAB is used for devices that do not support 802.1X authentication.

If you enable the MAB option on the port, the system will use the device's MAC address as the username and password for authentication.

MAB configuration in FortiSwitch :


However, note the below constraints when using MAB :


1) Ensure 'Auto' is configured for the Radius server configuration.


set auth-type "auto" uses PAP, MSCHAP_v2, and CHAP (in that order).

'chap': Challenge Handshake Authentication Protocol.
'ms_chap': Microsoft Challenge Handshake Authentication Protocol.
'ms_chap_v2': Microsoft Challenge Handshake Authentication Protocol version 2.
'pap': Password Authentication Protocol.

MAB will use PAP.


FortiSwitch # show user radius
    config user radius
        edit "Radius-server"
            set auth-type "auto" 
            set secret ENC <>
            set server ""


FortiSwitch will send radius requests out for MAB only if 'auto' or 'pap' is configured in the radius client configuration.


2) 'sticky mac' should not be enabled on the FortiSwitch port set with 802.1x. This means:

FortiSwitch # config switch interface

FortiSwitch (interface) # edit port1

FortiSwitch (port1) # show full-configuration | grep sticky
    set sticky-mac disable  


Enabling Sticky-mac will cause MAB to timeout and is not supported for all releases and all FortiSwitch models.