|
MAB is used for devices that do not support 802.1X authentication.
If you enable the MAB option on the port, the system will use the device's MAC address as the username and password for authentication.
MAB configuration in FortiSwitch :
https://docs.fortinet.com/document/fortiswitch/7.2.3/administration-guide/110307/mac-authentication-...
However, note the below constraints when using MAB :
1) Ensure 'Auto' is configured for the Radius server configuration.
set auth-type "auto" uses PAP, MSCHAP_v2, and CHAP (in that order).
'chap': Challenge Handshake Authentication Protocol.
'ms_chap': Microsoft Challenge Handshake Authentication Protocol.
'ms_chap_v2': Microsoft Challenge Handshake Authentication Protocol version 2.
'pap': Password Authentication Protocol.
MAB will use PAP.
FortiSwitch # show user radius
config user radius
edit "Radius-server"
set auth-type "auto"
set secret ENC <>
set server "10.61.65.91"
next
end
FortiSwitch will send radius requests out for MAB only if 'auto' or 'pap' is configured in the radius client configuration.
2) 'sticky mac' should not be enabled on the FortiSwitch port set with 802.1x. This means:
FortiSwitch # config switch interface
FortiSwitch (interface) # edit port1
FortiSwitch (port1) # show full-configuration | grep sticky
set sticky-mac disable
Enabling Sticky-mac will cause MAB to timeout and is not supported for all releases and all FortiSwitch models.
|
