|Description||This article describes the constraints and requirements related to MAB in FortiSwitch.|
|Scope||All FortiSwitch models.|
MAB is used for devices that do not support 802.1X authentication.
If you enable the MAB option on the port, the system will use the device's MAC address as the username and password for authentication.
MAB configuration in FortiSwitch :
However, note the below constraints when using MAB :
1) Ensure 'Auto' is configured for the Radius server configuration.
set auth-type "auto" uses PAP, MSCHAP_v2, and CHAP (in that order).
'chap': Challenge Handshake Authentication Protocol.
FortiSwitch # show user radius
FortiSwitch will send radius requests out for MAB only if 'auto' or 'pap' is configured in the radius client configuration.
2) 'sticky mac' should not be enabled on the FortiSwitch port set with 802.1x. This means:
FortiSwitch (interface) # edit port1
FortiSwitch (port1) # show full-configuration | grep sticky
Enabling Sticky-mac will cause MAB to timeout and is not supported for all releases and all FortiSwitch models.