WeOS
5.29.0

# MAC authentication using accept list HowTo

## Introduction

This document describes a setup of MAC authentication using a local MAC accept list to authorise MAC addresses.

## Overview

For an overview of all available configuration settings for Port Access Control, refer to the configuration section in the Port Access Control Guide.

Below is the topology of the devices in this setup.

                                            |
                                          .--.-.
                                         ( (    )__
                                       (_,  \ ) ,_)
                                         '-'--`--'
                                            | GW 10.0.2.1
                                            |    VLAN 2
                                            |    10.0.2.0/24
                                            | 10.0.2.2
     Authenticator  .--+------+------+------+--.
    (Switch/Router) |  5      6      7      8  |
    with Accept-List|           WeOS           |
       10.0.1.1     |  1      2      3      4  |
                    '--+------+------+------+--'
                       X      X      X      X  <== Controlled Ports
                       |    VLAN 1              (All Blocked by
                       |    10.0.1.0/24          Authenticator)
                    .--+-.
                    | H1 | (Host/Supplicant)
                    '----' IP 10.0.1.43/24
                           GW 10.0.1.1

Figure 1: A basic setup of port access control using MAC Authentication. Ports eth1-eth4 are controlled. Here ports eth1-eth7 are on VLAN 1 and eth8 is on VLAN 2, but they could be on the same VLAN.

## Configuration

First VLANs and IP addresses of the WeOS router is configured, see Figure 1 above. It is assumed that all ports are assigned (untagged) to VLAN 1 from start. For more information, see VLAN configuration.

    example:/#> config
    example:/config/#> vlan 2
    example:/config/vlan-2/#> untagged eth8
    example:/config/vlan-2/#> end
    example:/config/#> iface vlan1
    example:/config/iface-vlan1/#> no inet
    example:/config/iface-vlan1/#> inet static 10.0.1.1/24
    example:/config/iface-vlan1/inet-static-10.0.1.1/#> end
    example:/config/iface-vlan1/#> end
    example:/config/#> iface vlan2
    example:/config/iface-vlan2/#> inet static 10.0.2.2/24
    example:/config/iface-vlan2/inet-static-10.0.2.2/#> end
    example:/config/iface-vlan2/#> end
    example:/config/#> ip
    example:/config/ip/#> route default 10.0.2.1
    example:/config/ip/#> leave
    example:/#>

A MAC authentication list configured. This is done in the AAA context.

    example:/#> config
    example:/config/#> aaa
    example:/config/aaa/#> mac-auth 1
    example:/config/aaa/mac-auth-1/#> mac match 00:80:c8:3c:25:b8 description "My PC"
    example:/config/aaa/mac-auth-1/#> leave
    example:/config/#> leave
    example:/#>

See MAC match Settings for more information on how to configure a MAC authentication list.

With a MAC authentication list created, enabling MAC Authentication on ports eth1-eth4 can be done as follows.

    example:/#> config
    example:/config/#> port-access
    Creating new Port Access instance 1.
    example:/config/port-access-1/#> port eth1..eth4
    example:/config/port-access-1/#> description "Site A"
    example:/config/port-access-1/#> port-method mac-based
    example:/config/port-access-1/#> mac-authentication
    example:/config/port-access-1/mac-auth/#> accept-list 1
    example:/config/port-access-1/mac-auth/#> leave
    example:/#>

Port Method

In this example we explicitly set the port method to `mac-based`, which is also the default setting. With this method, each individual client must be authenticated and its MAC address is unlocked on the port. For more information about port methods, see Port Method.

## Status

Port access status can be shown by issuing `show port-access` in the admin context.

    example:/#> show port-access
    Number of Port Access Instances: 1
    Table Instance Dividers        : Disabled

    ╒ 802.1X Authentications ════════════════════════════════════════════════════╕
    │#  MAC-ADDRESS        SUPPLICANT    PORT    SERVER           DATE-ADDED     │
    │No authenticated 802.1X clients found.                                      │
    └────────────────────────────────────────────────────────────────────────────┘

    ╒ MAC Auth Authentications ══════════════════════════════════════════════════╕
    │#  MAC-ADDRESS        PORT    METHOD                         DATE-ADDED     │
    │1  00:80:c8:3c:25:b8  eth1    Whitelist                      Nov 22 18:40:21│
    └────────────────────────────────────────────────────────────────────────────┘

    ╒ Ports ═════════════════════════════════════════════════════════════════════╕
    │PORT    METHOD      STATE                           AUTHENTICATED-MAC       │
    │eth1    MAC Based   1 Authentication                00:80:c8:3c:25:b8       │
    │eth2    MAC Based   0 Authentications               -                       │
    │eth3    MAC Based   0 Authentications               -                       │
    │eth4    MAC Based   0 Authentications               -                       │
    └────────────────────────────────────────────────────────────────────────────┘

    ╒ VLAN Assignment ═══════════════════════════════════════════════════════════╕
    │PORT    ENABLED  STATE       FROM     ASSIGNING-CLIENT   VLAN               │
    │eth1    No       Unassigned  -        -                  -                  │
    │eth2    No       Unassigned  -        -                  -                  │
    │eth3    No       Unassigned  -        -                  -                  │
    │eth4    No       Unassigned  -        -                  -                  │
    └────────────────────────────────────────────────────────────────────────────┘

    - Use 'show port-access audit' to display related events in the audit log.
    - Use 'show port-access INSTANCE' to show details for a specific instance.
    - Use 'port-access instance-dividers' to enable dividers between instances
      in the tables.
    example:/#>

For more information about the status output and the different tables, see Port Access Control Status.

« Previous Next »