Cloud Managed Networks

 View Only

  • 1.  Aruba Central - Creating an SSID that allows usename/password as well as MAC authentication

    Posted 16 days ago

    Hello All

    I want to create an SSID that we use a username and password to login but only allows specific MAC addresses to connect.

    I have been looking but cannot find a solution that enables both.

    Is somebody able to assist?

    Thanks

    Glenn



  • 2.  RE: Aruba Central - Creating an SSID that allows usename/password as well as MAC authentication

    Posted 16 days ago

    Yes, you can do both on one SSID. Make it an Enterprise (802.1X) WLAN and turn on MAC authentication beside it in the WLAN's Security settings. The AOS 10 Authentication Methods page gives the order: MAC auth runs first, 802.1X is only tried once the MAC passes, and a client that then fails 802.1X gets a deny-all or mac-auth-only role: https://arubanetworking.hpe.com/techdocs/central/2.5.8/content/aos10x/aos10x-overview/aos10-auth-methods.htm

    Make sure that mac-auth-only role allows nothing useful. Leave MAC authentication fail-through off too, or an unknown MAC just carries on to 802.1X. The allowed MACs go in the same server that checks the passwords (the internal server or ClearPass), added as MAC entries.

    If you meant a web login page, that won't gate the same way, because a failed MAC check just drops the client to the portal. Also turn off private MAC on the phones and laptops, or they'll never match. Which RADIUS server are you on?



    ------------------------------
    Dustin Burns
    @Worldcom Exchange, Inc.
    www.wei.com

    - - -
    The comments I post here are my own, and not my employers
    If my post was useful accept solution and/or give kudos
    Personal Blog: www.networkfieldnotes.com
    - - -
    ------------------------------



  • 3.  RE: Aruba Central - Creating an SSID that allows usename/password as well as MAC authentication

    Posted 11 days ago

    ?? How does that work in practice? Clients that does not understand/talk 802.1x, how do they then get their Wireless traffic Encrypted, when they are MAC authenticated?
    802.1x requires establishing and deriving the WPA2/3 encryption keys between the client and AP dynamically during the 802.1x authentication session.

    If the client does not understand/try that, what happens then? 


    Original Message


  • 4.  RE: Aruba Central - Creating an SSID that allows usename/password as well as MAC authentication

    Posted 11 days ago

    You're right, and that's the point of this setup. MAC auth here doesn't replace 802.1X, it's an extra gate in front of it. Every client still has to finish 802.1X to get its PMK and do the 4-way handshake, so a device that can't do 802.1X can't join this SSID at all. Glenn wants a username and password on top of the MAC check, so that's the behaviour he's after.

    One correction to my own reply. The Instant guide on MAC Authentication with 802.1X Authentication says the mac-auth-only role is primarily used for wired clients: https://arubanetworking.hpe.com/techdocs/Archived/Instant-AOS-8/Instant_86_WebHelp/Content/instant-ug/authentication/mac-dot1x-auth.htm On an Enterprise WLAN, a client that passes MAC and then fails 802.1X never gets keys, so it doesn't get anywhere.

    Devices that can't do 802.1X belong on a separate Personal SSID. With MPSK, ClearPass checks the MAC and hands that device its own passphrase, and the encryption comes from that key: https://arubanetworking.hpe.com/techdocs/central/2.5.8/content/aos10x/cfg/aps/wpa2_mpsk.htm



    ------------------------------
    Dustin Burns
    @Worldcom Exchange, Inc.
    www.wei.com

    - - -
    The comments I post here are my own, and not my employers
    If my post was useful accept solution and/or give kudos
    Personal Blog: www.networkfieldnotes.com
    - - -
    ------------------------------

    Original Message


  • 5.  RE: Aruba Central - Creating an SSID that allows usename/password as well as MAC authentication

    Posted 11 days ago

    Also, have you looked into using allowlists? That's manual/static config that would have to be maintained by someone. Using NAC would be more secure. ClearPass for instance can also profile the device based on the traffic and interactions coming from the unknown/known device. DHCP can be forwarded to ClearPass to see what the operating system is for instance. You could se if someone if trying to use an access point Mac-address for instance, but run Linux/Windows/MacOS etc... That would be odd, and would be good evidence of someone spoofing their Mac address. Local Deny/Allow-Lists can't do that.



    ------------------------------
    Dustin Burns
    @Worldcom Exchange, Inc.
    www.wei.com

    - - -
    The comments I post here are my own, and not my employers
    If my post was useful accept solution and/or give kudos
    Personal Blog: www.networkfieldnotes.com
    - - -
    ------------------------------



  • 6.  RE: Aruba Central - Creating an SSID that allows usename/password as well as MAC authentication

    Posted 9 days ago

    Glenn, did that get it working? If an unknown MAC still gets on, check the WLAN's MAC authentication fail-through setting first, then look at which role that client actually lands in on the AP's client list. If it's sorted, marking the reply as the solution helps the next person find it.



    ------------------------------
    Dustin Burns
    @Worldcom Exchange, Inc.
    www.wei.com

    - - -
    The comments I post here are my own, and not my employers
    If my post was useful accept solution and/or give kudos
    Personal Blog: www.networkfieldnotes.com
    - - -
    ------------------------------



Related Content