Loadtop108

MAC-Based Access Control

1. Finding Mac Address For Cisco Access Control Module
2. Finding Mac Address For Cisco Access Control Software
3. Finding Mac Address For Cisco Access Control Router
4. Finding Mac Address For Cisco Access Control Devices

It is critical to control which devices can access the Wireless LAN. MAC-Based Access Control can be used to provide network access control on MR series access points. With MAC-Based Access Control, devices must be authenticated by a RADIUS server before network access is granted on an SSID.

The Access Point (Authenticator) sends a RADIUS Access-Request to the RADIUS server containing the username and password of the connecting wireless device based on the association process. With MAC-based Access Control, the username and password combination is always the MAC address of the connecting device, lower case, without delimiting characters.

If a RADIUS policy exists on the server that specifies the device should be granted access and the credentials are correct, the RADIUS server will respond with an Access-Accept message. Upon receiving this message, the AP will grant network access to the device on the SSID.

Use ODBC connection to check against MAC address Database - (‎ 08:16 AM) Network Access Control by umahar on ‎ 08:16 AM Latest post on ‎ 07:01 PM by hslai. Finding the media access control (MAC) address, or hardware address, for the hosts on your network is a fairly simple process. It involves the use of the address resolution protocol (ARP), which converts Internet protocol (IP) addresses into the MAC address. Checking MAC Addresses on a Cisco Switch You can check the MAC addresses stored by a Cisco switch by logging into the switch and issuing the command show mac address-table. The addresses are stored in a table called the bridge forwarding table or CAM table. MAC address (Media Access Control address) is a unique identifier assigned to network interfaces for communications on the physical network segment. It usually encodes the manufacturer’s registered identification number. It is used to record a stations mac address and it’s corresponding switch port location.' Example: Port 17 has a device plugged in with this mac address. If you were looking for a device you could ping it, look at the arp table to get the mac then use the mac command to find the port.

If the RADIUS server replies with an Access-Reject, the device does not match an existing policy or the RADIUS server has a rule denying the client and the AP will not grant network access to the device.

Finding Mac Address For Cisco Access Control Module

Below is a diagram showing a successful authentication exchange:

Security Considerations

MAC-Based Access Control has some security implications which must be considered before using this method as a primary method to secure a wireless network.

• It is not an association method that supports wireless encryption. Communication between wireless clients and the MR is not encrypted and can be intercepted and viewed as clear text by “man-in-the-middle” devices using easily accessible wireless capture tools. Therefore clients will need to rely on upper layer protocols for encrypting traffic, such as SSL or IPsec, once a device has gained network access.
• Because the MAC address of the device is used as the authentication credentials, an attacker can easily gain network access by spoofing the MAC address of previously authenticated clients.

Checking MAC Addresses on a Cisco Switch

You can check the MACaddresses stored by a Cisco switch by logging into the switch and issuingthe command show mac address-table. The addresses arestored in a table called the bridge forwarding table or CAM table.

Switches maintain a table of both static and dynamically learnedIP addresses. Cisco switches have a number of special built-inaddresses such as the 4 static address above. E.g., in the above case the first entry 0009.e897.d280 is a static entry reflecting the MAC address of the switch itself. In the above example, 3 systems are connected to the switch on ports 1, 12, and 18. Their addresses are reported as dynamicaddresses.

Finding Mac Address For Cisco Access Control Software

You can view just the static or just the dynamic MAC addresses with thecommands show mac address static and show mac addressdynamic.

Finding Mac Address For Cisco Access Control Router

You can also view the MAC addresses using the show interfacescommand, but that gives you a lot of extra information as well,so it isn't as easy to see the MAC addresses for all interfaces at a glance.

A MAC address for the switch can be seen in line 2 of the output ofthe command. A lot more information is actually output than what isshown.

The show arp command will also show some MAC addresses, butonly those with which the switch has had some communication at the IP level. The MAC addresses show Ethernet level communications.

In the example above, the 192.168.0.50 address representsthe IP address of the system by which I was logged into the switch. Theswitch IP address was 192.168.0.4.

Finding Mac Address For Cisco Access Control Devices

References:

1. Cisco administration 101: Understanding Ethernet MAC addresses
   By: David Davis CCIE, MCSE+I, SCSA
   Date: october 12, 2006
   TechRepublic
2. How a Cisco Switch functions on an Ethernet network
   By: David Davis, vExpert, VCP, CCIE 9369
   Date: January 7, 2009
   Petri IT Knowledgebase