Cisco Systems OL-6415-04 manual MAC Address Authentication to the Network

Chapter 6 Configuring Authentication Types

Understand Authentication Types

There is more than one type of EAP authentication, but the access point behaves the same way for each type: it relays authentication messages from the wireless client device to the RADIUS server and from the RADIUS server to the wireless client device. See the “Assigning Authentication Types to an SSID” section on page 6-9for instructions on setting up EAP on the access point.

Note If you use EAP authentication, you can select open or shared key authentication, but you don’t have to. EAP authentication controls authentication both to your access point and to your network.

MAC Address Authentication to the Network

The access point relays the MAC address of the wireless client device to a RADIUS server on your network, and the server checks the address against a list of allowed MAC addresses. Intruders can create counterfeit MAC addresses, so MAC-based authentication is less secure than EAP authentication. However, MAC-based authentication provides an alternate authentication method for client devices that do not have EAP capability. See the “Assigning Authentication Types to an SSID” section on page 6-9for instructions on enabling MAC-based authentication.

Tip If you don’t have a RADIUS server on your network, you can create a list of allowed MAC addresses on the access point’s Advanced Security: MAC Address Authentication page. Devices with MAC addresses not on the list are not allowed to authenticate.

Tip If MAC-authenticated clients on your wireless LAN roam frequently, you can enable a MAC authentication cache on your access points. MAC authentication caching reduces overhead because the access point authenticates devices in its MAC-address cache without sending the request to your authentication server. See the “Configuring MAC Authentication Caching” section on page 6-14for instructions on enabling this feature.

Figure 6-4shows the authentication sequence for MAC-based authentication.

Cisco Wireless ISR and HWIC Access Point Configuration Guide

OL-6415-04 6-5