Home Knowledge Base SecureW2 Documentation MAC Authentication Bypass (MAB)

MAC Authentication Bypass (MAB)

Introduction

MAC Authentication Bypass (MAB) authenticates devices based on their MAC (Media Access Control) address. Once the source MAC address is identified, the switch generates an Access-Request message using the device’s MAC address as the identity and sends it to the RADIUS server. The RADIUS server evaluates the MAC address against the configured policies to determine whether the device is allowed to access the network and what access attributes should apply. If authentication is successful, the RADIUS server returns an Access-Accept message, and the switch grants the device network access. If authentication is not successful, the RADIUS server returns an Access-Reject message, and the switch denies the device access to the network.

This guide covers how to manage MAB devices using either the JoinNow Management Portal or the SecureW2 API, including adding devices individually, in bulk via CSV upload, or programmatically via API, so administrators are not limited to configuring one device at a time.

Prerequisites

Before you begin, make sure your JoinNow Management Portal subscription includes RADIUS Only or PKI + RADIUS.

Configure MAC Authentication

MAC Authentication can be configured using either of the following methods:

  1. Configure via JoinNow Management Portal
  2. Configure via API

Configure via JoinNow Management Portal

This section describes the portal-based workflow for setting up MAC Authentication and managing the devices that require network access. It covers the configuration steps needed to associate devices with the appropriate authentication and access policies.

Create a MAC Authentication Core Provider

Before configuring MAC Authentication, you must create and configure a Core Provider in the JoinNow Management Portal. This section explains how to create the MAC Authentication Core Provider, organize devices into groups, and add or delete device MAC addresses for authentication.

To create a MAC Authentication core provider, perform the following steps:

  1. Log in to the JoinNow Management Portal.
  2. Navigate to the Integration Hub > Core Platforms.
  3. Click Add.
  4. On the Basic tab:
    1. In the Name field, enter the name of the core provider.
    2. In the Description field, enter a suitable description for the core provider. 
    3. From the Type drop-down list, select MAC Authentication under the Core Provider category.
    4. Click Save. The page refreshes and displays the Configuration and Groups tabs.

Create a MAC Group

Groups allow you to organize devices for MAC Authentication and associate them with the appropriate Policy Workflows to apply network access and VLAN assignment policies to authenticated devices.

To create a MAC group, perform the following steps:

  1. Select the Groups tab.
  2. Click Add group.
  3. On the displayed pop-up window, in the Name field, enter a name for the MAC Group.
  4. In the Description field, enter a suitable description for the MAC Group.
  5. Click Save.
  6. Click Update to save the group.

    NOTE: Clicking Save only closes the pop-up window. You must click Update to save the group. Otherwise, the group name will not appear in the Group Name drop-down list when adding a device.

Add Devices

This section describes how to add devices to the MAC Authentication configuration in the JoinNow Management Portal. Devices can be added individually by entering their MAC address and assigning them to the appropriate group, or multiple devices can be added at once using a CSV file.

The following sections describe both methods for adding devices:

  1. Add Device – Add and configure a single device by providing its MAC address, group, and description.
  2. Upload Device(s) – Add multiple devices simultaneously by uploading a CSV file containing the MAC addresses and assigning them to a selected group.
Add Devices Individually

This section describes how to add a single device to a MAC Group by entering its MAC address in the JoinNow Management Portal.

  1. Select the MAC Authentication core provider created earlier and click Edit.
  2. Select the Configuration tab.
  3. Click Add Device.
  4. On the displayed pop-up window, in the MAC Address field, enter the MAC address of the device you want to authenticate.
  5. From the Group Name drop-down list, select the group name you created in the Create a MAC Group section.
  6. In the Description field, enter a suitable description for the device.
  7. Click Save.
Upload Devices via CSV

This section describes how to add multiple devices to a MAC Group at once by uploading a CSV file containing their MAC addresses.

  1. Select the MAC Authentication core provider created earlier and click Edit.
  2. Select the Configuration tab.
  3. Click Upload Device(s).
  4. On the Upload Device(s) pop-up window, from the Group Name drop-down list, select the group name you created in the Create a MAC Group section.
  5. In the File field, click Choose file to select the .csv file containing the MAC addresses of the devices.

     

    NOTE: The uploaded .csv file can be a maximum of 256 KB and can contain as many MAC addresses as fit within that size.

    NOTE: The MAC address must be in either AA:BB:CC:DD:EE:FF or AA-BB-CC-DD-EE-FF format.

  6. Click Upload. The list of device MAC addresses is displayed.
  7. Click Update.

Delete a Device

This section describes how to delete devices from the MAC Authentication configuration in the JoinNow Management Portal. Devices can be deleted individually, or multiple devices can be deleted at once.

To delete a device individually:

  1. Select the MAC Authentication core provider created earlier and click Edit.
  2. Select the Configuration tab.
  3. Click the Delete icon next to the device you want to delete.
  4. Click Update.

To delete multiple devices at once:

  1. Select the MAC Authentication core provider created earlier and click Edit.
  2. Select the Configuration tab.
  3. In the Devices section, click Delete Device(s).
  4. On the Delete Device(s) pop-up window, in the File field, click Choose file to select the .csv file containing the MAC addresses of the devices you want to delete. 
  5. Click Upload.
  6. Click Update.

Policy Management

Policy Management defines how JoinNow segments devices and grants network access. Configure the following policies:

  1. Policy Workflow – Segments devices based on groups.
  2. Network Policy – Applies RADIUS attributes such as VLAN assignment during WiFi authentication.

Create a Policy Workflow

Policy Workflow segments devices based on defined criteria. It allows you to define and create roles based on groups retrieved from the Core Provider.

To create a policy workflow, perform the following steps:

  1. Navigate to Policy Management > Policy Workflows.
  2. Click Add Policy Workflow.
  3. In the Basic tab, enter the name of the Policy Workflow in the Name field.
  4. In the Display Description field, enter a suitable description for the Policy Workflow.
  5. Click Save.
  6. The page refreshes, and the Conditions tab is displayed. 
  7. Select the Conditions tab.
  8. From the Core Provider drop-down list, select the MAC Authentication that you created earlier.
  9. In the Groups field, select the MAC Group that you created earlier.
  10. Click Update.

Create a Network Policy

A Network Policy defines how device connection decisions are made based on device information obtained from the Policy Workflow. It allows you to specify whether the device will be granted or denied network access, along with other RADIUS attributes that can be sent, which are most commonly VLAN assignments.

NOTE: Configure a Network Policy only if your organization uses SecureW2 CloudRADIUS as its RADIUS server.

To create a network policy, perform the following steps:

  1. Navigate to Policy Management > Network.
  2. Click Add Network Policy.
  3. Under the Basic tab, in the Name field, enter the name of the network policy.
  4. In the Display Description field, enter a suitable description for the network policy.
  5. Click Save.
  6. The page refreshes, and the Conditions and Settings tabs appear.
  7. Select the Conditions tab.
  8. Click Add rule and select the Policy Workflow to assign to the Network Policy. This mapping directs SecureW2 RADIUS to validate the device’s MAC address against the selected Policy Workflow during authentication.
  9. Select the Settings tab.
  10. From the Access drop-down list, select any one of the options to allow or deny authentication requests. The default value is “Allow”.
  11. Click Add Attribute.
  12. From the Dictionary drop-down list, select an option: 
    1. Radius:IETF: Uses standard RADIUS attributes for VLAN assignment.
    2. Custom: Uses Vendor-Specific Attributes (VSA).
  13. Add the RADIUS attributes required for VLAN assignment. For reference, here is what is commonly required for VLAN Assignment:
    1. Tunnel-Medium-Type: IEEE-802
    2. Tunnel-Private-Group-ID: {VLAN Name}
    3. Tunnel-Type: VLAN
  14. Click Save.
  15. Click Update.

Configure via API

This section describes how to set up API-based access for managing MAC Authentication devices programmatically, without relying on manual portal configuration.

Create a REST API Device and User Management Token

The REST API Device and User Management Token is SecureW2 API-based method for managing MAC Authentication devices. Unlike the JoinNow Management Portal, which requires manual configuration, this token lets you add, retrieve, update, and delete MAC addresses programmatically.

To create a REST API Device and User Management token, perform the following steps:

  1. Log in to the JoinNow Management Portal.
  2. Navigate to Integration Hub > Device Management Platforms.
  3. Click Add.
  4. In the Basic tab, enter the device management platform name in the Name field.
  5. In the Description field, enter the description for the device management platform.
  6. From the Type drop-down list, select REST API Device and User Management Token.
  7. In the Access field, select Read-Write to grant the token full control over resources, allowing it to interact with endpoints using GET, POST, PUT, and DELETE methods.
  8. Click Save. A .csv file containing the API Key ID and API Secret is downloaded.

    NOTE: Save the .csv file securely. This file is downloaded only once at the time of token creation. If lost, the token and secret cannot be retrieved.

Manage MAC Authentication Devices via API

After creating the REST API Device and User Management token, use the JoinNow Connector API Guide to manage MAC Authentication devices through the API. To access the guide, log in to the JoinNow Management Portal and navigate to General > Documentation. 

The guide provides instructions for:

  1. Retrieving all MAC addresses in a MAC Core Provider.
  2. Retrieving all MAC groups.
  3. Adding a MAC address individually or in bulk.
  4. Retrieving the details of a specific MAC address.
  5. Updating the group and description of an existing MAC address.
  6. Deleting a MAC address.

For the API endpoints, request parameters, and examples for these operations, see the JoinNow Connector API Guide.

More General Help Explainers
Reseller or MSP? Join our Partner Program