Hands-On Lab: Configuring MAC Authentication Bypass (MAB)

Lab Objective

Configure MAB as a fallback authentication method on a port already requiring 802.1X, pre-authorize a specific device's MAC address on the RADIUS server, and verify that device gains network access via MAB after 802.1X times out, while a genuinely unknown device remains blocked.

Lab Purpose

802.1X, configured in the previous lab, requires supplicant software the connecting device must actually run — many devices like printers, IP cameras, and older equipment have no 802.1X capability at all. MAB provides a fallback specifically for these devices, using the device's MAC address as a (much weaker) form of identity when no 802.1X supplicant responds.

Lab Topology

Switch1 ---- Gi1/0/9 ---- Printer1 (no 802.1X
                          capability, MAC:
                          00aa.bb00.7777)

RADIUS server: 192.168.250.100, with
00aa.bb00.7777 pre-authorized as a known
device for MAB

Task 1: Configure the Port for 802.1X with MAB as Fallback

Configure Gi1/0/9 with 802.1X authentication and enable MAB as the fallback method.

Task 2: Connect Printer1 and Observe the 802.1X Timeout

Connect the printer and observe that no EAPOL response occurs, since it has no 802.1X supplicant.

Task 3: Verify MAB Takes Over After the Timeout

Confirm the switch falls back to MAB, sending the printer's MAC address to RADIUS for authentication.

Task 4: Verify Printer1 Gains Access

Confirm the port authorizes and the printer can communicate on the network.

Task 5: Verify an Unrecognized Device Is Still Blocked

Connect a different device with an unregistered MAC address and confirm MAB also fails to authorize it.

Solution and Verification

Switch1(config)# interface gigabitethernet1/0/9
Switch1(config-if)# switchport mode access
Switch1(config-if)# authentication port-control auto
Switch1(config-if)# dot1x pae authenticator
Switch1(config-if)# mab

-- "mab" adds MAC Authentication Bypass as
-- a fallback -- 802.1X is still attempted
-- first, with MAB only engaging after it
-- times out

-- Printer1 connected, no EAPOL response
-- sent since it has no 802.1X supplicant

Switch1# show authentication sessions interface gigabitethernet1/0/9

Interface  MAC Address       Method  Status
Gi1/0/9    00aa.bb00.7777    N/A     Running
-- Initially "Running" while 802.1X is
-- still being attempted

-- After the dot1x timeout period elapses:

Switch1# show authentication sessions interface gigabitethernet1/0/9

Interface  MAC Address       Method  Status
Gi1/0/9    00aa.bb00.7777    mab     Authz Success
-- The switch fell back to MAB, sending
-- 00aa.bb00.7777 to RADIUS as the
-- "username" for authentication -- since
-- this MAC was pre-authorized, RADIUS
-- returned Access-Accept

Printer1> [prints a test page over the network]
-- Confirmed working, print job completed
-- successfully

-- Unregistered device connected to a
-- similarly configured port:

Switch1# show authentication sessions interface gigabitethernet1/0/10

Interface  MAC Address       Method  Status
Gi1/0/10   00aa.bb00.8888    mab     Authz Failed
-- RADIUS returned Access-Reject for this
-- unregistered MAC -- MAB fails just as
-- 802.1X would for invalid credentials

Key Takeaway

MAB is deliberately a fallback, never a primary method, on a port configured with both: 802.1X is always attempted first, and MAB only engages after the 802.1X exchange genuinely times out with no supplicant response — this ordering ensures a device actually capable of proper 802.1X authentication always uses the stronger method, while MAB's inherently weaker MAC-based verification is reserved specifically for devices with no other option.