MAC based authentication for Wired Users

acharyr123 · ‎01-30-2008

Hi!!

I want to have the quarantine type facility in my network.

I do have ACS, 2960, 4500 & 6500 switches etc in my network.

I want any user tries to login to he network has to authenticate via AMC address of the nic card.

The end users mac will be there in the ACS. If he tries to login ACS will authentication & assign him an IP from the DHCP pool from the DHCP server. But if his/her MAC is not there in the ACS, then he will be allocated with a different IP from the dhcp pool created into the switch. In this IP pool only internet access will be available rest will be blocked. This i can achieve by VACL.

Can someone help me to understand whether it will work or not!!!!

Jagdeep Gambhir · ‎01-31-2008

It should work with MAB setup on the swtich.

http://forums.cisco.com/eforum/servlet/NetProf;jsessionid=6F8D618D8C0D61AEC87D77F0FF833C0D.SJ3A?page=netprof&forum=Security&topic=AAA&CommCmd=MB%3Fcmd%3Ddisplay_location%26location%3D.2cbf51a8/0

Regards,

~JG

acharyr123 · ‎01-31-2008

can i have a sample config for the same!!

jafrazie · ‎01-31-2008

Does this help?

<http://www.cisco.com/en/US/docs/switches/lan/catalyst3750/software/release/12.2_37_se/configuration/guide/sw8021x.html#wp1196845>

acharyr123 · ‎01-31-2008

Thanks for replying....

please suggest me whether the kind of solution i am looking for is possible or not!!

jafrazie · ‎01-31-2008

Should be. With MAC-Auth Bypass, you can authenticate via MAC address check.

This implementation guide may help:

<http://www.cisco.com/univercd/cc/td/doc/solution/macauthb.pdf>