Si el AP es el que autentica a los clientes. Lo que necesitas configurar es lo siguiente:
SSID - MAC Address Authentication
This SSID authenticates the wireless clients based on their MAC address. It uses the MAC address as username/password. In this example the AP acts as local RADIUS, so the AP stores the MAC address list. The same configuration can be applied with external RADIUS server.
Step 1. Enable AP as RADIUS server. The NAS IP address is the AP's BVI. Create the entry for the client with MAC address aaaabbbbcccc.
# aaa new-model
# radius-server local
# nas <a.b.c.d> key 0 <shared-key>
# user aaaabbbbcccc password 0 aaaabbbbcccc mac-auth-only
Step 2. Configure the RADIUS server to which the AP sends the authentication request (it is the AP itself).
# radius server <radius-server-name>
# address ipv4 <a.b.c.d> auth-port 1812 acct-port 1813
# timeout 10
# retransmit 3
# key 0 <shared-key>
Step 3. Assign this RADIUS server to a radius group.
# aaa group server radius <radius-group>
# server name <radius-server-name>
Step 4. Assign this radius group to an authentication method.
# aaa authentication login <mac-method> group <radius-group>
Step 5. Create the SSID, this example assigns it to VLAN 2402.
# dot11 ssid mac-auth
# vlan 2402
# authentication open mac-address <mac-method>
# mbssid guest-mode
Step 6. Assign the SSID to the interface 802.11a.
# interface dot11radio 1
# mbssid
# ssid mac-auth
Saludos,
Rafael - TAC
