What is MAB, and why is it considered weak?
Show the answer
Say this first
MAC Authentication Bypass is the fallback for devices that cannot run 802.1X: printers, cameras, badge readers, some phones and medical devices. The switch learns the device's source MAC from its first frames and sends it to RADIUS as the identity. The server looks it up in an endpoint list and returns accept with a policy. It is weak because a MAC address is not a secret: it is printed on the label and visible on the wire, so anyone can copy it. MAB devices should get narrow access, and profiling should confirm the device still looks like a printer.
Go deeper
Order and timing
interface GigabitEthernet1/0/22
authentication order dot1x mab
authentication priority dot1x mab
authentication port-control auto
mab
dot1x pae authenticator
dot1x timeout tx-period 10With the default tx-period of 30 seconds and two retries, a device with no supplicant waits about
90 seconds before MAB starts, long enough for DHCP on some devices to give up. Lowering tx-period
to 10 brings that to about 30 seconds. Another option is authentication order mab dot1x with
priority dot1x mab: MAB runs first, and an 802.1X client can still take over when it sends EAPOL.
What the server sees
On Cisco switches a MAB request carries Service-Type Call-Check, and the MAC appears as the username and in Calling-Station-Id. The MAC format is configurable on the switch and normalized on most servers.
Making it less weak
- Narrow policy per device type: a printer gets a downloadable ACL that allows only the print servers, not the whole network.
- Profiling with DHCP options, LLDP or CDP, HTTP user agent and active scans, so a laptop presenting a printer's MAC gets flagged when its profile changes.
- Move devices to 802.1X with certificates whenever the device supports it.
They will ask next
How do you onboard hundreds of printers and cameras?
Import the MAC lists from the asset inventory into an endpoint identity group, and let profiling classify the rest. The authorization rule matches the group or profile and returns the policy.
How does MAB interact with multi-auth?
Each MAC on the port is its own session. One port can have an 802.1X laptop and a MAB-authorized device behind a small switch, each with its own policy.
Traps
- Calling MAB device authentication. It identifies a device by a value anyone can copy.
- Forgetting the 90 second delay with default timers, which makes MAB devices fail DHCP after rollout.