EAP packets generated for plain MAC-based authentication

Question

I wanted to implement trivial MAC-based authentication on some Cisco SG300 (small-business) switches. The client doesn't ask for auth but I simply want the client's MAC address to be authenticated, like for a printer.

Those switches can do both 802.1x as well as MAC-based auth. However their definition/implementation of the latter seems interesting. Read ahead.

---

First, in the case of MAC-based auth, as usual the switch assumes the role of the supplicant. However these ones still send EAP packets inside the RADIUS request, instead of a plain RADIUS request, to the authentication/RADIUS server. The manual gives this hint:

MAC-based authentication is an alternative to 802.1X authentication that allows network access to devices (such as printers and IP phones) that do not have the 802.1X supplicant capability. MAC-based authentication uses the MAC address of the connecting device to grant or deny network access.

In this case, the switch supports EAP MD5 functionality with the username and password equal to the client MAC address

Now all the other gear we have doesn't do that when you want to use plain MAC-based auth. Even Cisco themselves don't do that on their IOS devices (where the feature is called "MAC-auth bypass").

Second, these switches (SG series) can do dynamic VLAN assignment, meaning you return a certain RADIUS attribute with a VLAN embedded in it, and then the switch will apply that VLAN on the port if possible.

Now in this case, this attribute is silently ignored, if it is not nicely provided in an EAP "envelope". This is where it all comes together and breaks our current setup (or it needs to be modified.)

I could of course try to configure the RADIUS server (here freeradius) to handle both situations (EAP as well as plain RADIUS), but what I mainly want to know from someone who has already gone through all this is: Is a "MAC authentication" that still generates EAP packets a valid approach?

Now what I would want to do is: Nail Cisco's support and tell them that either the device should do

• EAP when 802.1x is requested
• plain RADUIS when MAC-auth is requested (and not some kind of EAP nevertheless)

However I would need some strong rationale for that :)

I know this isn't some "I've tried this and that and how do I finally get it to work" question but rather the type "Why is it working like that? Is it correct of them to implement it this way? If yes, why; if no, why not?" (Maybe you have some RFC or the like in mind.) Hope that's ok.

Answer 1

what I mainly want to know from someone who has already gone through all this is: Is a "MAC authentication" that still generates EAP packets a valid approach?

Here's a freeradius-users thread which answers most of these questions.

The crux is:

• Using EAP for MAC auth makes no real sense.
• But it isn't bad either if it's at least correctly implemented.
• Users on the freeradius list didn't think Cisco's SG series implements 802.1x EAP MAB correctly, since the EAP Service-Type is missing. As Nick Lowe mentioned, if the EAP Service-Type is missing, it becomes awkward, hackish and potentially unreliable to discriminate between the type of service being used by a client.