Address For Aruba Access Points How To Configure It

This article discusses the benefits of MAC-Based RADIUS and how to configure it in Microsoft NPS and Dashboard.

Benefits of MAC-Based RADIUS In some environments it is critical to control which devices can access the wired LAN.

Ports in common areas make a network vulnerable to access by guests and other unauthorized users.

MAC-Based RADIUS can be used to provide port based access control on your MS series switches.

Unauthorized users are prevented from accessing to the wired LAN because each device that connects to a switch port will need to be authenticated before network access is granted.

Devices are authenticated at the port level with MAC-Based RADIUS.

When a device connects to a port with an access policy assigned, before network access is granted, the device must be authenticated by the RADIUS server.

Address For Aruba Access Points Password Of The

The switch (RADIUS client) sends a RADIUS Access-Request to the RADIUS server containing the username and password of the connecting device.

The username and password combination is always the MAC address of the connecting device, lower case without delimiting characters.

If a RADIUS policy exists on the server that specifies the device should be granted access and the credentials are correct, the RADIUS server will respond with an Access-Accept message.

Upon receiving this message, the switch will grant network access to the device on that port.

If the RADIUS server replies with an Access-Reject because the device does not match a policy, the switch will not grant network access.

It is possible however, to configure the switch to drop devices into a Guest VLAN when they fail to authenticate.

Below is an example of a basic MAC-Based authentication exchange.

Adding MS Switches as RADIUS clients on the NPS Server All switches that that need to authenticate connecting devices must be added as RADIUS clients on in NPS.

Below are the steps to add the switches as RADIUS clients.

Open the NPS Server Console by going to Start Programs Administrative Tools Network Policy Server.

In the Left pane, expand the RADIUS Clients and Servers option.

Right click the RADIUS Clients option and select New.

Enter a Friendly Name for the MS Switch.

Enter the the IP Address of your MS Switch.

Create and enter a RADIUS Shared Secret (note this secret - we will need to add this to the Dashboard).

Press OK when finished.

Repeat these steps b - g for all switches.

See Figure 1 for a sample RADIUS client configuration.

Figure 1. Create a user account in Active Directory for a connecting device.

Open Active Directory Users and Computers: Start All Programs Administrative Tools Active Directory Users and Computers.

Create a new user account.

See KB Creating a Windows Group For MAC Based Authentication.

Then specify NAS port type Ethernet followed by clicking Next.

Figure 5) Figure 5.

Click Next on the Specify Access Permission screen.

On the Configure Authentication Methods page, uncheck all options except Unencrypted authentication (PAP, SPAP).

Figure 6) Figure 6.

Click Next on the Configure Constraints screen.

Click Next on the Configure Settings screen.

Review settings and click Finish on the Completing New Network Policy screen.

Figure 7) Figure 7.

On the Dashboard navigate to Configure Access Policies.

Click on the link Add Access Policy in the main window then click the link to Add a server.

Enter the IP address of the RADIUS server, the port (default is 1812 or 1645), and the secret you created above in part 2.

Figure 8) 4) Click Save changes.

Figure 8. Apply Access policy to MS Switchports.

Explore Meraki Contact Support Most questions can be answered by reviewing our documentation, but if you need more help, Cisco Meraki Support is ready to work with you.

Open a Case Ask the Community In the Meraki Community, you can keep track of the latest announcements, find answers provided by fellow Meraki users and ask questions of your own.

Mac Address For Aruba Access Points