MAB (MAC Authentication Bypass)

Stands for: MAC Authentication Bypass: 802.1X's fallback that authenticates a device by its MAC address

MAC Authentication Bypass: the 802.1X fallback in which a switch, finding no supplicant on a port, submits the device's MAC address to the RADIUS server as its identity, so that printers, phones and other things that cannot authenticate are admitted by a list.

Cisco's configuration guide describes MAB as "a MAC-address-based authentication mechanism" for "platforms with no supplicant or not under administrative control", and names the devices: cash registers, fax machines, printers. The mechanism is a RADIUS request built by the switch: "MAB generates a RADIUS request with a MAC address in the Calling-Station-Id (attribute 31) and Service-Type (attribute 6) with a value of 10", Call Check in RFC 2865's list, the value that tells the server to decide on the station identifier rather than on a user. The encyclopaedia's description of the sequence is the one engineers recognise: the port first tries 802.1X, and if nothing answers it authenticates with the MAC address as both username and password. The guide also records that "before standalone MAB support was available, MAB could be configured only as a failover method for 802.1x authentication", and that standalone MAB works on switched ports only. The weakness is the credential: a MAC address is printed on the device and visible on the wire, so MAB admits anything that spoofs an allowed address, which is why the authorisation it returns should be a restricted VLAN or filter and why profiling, checking that the device behaves like the printer it claims to be, grew up around it.

Every 802.1X deployment meets the same wall within a week: the devices that cannot run a supplicant. Printers, IP phones from before the standard, cameras, badge readers, building controllers, lab instruments and the long tail of embedded equipment have no way to answer an EAP-Request Identity, and a port that insists on one simply never opens. MAC Authentication Bypass is the fallback the industry settled on. Cisco's IOS configuration guide, Configuring MAC Authentication Bypass, describes it as "a MAC-address-based authentication mechanism that allows clients in a network to integrate with the Cisco Identity Based Networking Services (IBNS) and Network Admission Control (NAC) strategy using the client MAC address", intended for "platforms with no supplicant or not under administrative control", and it names the examples that every network has: cash registers, fax machines, printers.

The mechanism is simple and entirely on the switch. When 802.1X on a port times out without a supplicant answering, the switch takes the source MAC address of the first frame it sees and builds a RADIUS Access-Request around it. The guide specifies the shape: "MAB generates a RADIUS request with a MAC address in the Calling-Station-Id (attribute 31) and Service-Type (attribute 6) with a value of 10". RFC 3580 fixes the Calling-Station-Id format for 802.1X as the MAC in upper-case hexadecimal with hyphens between octets, and Service-Type 10 is Call Check, which RFC 2865 defines as the NAS asking the server to accept or reject a call "typically based on the Called-Station-Id or Calling-Station-Id attributes", so the server knows to consult a list of addresses rather than a directory of users. The encyclopaedia article on 802.1X describes the sequence the same way: the port first checks for 802.1X and, finding none, authenticates with the device's MAC address as username and password. The guide adds a piece of history, that "before standalone MAB support was available, MAB could be configured only as a failover method for 802.1x authentication", and that standalone MAB is supported on switched ports only; the usual configuration today is an order, 802.1X first, MAB second and web authentication third.

The weakness is the credential. A MAC address is not a secret: it is printed on a label, visible to anyone on the same segment, and trivially changed on most operating systems. MAB therefore admits anything that presents an allowed address, and an attacker who unplugs a printer and clones its MAC inherits whatever the printer was authorised for. The mitigations are about authorisation rather than authentication: the RADIUS server returns a restricted VLAN or a downloadable filter for MAB sessions, so that a cloned printer address reaches the print server and nothing else; and profiling, in which the policy engine watches the device's traffic, its DHCP options, its browser strings and its protocols, and withdraws the session, with a RADIUS Change of Authorization, when the thing claiming to be a printer starts behaving like a laptop. The RADIUS CoA entry describes that mechanism.

Operationally MAB is a database problem. Somebody has to maintain the list of permitted addresses, with an owner and a purpose for each, and the list decays as devices are replaced; most deployments feed it from a discovery or asset system rather than by hand, and the audit question is not whether MAB is on but who may add to the list and how an entry is retired. The accounting records MAB sessions generate, Start and Stop with the Calling-Station-Id, are the trail that shows which port a given device was on and when, which is useful far beyond security.

The design rule that follows is to treat MAB as an admission policy for things, with the least authorisation that lets each kind of thing work, rather than as authentication. Where a device can hold a certificate, EAP-TLS replaces it; where it cannot, MAB plus a restricted authorisation plus profiling is the state of the art, and the web authentication entry covers the third fallback, for the devices that have a browser but no supplicant.

Also known as: mac authentication bypass, mac auth, mac-based authentication, mac bypass

Sources

← All glossary entries