Local radius + mac-filter ?

Question

Hi all,
could someone tell me how to configure a local radius plus mac-filter?
The config with the local radius is running perfekt, but I dont't know how to configure a filter addition ?
any ideas are welcome
Carsten

Answer 1

yes, you can do that, but you don't actually need those two first "authentication" commands. These two:
authentication open mac-address mac_methods eap EAP_LOCAL
authentication network-eap EAP_LOCAL mac-address mac_methods
will overwrite these two:
authentication open eap EAP_LOCAL
authentication network-eap EAP_LOCAL
so you'll just be left with:
dot11 ssid wlan-ap
authentication key-management wpa
authentication open mac-address mac_methods eap EAP_LOCAL
authentication network-eap EAP_LOCAL mac-address mac_methods
Yes, you can also use "dot11 association", but you'd have to keep track of your access-list 700 on each access-point independently for each client. With RADIUS-based MAC authentication you will have a centralized mac address database on the RADIUS server.
You can also do local AP RADIUS authentication for this too ("radius-server local")
By the way, it is recommended to use two separate RADIUS servers for EAP and for MAC authentication. For example, ACS for EAP and LOCAL for MAC. The problem with using the same RADIUS server is that a user can now do EAP authentication by supplying WLAN NIC's MAC address as username and password and both EAP and MAC auth will pass!!