7-43
Wireless Security Configuration
Configuring MAC Address Authentication
Configuring MAC Address
Authentication
MAC address authentication functions enable the access point to control
which devices can associate with it. You can:
■ Configure the access point to authenticate client MAC addresses against
a local Access Control List stored locally on the access point or stored
remotely on a RADIUS server,
■ Specify station MAC addresses in the local Access Control List as allowed
or denied access to the network,
■ Lock out specific stations from all WLANs and WDS links on the access
point, or
■ Temporarily deauthenticate a client or station from the access point.
MAC address authentication is applied across all WLANs and all radios.
Note If you use a RADIUS authentication server for MAC authentication, you must
first configure the server in the RADIUS servers screen. For details on config-
uring RADIUS servers, see
“Web: Setting RADIUS Server Parameters” on page 7-33.
Authentication Order
Connection requests are authenticated in the following order:
■ First, against the MAC Lockout list,
■ Then, against the local Access Control List,
■ Last, against the RADIUS server.
Access Control List and RADIUS Server
Client station MAC authentication occurs prior to any 802.1X AP Authentica-
tion configured for the access point (see “Configuring 802.1X AP Authentica-
tion” on page 7-53). However, a client’s MAC address provides relatively weak
user authentication, since MAC addresses can be easily captured and used by
another station to break into the network. Using 802.1X AP Authentication
provides more robust user authentication by using user names and passwords
or digital certificates. So although you can configure the access point to use
MAC address and 802.1X authentication together, it is better to choose one or
the other, as appropriate.
To Next Page
Loading...
Need help?
General
