You didnt match radius request. NAD-IP-ADDRESS nedd to be address or group. Add PLI-LVL23 ip address into ap group in clearpass and use belongs-to-group condition.
Original Message:
Sent: May 19, 2025 04:18 AM
From: airhead_tem
Subject: Can MAB (Mac-Auth) using WIFI
I have changes this following the recommendation.
Original Message:
Sent: May 19, 2025 03:22 AM
From: shpat
Subject: Can MAB (Mac-Auth) using WIFI
So modify your service Trigger parameters to Match precisely the name (keep in mind it is Case Sensitive).
Then the service should be triggered correctly.
------------------------------
Shpat | ACEP | ACMP | ACCP | ACDP
Just an Aruba enthusiast and contributor by cases
If you find my comment helpful, KUDOS are appreciated.
Original Message:
Sent: May 19, 2025 03:04 AM
From: airhead_tem
Subject: Can MAB (Mac-Auth) using WIFI
Ok i got already where the PLI-LVL23 come from. It was from the VC of the Access Point.
Original Message:
Sent: May 19, 2025 02:59 AM
From: airhead_tem
Subject: Can MAB (Mac-Auth) using WIFI
I'm using Aruba Central as a controller.
I've checked the place where the SSID profile was created, there is no such option for frame.
Original Message:
Sent: May 19, 2025 02:27 AM
From: GorazdKikelj
Subject: Can MAB (Mac-Auth) using WIFI
Check the RADIUS configuration on controller. Do you send service type of FRAMED-USER instead of LOGIN-USER? If so, then you need to change service definition to use FRAMED-USER (2) instead of LOGIN-USER(1) or reconfigure RADIUS server on controller.
Best, Gorazd
------------------------------
Gorazd Kikelj
MVP Guru 2025
Original Message:
Sent: May 19, 2025 02:07 AM
From: airhead_tem
Subject: Can MAB (Mac-Auth) using WIFI
Urmm...that interesting, I don't have any PLI-LVL23 in the Device Group.
However, I check access tracker, on my working EAP-TLS connection, the Radius Request come from the same PLI-LVL23.
Original Message:
Sent: May 19, 2025 12:34 AM
From: shpat
Subject: Can MAB (Mac-Auth) using WIFI
Also, after you solve service Triggering, this can be an issue.
Your static host list has MAC Address in the format of XX-XX-XX-XX-XX-XX
If you make Rule Mapping and Enforcement policies based on the User-names, the username you are receiving is in format xxxxxxxxxxxx based on your Access Tracker input
------------------------------
Shpat | ACEP | ACMP | ACCP | ACDP
Just an Aruba enthusiast and contributor by cases
If you find my comment helpful, KUDOS are appreciated.
Original Message:
Sent: May 17, 2025 12:02 PM
From: airhead_tem
Subject: Can MAB (Mac-Auth) using WIFI
Service Type : MAC Authentication
Authentication Method : MAC_AUTH
Authentication Source : Static Host List
I have register inside static host list my test laptop MAC Address using this format XX-XX-XX-XX-XX-XX
Original Message:
Sent: May 17, 2025 11:55 AM
From: shpat
Subject: Can MAB (Mac-Auth) using WIFI
What is the authentication source you're using?
------------------------------
Shpat | ACEP | ACMP | ACCP | ACDP
Just an Aruba enthusiast and contributor by cases
If you find my comment helpful, KUDOS are appreciated.
Original Message:
Sent: May 17, 2025 11:01 AM
From: airhead_tem
Subject: Can MAB (Mac-Auth) using WIFI
Yes, we want to setup for TV display, Camera & Printer via WIFI.
So technically it can be done, not only via LAN (network cable)
I did configure the MAC_AUTH services but this error hit me and REJECT.
Alerts for this Request :
RADIUS Cannot select appropriate authentication method
Original Message:
Sent: May 17, 2025 10:05 AM
From: shpat
Subject: Can MAB (Mac-Auth) using WIFI
If you mean, using MAC Authentication for Wireless Infrastructure, you need to setup your SSID to do MAC-Auth and then configure the service on Clearpass to perform MAC-AUTH (for Authentication under Authentication Methods, use Allow All MAC AUTH option).
However, with the current Random MAC on most mobile devices, are you sure you want to use MAB for WIFI connectivity?
------------------------------
Shpat | ACEP | ACMP | ACCP | ACDP
Just an Aruba enthusiast and contributor by cases
If you find my comment helpful, KUDOS are appreciated.
Original Message:
Sent: May 16, 2025 12:07 PM
From: airhead_tem
Subject: Can MAB (Mac-Auth) using WIFI
Can MAB in Clearpass can be done if the endpoint using WIFI connectivity?
I don't see any document from Aruba for this.
I have tried configured new services that use MAC_AUTH but it won't work as expected.