Users Guide

Security Commands 960
mab
Use the mab command to configure the switch to enable MAC
Authentication Bypass (MAB) authentication for devices connected to the
interface. Use the no form of this command to disable MAB on an interface.
Syntax
mab [auth-type {pap | eap-md5|chap}]
no mab
• chap—Authenticate MAB clients using Challenge Authentication
Protocol (CHAP)
• eap—Authenticate MAB clients using Extensible Authentication Protocol
(EAP)
• pap—Authenticate MAB clients using Password Authentication Protocol
(PAP)
Default Configuration
By default, MAB clients are authenticated using the EAP method.
Command Mode
Interface Configuration (Ethernet) mode
User Guidelines
This command is used to enable MAC Authentication Bypass (MAB) on an
interface. MAB is a supplemental authentication mechanism that allows
802.1x unaware clients—such as printers, fax machines, and some IP phones,
to authenticate to the network using the client MAC address as an identifier.
However, MAB can also be used to authenticate 802.1x aware clients in some
configurations. This command also provides options to specify the type of
authentication to be used, which can be either EAP-MD5, PAP, CHAP.
Authentication of a user via MAB will not occur until the authentication
time-out guest-vlan-period timer expires.
When using MAB, configure the format of the RADIUS UserName attribute
sent in the RADIUS Access-Request using the mab request format
command.