MAB identity is usually…

Correct: a. PDF: MAC as username/password.

Why Continue on unknown MAB in monitor mode?

Correct: a. ISE default MAB + monitor design.

Cisco · ISE 3.3 · Lesson 6 of 12

MAB: when the device has no 802.1X voice

Printer 10.20.30.60 has no PEAP. The port must fall from 802.1X to MAB — RADIUS with the MAC as the identity. ISE looks up Internal Endpoints (or a profile). This lesson is that fallback, and why a stolen laptop MAC is not “Priya.”

Updated 2026-08-18·18 min read·L2 primary·Quiz at end

After this page you can

Explain 802.1X → MAB → Auth-Fail/Guest order.
Add an endpoint MAC and map it to a printer profile.
Use Continue on unknown MAC in monitor mode.
Not put printers in the HR user dACL.

The ticket

Finance printer offline after you enabled 802.1X. Someone set the port to no authentication. Now any cable on that jack is trusted. MAB is the adult fix.

Quick interview answer

MAB sends the MAC as username/password (PDF). It is not a user login. Official default: if the MAC is not found, the request can continue to Authorization so profiling can still assign a limited profile. Fallback on the port: 802.1X → timeout → MAB → fail → Auth-Fail / Guest VLAN. A MAB Accept is only as strong as how you inventory MACs.

Printer using MAB because it has no 802.1X supplicant — MAB is a name-tag, not a password. Treat it that way in Authorization.

Lab data · dummy only

PAN ise-pan 10.10.10.20 · PSN ise-psn1 10.10.10.21 · MnT ise-mnt 10.10.10.22 · NAD sw-access-01 10.10.10.2 · AD dc01 10.20.30.10 · Priya 10.20.30.80 TECHCLICK\priya.hr · printer 10.20.30.60. Not a live customer.

MAB is not 802.1X

No EAPoL identity from a user. Switch waits, then MAB. ISE Authentication rule “MAB” + Internal Endpoints. Authorization uses endpoint group / profile (HP-Printer, Cisco-IP-Phone) not AD group HR.

https://ise-pan.techclick-lab.in/admin

Training mock · not live

ISE Admin

Context VisibilityOperationsPolicyAdministration

Context Visibility → Endpoints

aa:aa:aa:10:20:60

MAC

AA:AA:AA:10:20:60

Static group

Printers

Profile

HP-Printer

Authz result

dACL_PRINT (TCP 9100 to print servers only)

Administration → Identity → Endpoints. Training mock.

Static MAC vs profile

Method	Use	Risk
Static endpoint + group	Few known printers	Spreadsheet rot
Profiling then Authz	Phones, cameras	Unknown looks like a phone
Open port	Never as the design	Anyone sits there

How you allow a printer

Side A — port order
authentication order dot1x mab and mab. Do not skip 802.1X or laptops will MAB as “printers” if you Authz too loosely.
Side B — ISE
Add MAC to Endpoints / Printers. Authz: IF Printers THEN dACL_PRINT. Phones get voice VLAN + cisco-av-pair device-traffic-class=voice.
Side C — prove
show authentication sessions Method = mab. Live Logs identity = the MAC, not priya.hr.

dummy session

show authentication sessions interface Gi1/0/20 details
# Method  mab
# Status  Auth OK
# VLAN    40
# ISE Live Logs Identity: AA-AA-AA-10-20-60
# Policy: MAB / Printers / dACL_PRINT

Four MAB failures

1 · 802.1X never times out

tx-period / max-reauth too long. Printer waits minutes.

2 · Unknown MAC Reject

Authc options not Continue. Profiling never sees it.

3 · MAB Authz = Permit_All

Spoofed MAC = full LAN. Use a tiny dACL.

4 · Phone without voice flag

Data VLAN only, no voice. Add the voice authorization checkbox / AV-pair.

How to prove it

Close the ticket only when

1) Method mab. 2) Identity is the MAC. 3) dACL/VLAN is printer/phone, not HR. 4) A laptop on that port still prefers dot1x.

Traps

Wrong	Right
no authentication on printer ports	MAB + tiny dACL
Same Authz as users	Endpoint group Authz
MAB first forever	dot1x then mab

Cisco ISE class series: Personas · First day · NAD + RADIUS · Policy sets · Wired 802.1X · MAB · CWA / guest · Profiling · dACL vs VLAN · Live logs · vs Forescout · Interview

Sources

ISE 3.3 default MAB authentication options.
Lab PDF — MAB workflow, fallback order, Internal Endpoints.