# MAB: when the device has no 802.1X voice Source: https://ai.techclick.in/blog_cisco_ise_mab_printers_phones Markdown: https://ai.techclick.in/blog_cisco_ise_mab_printers_phones.md Publisher: Techclick Infosec Pvt Ltd MAC Authentication Bypass when there is no supplicant. Endpoint identity, profiling, Auth-Fail VLAN. Dummy printer 10.20.30.60. ## The ticket Finance printer offline after you enabled 802.1X. Someone set the port to no authentication . Now any cable on that jack is trusted. MAB is the adult fix. Quick interview answer MAB sends the MAC as username/password (PDF). It is not a user login. Official default: if the MAC is not found, the request can continue to Authorization so profiling can still assign a limited profile. Fallback on the port: 802.1X → timeout → MAB → fail → Auth-Fail / Guest VLAN . A MAB Accept is only as strong as how you inventory MACs. Hero · no supplicant MAB is a name-tag, not a password. Treat it that way in Authorization. Lab data · dummy only PAN ise-pan 10.10.10.20 · PSN ise-psn1 10.10.10.21 · MnT ise-mnt 10.10.10.22 · NAD sw-access-01 10.10.10.2 · AD dc01 10.20.30.10 · Priya 10.20.30.80 TECHCLICK\priya.hr · printer 10.20.30.60 . Not a live customer. ## MAB is not 802.1X No EAPoL identity from a user. Switch waits, then MAB. ISE Authentication rule “MAB” + Internal Endpoints. Authorization uses endpoint group / profile (HP-Printer, Cisco-IP-Phone) not AD group HR. https://ise-pan.techclick-lab.in/admin Training mock · not live ISE Admin Context Visibility Operations Policy Administration Context Visibility → Endpoints ### aa:aa:aa:10:20:60 MAC AA:AA:AA:10:20:60 Static group Printers Profile HP-Printer Authz result dACL_PRINT (TCP 9100 to print servers only) Cancel Save Administration → Identity → Endpoints. Training mock. ## Static MAC vs profile Method Use Risk Static endpoint + group Few known printers Spreadsheet rot Profiling then Authz Phones, cameras Unknown looks like a phone Open port Never as the design Anyone sits there ## How you allow a printer - #### Side A — port order authentication order dot1x mab and mab . Do not skip 802.1X or laptops will MAB as “printers” if you Authz too loosely. - #### Side B — ISE Add MAC to Endpoints / Printers. Authz: IF Printers THEN dACL_PRINT. Phones get voice VLAN + cisco-av-pair device-traffic-class=voice . - #### Side C — prove show authentication sessions Method = mab. Live Logs identity = the MAC, not priya.hr. dummy session show authentication sessions interface Gi1/0/20 details # Method mab # Status Auth OK # VLAN 40 # ISE Live Logs Identity: AA-AA-AA-10-20-60 # Policy: MAB / Printers / dACL_PRINT ## Four MAB failures ### 1 · 802.1X never times out tx-period / max-reauth too long. Printer waits minutes. ### 2 · Unknown MAC Reject Authc options not Continue. Profiling never sees it. ### 3 · MAB Authz = Permit_All Spoofed MAC = full LAN. Use a tiny dACL. ### 4 · Phone without voice flag Data VLAN only, no voice. Add the voice authorization checkbox / AV-pair. ## How to prove it Close the ticket only when 1) Method mab. 2) Identity is the MAC. 3) dACL/VLAN is printer/phone, not HR. 4) A laptop on that port still prefers dot1x. ## Traps Wrong Right no authentication on printer ports MAB + tiny dACL Same Authz as users Endpoint group Authz MAB first forever dot1x then mab ## Knowledge check Judgment items. One best answer. Reasons send you back to the matching section. Q1 MAB identity is usually… The MAC address The AD password The PAN hostname pxGrid Correct: a . PDF: MAC as username/password. Q2 Port fallback order in the lab PDF? 802.1X → MAB → Auth-Fail/Guest MAB only CWA then 802.1X No fallback Correct: a . PDF traps. Q3 Why Continue on unknown MAB in monitor mode? So Authorization/profiling can still see the endpoint To skip RADIUS To disable CoA To replace AD Correct: a . ISE default MAB + monitor design. Q4 Printer Authz should be… A tight printer dACL / VLAN The same as HR users Permit ip any any Guest portal Correct: a . Failure 3. Q5 Live Logs identity for a healthy printer? The MAC priya.hr admin blank always Correct: a . Proof. Q6 Why keep dot1x before mab on a user jack? So a laptop still does 802.1X, not a fake printer MAB IOS requires it alphabetically MnT cannot log MAB first PEAP cannot follow MAB ever Correct: a . Runbook Side A. Check answers Reset Cisco ISE class series: Personas · First day · NAD + RADIUS · Policy sets · Wired 802.1X · MAB · CWA / guest · Profiling · dACL vs VLAN · Live logs · vs Forescout · Interview ## Sources - ISE 3.3 default MAB authentication options. - Lab PDF — MAB workflow, fallback order, Internal Endpoints. Related: ISE evidence desk · session factory · Forescout series . --- Cite this Techclick lesson with the source URL. Do not invent fees, batch dates, or job guarantees. Browse all lessons: https://ai.techclick.in/blogs AI index: https://ai.techclick.in/llms.txt