MAC Address Authorization in a pre-existing RADIUS/NPS environment

i have radius/nps deployed. current solution win2008r2 nps , me authenticating 802.1x clients (hp switches), alcatel ip phones (md5 enabled) , vpn pptp clients (incoming connections through fortigate appliance)

now, need solve problem ruckus zone director , limitation of 128 mac addresses per ssid in controlled ssid

avoid 128 macs limitation suggested use mac address authorization, see:

http://forums.ruckuswireless.com/forums/8/topics/885



far know, need make changes in nps can turn current configurations impossible use without impacting 802.1x, vpn , ip phone clients.


nps: override user-name
http://technet.microsoft.com/en-us/library/dd197553(v=ws.10).aspx



"...

if set override user-name 1 , user identity attribute 31, authenticating server can perform automatic number identification/calling line identification (ani/cli)-based authentication. normal authentication using authentication protocols, such microsoft challenge handshake authentication protocol (ms-chap) , extensible authentication protocol (eap), disabled
..."


so, how can deploy nps mac address authentication using current nps deployment without changing current configurarions, adding?








mac address authorization
http://technet.microsoft.com/en-us/library/dd197535(v=ws.10).aspx


nps: user identity attribute
http://technet.microsoft.com/en-us/library/dd197523(v=ws.10).aspx

you have create user accounts based on mac address of client , password mac address. in lowercase.

next, create a group in ad , add these user accounts group. use group in network policy. 

---

johan loos

Windows Server  >  Network Infrastructure Servers