Setup External RADIUS MAC Authentication

8 min

Overview

Use External RADIUS MAC Authentication to approve wired devices that do not support 802.1X on your own RADIUS server, instead of in the Nile Portal. Typical devices include printers, desk phones, cameras, sensors, and other headless devices.

The device's MAC address is used as its credential. When a device connects to a Nile switch, Nile sends its MAC address to your RADIUS server, such as Cisco ISE, Aruba ClearPass, or Microsoft NPS. The server decides whether the device is allowed and which segment it joins.

Use this option if your RADIUS server already holds your device list and you do not want to copy it into the Nile Portal. To approve devices in the Nile Portal instead, see Setup MAC Authentication.

Note: MAC-based methods are simple, but a MAC address can be copied. Use them for low-risk or controlled devices. Use 802.1X where you need stronger security.

Learn more about MAC Authentication and Wired Unified Authentication.

How External RADIUS MAC Authentication works

A device connects to a Nile switch port. Every port is blocked until the device is approved.

Nile learns the device's MAC address and sends a MAC authentication request to the RADIUS server that has Wired MAC Auth selected for that location.

The RADIUS server checks the MAC address against its device list and returns either an Access-Accept with the segment name, or an Access-Reject.

Nile places the device in the returned segment, and the device gets an IP address from that segment's subnet.

Nile authenticates the device again when the session timeout is reached or when the device reconnects.

Prerequisites

Complete the following before you turn on External RADIUS MAC Authentication. Most steps have a dedicated page with detailed instructions.

Configure a Service Area. Define the sites, buildings, and floors where you need Nile connectivity. See Setup Service Areas.

Configure DHCP. Choose Nile DHCP or an external DHCP server, and define the subnets your devices will use. Each segment needs a subnet at every site where its devices connect. See Setup DHCP.

Configure Segments. Create a segment for each group that the RADIUS server will return, such as Printers or Cameras. Note the exact segment names, because the RADIUS server must return them exactly. See Setup Segments.

Prepare your RADIUS server. Have the IP addresses of up to three servers, the RADIUS port (usually 1812), and the shared secret. Make sure there is a route between the RADIUS server and the core router or firewall that connects to the Nile Service Gateway, and that RADIUS traffic is allowed in both directions.

Prepare your device list. Collect the MAC addresses of the devices you want to approve, and decide which segment each group of devices should join.

Enable the feature. The Wired MAC Auth checkbox is turned on only on request. Contact Nile Support to enable it for your organization.

Configuration Steps

Step 1: Add the RADIUS server in the Nile Portal

In the left navigation, select Network Setup > Authentication, and click the + sign. To use a RADIUS server that is already added, click its name instead.

Configure the following:

Name: Enter a name for the RADIUS server.

Port: Enter the RADIUS port. This is usually 1812.

Shared Secret: Enter the secret. Use the same secret on the RADIUS server.

Host 1, Host 2, Host 3: Enter the primary, secondary, and tertiary servers.

Geo Scope: Select the locations that will use this RADIUS server.

Wired MAC Auth: Select this checkbox to send MAC authentication requests for wired devices at the locations in its Geo Scope to this server. Use only one RADIUS server with Wired MAC Auth for a location.

Wired Dot1x (optional): Not needed for MAC authentication. Select it only if this server also handles wired 802.1X. See Setup Wired 802.1X.

Guest Portal URL (optional): Enter a fixed portal address only if this server sends devices to a captive portal after MAC authentication. If you leave it blank, Nile uses the address that the RADIUS server returns.

Click Display NAS IPs and note the addresses. These are the Nile addresses that send requests to your RADIUS server. You add them to the server in Step 3.

Optional: Click Verify Hosts and enter a test username and password to check that Nile can reach the server. You can save these credentials so Nile uses them for ongoing monitoring.

Click Save.

Note: After you select Wired MAC Auth, all wired MAC authentication at those locations uses the RADIUS server. New devices no longer appear in the Nile Portal for approval. You cannot combine Nile MAC Authentication and External RADIUS MAC Authentication at the same location.

Step 2: Check the segments

Make sure each segment that the RADIUS server can return exists in the Nile Portal and has a subnet at every site where its devices connect.

You do not need to select the RADIUS server in the segment's Authentication dropdown for MAC authentication. Nile selects the server based on the device's location.

Step 3: Configure your RADIUS server

Every external RADIUS server needs the following:

Nile as a RADIUS client: Add each Nile NAS IP from Step 1 as a RADIUS client or network device, with the same shared secret.

Nile dictionary: Import the Nile vendor dictionary (vendor ID 58313) so the server can send the netseg attribute. The dictionary file is in each integration guide below.

Device list: Add the MAC addresses of approved devices to the server, for example, as endpoints in an endpoint group.

Segment name in every reply: Your RADIUS server must return the exact segment name in its Access-Accept. The name is case-sensitive and must match the segment name in the Nile Portal.

Nile attribute: Send the netseg attribute, for example, netseg=Printers.

Standard attribute: If your RADIUS server cannot use a custom dictionary, send the segment name in the Tunnel-Private-Group-ID attribute.

If the segment name is missing or does not match, the device is denied.

Re-authentication time (optional): Send the standard Session-Timeout attribute to set how often Nile authenticates the device again. If you do not send it, Nile authenticates the device again every 24 hours.

Monitoring: Nile checks each RADIUS server every minute. Allow MS-CHAPv2 for the monitoring check. See your server's integration guide below.

Nile sends the following attributes in each MAC authentication request. Use them to match MAC authentication requests in your policies:

User-Name: The device's MAC address in lowercase with no separators, for example, a4ae1233a65d.

Calling-Station-Id: The device's MAC address in uppercase with hyphens, for example, A4-AE-12-33-A6-5D.

Called-Station-Id: Ends with WiredMacAuthSsid.

Service-Type: Call Check.

NAS-Port-Type: Ethernet.

If you are using Cisco ISE, see Cisco Identity Service Engine (ISE) - RADIUS. The ISE MAB authentication rule must match Radius:Service-Type EQUALS Call Check AND Radius:NAS-Port-Type EQUALS Ethernet. Otherwise, ISE does not match requests from Nile. For more details, see the Cisco ISE Administrator Guide - Segmentation.

If you are using Aruba ClearPass, see Aruba Clearpass - RADIUS and the HPE ClearPass Policy Manager User Guide. Use a MAC Authentication service with a service rule where Called-Station-Id contains WiredMacAuthSsid.

If you are using Microsoft NPS, see Microsoft NPS and Configure Network Policies (Microsoft).

Step 4: Verify the connection

Connect the device to a Nile switch port.

In the Nile Portal, open Devices and search for the device's MAC address. Check that it is authenticated by RADIUS MAC authentication, is in the expected segment, and has an IP address from that segment's subnet. Open the device to see its events.

Select Network Setup > Access Management > Wired. The device appears with Authenticated By set to Radius macauth Approved.

Check your RADIUS server log for the matching request and the returned segment name.

External RADIUS MAC Authentication behavior

Replaces Nile MAC Authentication: When Wired MAC Auth is selected, Nile sends wired MAC authentication requests to the RADIUS server instead of using Nile MAC Authentication rules at those locations.

802.1X devices: If a device starts 802.1X, Nile uses only 802.1X for that device. If 802.1X times out, Nile sends a MAC authentication request to the RADIUS server.

Re-authentication: Nile authenticates each device again every 24 hours, or at the Session-Timeout returned by the RADIUS server. Nile also authenticates the device again when it reconnects.

Policy changes: Changes on the RADIUS server, such as a new segment or a denial, apply at the next re-authentication. To apply a change right away, reconnect the device.

Devices behind another device: When several devices connect through one port, such as a computer behind an IP phone, Nile authenticates each MAC address separately.

No VLAN tags: Turn off 802.1Q VLAN tagging on wired devices, such as a voice VLAN on desk phones. Nile does not support tagged traffic from wired devices.

Wired table entries: Devices that authenticate this way appear in the Wired table with Authenticated By set to Radius macauth Approved or Radius macauth Denied. You can edit only the description.

Server failover: Nile tries Host 1 first, then Host 2, then Host 3. When Host 1 returns, Nile uses it again.

Monitoring: Nile checks each RADIUS server every minute and reports latency and up or down status.

Troubleshooting

No request appears on the RADIUS server: Check that Wired MAC Auth is selected on the correct server and that its Geo Scope includes the device's location. Also check that the Nile NAS IPs are added as clients, the shared secret matches, and RADIUS traffic is allowed between the server and the Nile Service Gateway.

Requests arrive, but no policy matches: Update the policy conditions to match the attributes that Nile sends, such as Service-Type set to Call Check and NAS-Port-Type set to Ethernet.

RADIUS server rejects a known device: Check that the MAC address on the server matches the format the server uses for lookups. Nile sends the MAC address in lowercase with no separators in User-Name, and in uppercase with hyphens in Calling-Station-Id.

Device is accepted, but gets no access: The RADIUS reply did not include a segment name, or the name does not exactly match a Nile segment. Also check that the segment has a subnet at the site where the device connects.

New devices do not appear for approval in the Nile Portal: This is expected. Approve new devices on the RADIUS server.

Device keeps its old segment after a policy change: The device keeps its current IP address until it re-authenticates and renews DHCP. Reconnect the cable to apply the new segment right away.

RADIUS logs fill up quickly: Return a longer Session-Timeout so Nile authenticates devices less often.

RADIUS server shows as down in the Nile Portal: Check that the server allows MS-CHAPv2 and that the credentials saved in Verify Hosts are valid.