Configure Local MAC Authentication on Cisco WLCs

Mac filtering was popular back when WEP was the only means of wireless security. Mac filtering added an additional layer of authentication by validating the wireless NIC mac address prior to authenticating to a wireless network. Although, mac filtering is still used today, it is a management burden for larger deployments and it is very easy for a hacker to spoof the mac address with a sniffer since the mac is sent in the clear.

What you need know about local authentication on the Cisco WLC. By default, the WLC local database supports 512 entries and can be configured up to a total of 2048 max entries. This is a hard limitation and can not be exceeded unless you use a Radius server for MAC authentication.

LOCAL WLC DATABASE

The local user database is limited to a maximum of 2048 entries and is set to a default value of 512 entries. 

The local database stores entries for these items:

•MAC filters (clients)

•AP MIC/SSC (AP authorization list)

•Dynamic Interfaces

•Management users

•Local net users

•Excluded Clients

 

Together, ALL of these types of entries CANNOT exceed the configured database size.

In order to increase the local database to 2048, use this command from the CLI:

  

(Cisco Controller)Config database size ?

<count>        Enter the maximum number of entries (512-2048)

 

SHOW DATABASE SUMMARY 

 

This command will display the size of the database and current number of entries. 

 

(Cisco Controller) >show database summary

 

Current Max database entries..................... 512 <--- Default database size

Max database entries on next reboot.............. 512

Current number of entries used................... 5 <--- This is 3 user accounts and 2 dynamic interfaces

 

CONFIG MACFILTER IN LOCAL WLC DATABASE

 

The macfilter and WLAN ID are requirements

config <macfilter> <WLAN ID> [interface_name] [description] [IP address] 

 

These commands are optional and are not a requirement

[interface_name] [description] [IP address] 

 

(Cisco Controller) >config macfilter add 00:21:6A:11:A8:AA 2

 

 

ENABLE MACFILTERING ON WLAN

 

(Cisco Controller) >config wlan mac-filtering enable  2

 

SHOW MACFILTER SUMMARY

 

(Cisco Controller) >show macfilter summary

 

MAC Filter RADIUS Compatibility mode............. Cisco ACS

MAC Filter Delimiter............................. None

Local Mac Filter Table

MAC Address               WLAN Id          IP Addr           Description

-----------------------   --------------   ---------------   --------------------------------

00:21:6a:11:a8:aa           2              unknown

 

 

SHOW MACFILTER DETAIL 

(Cisco Controller) >show macfilter detail 00:21:6a:11:a8:aa

 

MAC Address...................................... 00:21:6a:11:a8:aa

WLAN Identifier.................................. 2

Interface Name...................................

IP Address....................................... unknown

Description......................................

 

MAP MAC ADDRESS TO IP ADDRESS

The config macfilter ip-address command lets you map an existing MAC-filter to an IP address. Use this command in order to configure an IP address into the local MAC filter database:

 

Config <macfilter> <WLAN ID> [interface_name] [description] [IP address] 

(Cisco Controller) >config macfilter add 00:21:6A:11:A8:AA 2 interface "description" 192.168.1.10

 

Note: <description>  Enter optional description (up to 32 characters) within double quotes