Study guide
10.3 MAC Authentication and Captive Portal Onboarding
HPE Aruba Networking Certified Associate - Campus Access HPE6-A85
Track your progress as you read
Finished sections get a check mark.
1 Introduction: HPE6-A85 Exam Overview
HPE6-A85 Exam Facts and Current Blueprint
2 Chapter 1: Network Stack Fundamentals
1.1 OSI Reference Model and Encapsulation 1.2 TCP/IP Protocol Suite and IP Headers 1.3 Layer 2 Operation, ARP, and 802.1Q Tagging
3 Chapter 2: Physical Connectivity and Host Addressing
2.1 Ethernet Media and Transceiver Standards 2.2 Power over Ethernet (PoE, PoE+, PoE++) Standards and Budgeting 2.3 LLDP, LLDP-MED, and Voice VLAN Configuration 2.4 Host IP Addressing and DHCP Relay Operations
4 Chapter 3: Network Resiliency and Virtualization
3.1 Virtual Switching Framework (VSF) Architecture and Topologies 3.2 VSF Split Detection, Failover, and Auto-Stacking 3.3 Virtual Switching Extension (VSX) Architecture and Operations 3.4 High-Availability Gateways: VRRP and VSX Active-Gateway
5 Chapter 4: AOS-CX Architecture and Switch Operation
4.1 AOS-CX Hardware Portfolio and State Database Architecture 4.2 Network Analytics Engine (NAE) and Automated Telemetry 4.3 AOS-CX Interface Configuration and Port Control 4.4 Link Aggregation (LAG) and LACP Configuration
6 Chapter 5: Layer 2 Protocols and Spanning Tree
5.1 AOS-CX VLAN Configuration and Native VLAN Handling 5.2 Spanning Tree Protocols: STP, RSTP, and MSTP 5.3 Spanning Tree Protections and Loop Prevention 5.4 MAC Address Table Learning, Aging, and Forwarding
7 Chapter 6: Wireless Fundamentals, Standards, and RF
6.1 IEEE 802.11 Standards and Wi-Fi Generations 6.2 RF Fundamentals, Signal Propagation, and Channel Design 6.3 Aruba Access Point Hardware Portfolio and Suffix Conventions 6.4 WLAN Topologies, BSSID/ESSID, and Roaming Standards
8 Chapter 7: Aruba Wireless Architecture and Management
7.1 AOS 10 Architecture and Aruba Central Integration 7.2 Wireless Forwarding Modes: Bridge vs Tunnel Mode 7.3 Automated RF and Client Optimization: AirMatch and ClientMatch 7.4 Secure Wireless Access: WPA3, SAE, and MPSK Implementation
9 Chapter 8: IP Routing Fundamentals and OSPF
8.1 IP Routing Principles and Packet Forwarding 8.2 OSPFv2 Protocol Mechanics and Adjacency Formation 8.3 OSPF Designated Routers and Multi-Area Deployments 8.4 ECMP, Static Routing, and VRF Isolation
10 Chapter 9: Campus Network Security and Segmentation
9.1 DHCP Snooping and Dynamic ARP Inspection 9.2 Port Security and MAC Address Limiting 9.3 ClearPass Policy Management and RADIUS Change of Authorization 9.4 Dynamic Segmentation, User-Based Tunneling, and Policy Enforcement
11 Chapter 10: Authentication, Authorization, and Accounting
10.1 The AAA Framework and Architecture 10.2 802.1X Authentication and EAP Methods 10.3 MAC Authentication and Captive Portal Onboarding 10.4 Administrative Access Control: RADIUS vs TACACS+
12 Chapter 11: Network Management and Telemetry
11.1 Aruba Central Cloud Architecture and Group Configuration 11.2 Zero-Touch Provisioning (ZTP) and Aruba Activate 11.3 AI Insights and Aruba User Experience Insight (UXI) 11.4 Network Telemetry, Streaming APIs, and SNMP/Syslog
13 Chapter 12: Troubleshooting the Solution
12.1 Structured Troubleshooting Methodologies and Scope Isolation 12.2 AOS-CX Layer 2 and Interface Diagnostic Commands 12.3 Layer 3, IP Services, and End-to-End Diagnostics 12.4 Physical-Layer Troubleshooting 12.5 Troubleshooting Wireless Clients and Network Access
14 Chapter 13: Optimizing Performance: QoS, Baselines, and Comparisons
13.1 Quality of Service (QoS) Classification and Marking 13.2 Queuing Algorithms and Congestion Management 13.3 Traffic Policing, Shaping, and Broadcast Rate Limiting 13.4 Establishing a Performance Baseline 13.5 Comparing Results to the Baseline
15 Chapter 14: Plan the Solution
14.1 Analyzing the Current Environment 14.2 Interpreting an Architect's High-Level Design 14.3 Creating a Low-Level Design 14.4 Preparing for Implementation
16 Chapter 15: Validate and Operate the Solution
15.1 Validating the Solution 15.2 Performing Firmware Updates 15.3 Making Basic Ongoing Configuration Changes 15.4 Maintaining Network Documentation
10.3 MAC Authentication and Captive Portal Onboarding
Key Takeaways Explain This Topic AI
MAC Authentication (MAC-Auth / MAB) provides automated, transparent network admission for headless IoT devices (printers, cameras, environmental monitors) that lack 802.1X supplicant software.
During MAC-Auth, the switch acts as an authentication proxy, transmitting a RADIUS Access-Request where both the username and password are populated with the client's Layer 2 MAC address.
Because MAC addresses can be trivially spoofed on an Ethernet broadcast domain, MAC-Auth must be paired with ClearPass device profiling (DHCP fingerprinting, LLDP, User-Agent) and dynamic role enforcement.
AOS-CX can run 802.1X and MAC authentication one after another or, with port-access onboarding-method concurrent enable , at the same time; by default concurrent onboarding prefers 802.1X, then MAC-Auth, then device profile.
Captive Portal onboarding redirects unauthenticated HTTP/HTTPS web sessions to an external ClearPass Guest portal, facilitating guest self-registration, employee sponsorship, and dynamic role transitions via RADIUS CoA.
Last updated: October 2026
MAC Authentication and Captive Portal Onboarding
Quick Summary: Enterprise campus networks must accommodate thousands of devices that cannot run an 802.1X supplicant. MAC Authentication (MAC-Auth) addresses headless Internet of Things (IoT) devices—printers, IP cameras, medical sensors, and badge readers—by having the switch act as a proxy, querying ClearPass using the client's Layer 2 MAC address. Because MAC addresses lack cryptographic integrity and can be spoofed, ClearPass augments MAC-Auth with device profiling (DHCP fingerprinting, LLDP/CDP, and HTTP telemetry). For human guests and unmanaged contractor laptops, Captive Portal intercepts web traffic, presents an onboarding portal for self-registration or employee sponsorship, and dynamically upgrades network privileges using RADIUS Change of Authorization (CoA) .
The Headless Device Challenge in Enterprise Networks
While corporate laptops and smartphones natively execute 802.1X supplicant software, modern campus facilities host vast fleets of embedded, specialized endpoints:
Building Automation: Smart LED lighting controllers, HVAC thermostats, badge readers, physical door locks.
Surveillance and Media: IP security cameras, digital signage displays, conference room audio/video bars.
Enterprise Peripherals: Networked multi-function printers, label makers, desktop VoIP phones.
Healthcare and Industrial: Patient telemetry pumps, barcode scanners, PLC controllers.
These endpoints lack interactive graphical user interfaces, full operating systems, or 802.1X client stacks. Disabling switch port security to accommodate them compromises campus integrity. MAC Authentication (MAC-Auth) —known broadly in the networking industry as MAC Authentication Bypass (MAB)—provides a transparent admission mechanism.
MAC Authentication Operational Mechanics
In MAC-Auth, the client endpoint performs no authentication signaling whatsoever. It simply powers up, establishes physical link, and transmits standard Ethernet frames (such as a DHCP Discover or ARP request). The AOS-CX switch acts as an authentication proxy : +---------------------------------------------------------------------------------------------------------+
- | MAC AUTHENTICATION TRANSACTION FLOW |
- | |
- | [ Headless Device ] [ AOS-CX Switch (Proxy) ] [ ClearPass Policy Manager ] |
- | (IP Camera) | | |
- | | --- Standard Traffic (ARP) --> | | |
- | | (Src: 00:09:b0:12:34:56) | | |
- | | | --- RADIUS Access-Request -------------> | |
- | | | User-Name: 0009b0123456 | |
- | | | User-Password: 0009b0123456 | |
- | | | Calling-Station-Id: 0009b0123456 | |
- | | | | |
- | | | +-- Checks DB |
- | | | +-- Evaluates |
- | | | <--- RADIUS Access-Accept -------------+ Profiling |
- | | | Aruba-User-Role: CAMERAS_ROLE | |
- | | | | |
- | | +-- Applies Role & VLAN to Port 1/1/5 | |
- | | <=== Permitted Data Traffic == | | |
- +---------------------------------------------------------------------------------------------------------+
- Step-by-Step MAC-Auth Execution
Link Detection and Frame Ingress: The headless endpoint connects to port 1/1/5 . The switch detects link-up and listens for the initial Layer 2 frame. It extracts the client's 48-bit source MAC address ( 00:09:B0:12:34:56 ).
RADIUS Proxy Generation: The switch formats a standard RADIUS Access-Request packet:
User-Name = Client MAC address (configurable format: lowercase, uppercase, with or without colons/hyphens; e.g., 0009b0123456 ).
User-Password = Client MAC address (hashed with the RADIUS shared secret).
Service-Type = Call-Check (Attribute 6, value 10 ), alerting ClearPass that this is an automated MAC authentication check rather than a human interactive login.
Calling-Station-Id = 00-09-B0-12-34-56 (Client MAC).
NAS-Port-Id = Physical port string ( 1/1/5 ).
ClearPass Policy Evaluation: ClearPass receives the request and searches its local identity stores:
Endpoints Repository: Database of known, profiled MAC addresses.
Guest Device Database: Devices pre-registered by guests or employees through the ClearPass Guest portal.
Static Host Lists: Manually maintained lists of approved hardware MAC addresses.
Enforcement and Policy Response: If the MAC address is recognized and authorized, ClearPass returns a RADIUS Access-Accept containing the Aruba-User-Role (e.g., CAMERAS_ROLE ). The switch applies the role and opens the controlled port.
MAC Spoofing Risks and ClearPass Profiling Defenses
MAC Authentication possesses a severe, inherent vulnerability: MAC addresses are entirely unencrypted and easily forged .
The Spoofing Threat
Ethernet frames broadcast source MAC addresses across the local LAN in cleartext. A malicious actor with a laptop can disconnect an authorized multi-function printer, run a packet analyzer or read the MAC address printed on the physical asset tag, and use standard operating system commands to clone that MAC address onto their own network interface card ( macchanger -m 00:09:B0:12:34:56 eth0 ). When the attacker plugs into the switch port, the switch initiates MAC-Auth, ClearPass sees the authorized printer MAC, and the attacker is granted admission to the corporate network. +---------------------------------------------------------------------------------------------------------+
- | CLEARPASS MULTI-FACTOR DEVICE PROFILING |
- | |
- | [ Ingress Device ] |
- | (Asserts Printer MAC) |
- | | |
- | +---> 1. DHCP SNOOPING TELEMETRY ----> Option 55 (Parameter Request List) & Option 60 |
- | | (Reveals underlying OS fingerprint) |
- | +---> 2. LLDP / CDP NEIGHBOR DATA ---> System Description: "Axis M3045 Network Camera" |
- | | (Contradicts printer MAC assertion!) |
- | +---> 3. HTTP USER-AGENT SNOOPING ---> Web Client Header: "Mozilla/5.0 (Windows NT 10.0)" |
- | | (Identifies attacker's true OS) |
- | v |
- | [ ClearPass Profiler Engine ] ========> MISMATCH DETECTED! |
- | MAC = Printer, but OS = Windows 10 Laptop! |
- | ACTION: CoA Disconnect / Quarantine Port! |
- +---------------------------------------------------------------------------------------------------------+
- Multi-Factor Profiling Telemetry
To defeat MAC spoofing, enterprise architectures combine MAC-Auth with Aruba ClearPass Device Profiling . ClearPass ingests multiple contextual data feeds to construct a multidimensional fingerprint of the connected device:
DHCP Fingerprinting: When an endpoint requests an IP address, the access switch snoops the DHCP Discover/Request and relays telemetry to ClearPass. ClearPass evaluates DHCP Option 55 (Parameter Request List) and Option 60 (Vendor Class Identifier). A genuine Hewlett Packard LaserJet printer requests vastly different DHCP options in a different sequence than a Windows 10 laptop or Linux workstation.
LLDP and CDP Snooping: Managed endpoints advertise capabilities via Link Layer Discovery Protocol (LLDP). The switch collects LLDP TLVs (such as System Description and System Capabilities ) and relays them to ClearPass via RADIUS accounting or streaming APIs.
HTTP User-Agent Snooping: When the device initiates outbound web traffic, web proxy or switch telemetry captures the User-Agent string, confirming the exact browser or embedded client runtime.
Automated Quarantine via CoA: If a device authenticates with an approved printer MAC address, but its DHCP fingerprint reveals a Linux kernel or Windows desktop, ClearPass detects the anomaly. It immediately fires an automated RADIUS Change of Authorization (CoA) packet to the switch, terminating the session or pushing a quarantine role.
Authentication Sequencing: Fallback vs. Concurrent
Because campus switch ports serve diverse devices, network engineers must configure ports to handle both 802.1X-capable laptops and headless IoT devices. AOS-CX switches support two operational paradigms: +---------------------------------------------------------------------------------------------------------+
- | SEQUENTIAL FALLBACK VS. CONCURRENT AUTH |
- | |
- | [ SEQUENTIAL FALLBACK ] (Legacy / Default) |
- | Port Link Up ----> 802.1X Starts ----> Waits for Timeout (30s) ----> Falls back to MAC-Auth |
- | (Printers and cameras endure a 30-second connectivity delay!) |
- | |
- | [ CONCURRENT AUTHENTICATION ] (High-Performance Modern Enterprise) |
- | Port Link Up ----+---> 802.1X Starts (EAPOL-Request) -----------------------------------------------+|
- | +---> MAC-Auth Starts (RADIUS Access-Request) -----------------------------+|| |
- | (Printers authenticate in milliseconds; Laptops prioritize 802.1X roles!) vv |
- +---------------------------------------------------------------------------------------------------------+
- 1. Sequential Fallback (802.1X with MAC-Auth Fallback)
Under sequential fallback, the switch prioritizes 802.1X. Upon physical link-up, the switch transmits EAP-Request/Identity frames, repeating them every discovery-period up to max-eapol-requests . If no EAPOL response arrives, the switch concludes the device lacks a supplicant, times out 802.1X, and initiates MAC-Auth. While secure, this creates an operational penalty: headless IoT devices experience a 20-to-30 second onboarding delay before network communication begins.
2. Concurrent Onboarding ( port-access onboarding-method concurrent enable )
AOS-CX switches overcome this delay with concurrent onboarding . When a device connects, the switch starts 802.1X and MAC-Auth at the same time (AOS-CX 10.14 CLI Guide). The client sits in the pre-auth role until one method succeeds or all fail; if all fail, the reject or critical role is applied based on the 802.1X failure reason:
For a printer: The switch transmits an EAPOL request while simultaneously dispatching a RADIUS MAC-Auth request. The printer ignores EAPOL, but the MAC-Auth transaction completes in under 200 milliseconds, granting instant access.
For a corporate laptop: Both methods trigger. The default priority is 802.1X, then MAC-Auth, then device profile, so the 802.1X result takes precedence when it completes.
Caution: some RADIUS servers block a client that sends two requests at once. If that happens, use aaa authentication port-access auth-precedence with auth-priority instead of concurrent onboarding.
Captive Portal and Web-Based Onboarding
For visitor guests, vendors, and unmanaged contractor laptops, neither 802.1X corporate credentials nor pre-registered MAC addresses are available. Captive Portal onboarding provides a browser-based admission workflow: +---------------------------------------------------------------------------------------------------------+
- | CAPTIVE PORTAL ONBOARDING WORKFLOW |
- | |
- | [ Guest Client ] [ AOS-CX Switch ] [ ClearPass Guest Portal ] |
- | | | | |
- | | --- 1. Connects to Port --------> | | |
- | | +-- Assigns "GUEST_LOGON" Role | |
- | | (Permits DNS/DHCP; Redirects HTTP) | |
- | | | | |
- | | --- 2. HTTP Request (cnn.com) -> | | |
- | | <== 3. HTTP 302 Redirect ========+ (Location: https://cppm.corp/guest) | |
- | | | |
- | | --- 4. Opens Browser to Portal ---------------------------------------> | |
- | | <== 5. Renders Self-Registration / Sponsor Form ======================= | |
- | | | |
- | | --- 6. Submits Registration / Guest Accepts Terms --------------------> | |
- | | +-- Approves Guest |
- | | | <--- 7. RADIUS CoA (RFC 3576) -------+ |
- | | | Switch transitions client to |
- | | | "GUEST_INTERNET" Role |
- | | <=== 8. Unrestricted Internet == | |
- +---------------------------------------------------------------------------------------------------------+
- The Redirection Lifecycle and Dynamic Role Transitions
Initial Unauthenticated State: The guest connects. MAC-Auth triggers and fails (or assigns a default initial role: GUEST_LOGON ).
The Redirection ACL: The GUEST_LOGON role contains a captive portal profile and ACL rules:
Permitted Traffic: UDP port 67/68 (DHCP) and UDP port 53 (DNS). If DNS is blocked, the client cannot resolve domain names, and redirection completely fails!
Intercepted Traffic: TCP port 80 (HTTP) and TCP port 443 (HTTPS). When the guest browser attempts to reach an external website, the switch intercepts the TCP handshake and responds with an HTTP 302 Temporary Redirect pointing to the ClearPass Guest portal URL.
Portal Interaction and Sponsorship: The guest browser navigates to ClearPass Guest. Options include:
Self-Registration: Guest enters name, email, and mobile number. ClearPass generates temporary credentials delivered via SMS.
Sponsor Approval: Guest enters the email of an internal employee. ClearPass emails the employee an approval link. Internet access remains suspended until the sponsor clicks "Approve".
RADIUS Change of Authorization (CoA): Once authenticated, ClearPass must update the client's state without requiring the user to unplug the Ethernet cable or bounce the switch port. ClearPass transmits an asynchronous RADIUS CoA message (RFC 3576 / 5176) to the switch:
The CoA instructs the switch to transition the client from GUEST_LOGON to GUEST_INTERNET .
The switch updates hardware forwarding tables, removing redirection ACLs and applying outbound Internet routing policies.
AOS-CX Configuration Commands and Verification
The following configuration demonstrates configuring MAC-Auth, enabling concurrent authentication, and establishing a captive portal redirect profile: switch# configure terminal
- ! Step 1: Configure RADIUS Server and Enable Dynamic Authorization (CoA)
- switch(config)# radius-server host 10.10.100.50 key plaintext SecretRadiusKey123
- switch(config)# radius dyn-authorization enable
- switch(config)# radius dyn-authorization client 10.10.100.50 secret-key plaintext SecretRadiusKey123
- ! Step 2: Define Captive Portal Redirect Profile
- switch(config)# aaa authentication port-access captive-portal-profile CPPM_GUEST_PORTAL
- switch(config-captive-portal)# url https://clearpass.corp.example.com/guest/guest_login.php
- switch(config-captive-portal)# exit
- ! Step 3: Define Roles for Initial Logon and Post-Auth Internet
- switch(config)# port-access role GUEST_LOGON_ROLE
- switch(config-pa-role)# captive-portal-profile CPPM_GUEST_PORTAL
- switch(config-pa-role)# vlan access 100
- switch(config-pa-role)# exit
- switch(config)# port-access role GUEST_AUTH_ROLE
- switch(config-pa-role)# vlan access 100
- switch(config-pa-role)# exit
- ! Step 4: Configure Port 1/1/2 for concurrent 802.1X and MAC-Auth
- switch(config)# aaa authentication port-access mac-auth enable
- switch(config)# interface 1/1/2
- switch(config-if)# no routing
- switch(config-if)# vlan access 1
- switch(config-if)# aaa authentication port-access client-limit 4
- switch(config-if)# aaa authentication port-access dot1x authenticator enable
- switch(config-if)# aaa authentication port-access mac-auth enable
- switch(config-if)# port-access onboarding-method concurrent enable
- switch(config-if)# exit
- Essential Verification Commands
Verification Command Diagnostic Purpose
show aaa authentication port-access interface 1/1/2 client-status Shows each client on the port, its authentication method, and status.
show port-access clients interface 1/1/2 Lists all active clients on port 1/1/2, identifying authentication method (dot1x vs mac-auth) and assigned User Role.
show port-access clients onboarding-method Shows which onboarding method (concurrent or precedence) each client used.
show radius dyn-authorization Displays statistics for incoming RADIUS CoA and Disconnect messages from ClearPass.
Common Exam Traps
MAC-Auth Security Assumption: An exam question might suggest MAC-Auth provides strong identity verification for IoT devices. MAC-Auth provides no cryptographic verification ; it is purely an identity check based on cleartext Layer 2 addresses and requires ClearPass profiling to mitigate spoofing.
Blocking DNS in Captive Portal: If a captive portal redirection ACL blocks UDP port 53 (DNS), the client will be unable to resolve the hostname of the ClearPass portal (or initial destination websites), completely breaking redirection.
Forgetting dynamic authorization: If radius dyn-authorization enable and a matching radius dyn-authorization client are missing, the switch will not accept RADIUS CoA messages from ClearPass, so guests stay in the onboarding role after a successful login.