An administrator is adding a switch to a network that is running Cisco ISE and is only for IP Phones. The phones do not have the ability to authenticate via 802.1X. Which command is needed on each…

The correct answer is C. mab. MAC Authentication Bypass (MAB) is the correct solution when devices cannot perform 802.1X supplicant-based authentication. The mab interface-level command on a Cisco switch enables MAB, which sends the device's MAC address to ISE as the username and password in a RADIUS…

Policy Enforcement

Question

An administrator is adding a switch to a network that is running Cisco ISE and is only for IP Phones. The phones do not have the ability to authenticate via 802.1X. Which command is needed on each switch port for authentication?

Options

Aenable bypass-MAC
Bdot1x system-auth-control
Cmab
Denable network-authentication

How the community answered

(23 responses)

B
4% (1)
C
91% (21)
D
4% (1)

Explanation

MAC Authentication Bypass (MAB) is the correct solution when devices cannot perform 802.1X supplicant-based authentication. The mab interface-level command on a Cisco switch enables MAB, which sends the device's MAC address to ISE as the username and password in a RADIUS request. ISE then looks up that MAC address in its endpoint database and applies the appropriate authorization policy. IP phones without 802.1X capability are the classic MAB use case. dot1x system-auth-control enables 802.1X globally on the switch (not port-specific MAB), and the other options ('enable bypass-MAC', 'enable network-authentication') are not valid Cisco IOS commands.

Topics

#MAC Authentication Bypass (MAB)#IP Phone Authentication#Cisco ISE#Network Access Control

Community Discussion

No community discussion yet for this question.

Full 300-715 Practice