MAC-Based VLAN Assignment Using 802.1x in UniFi Network

RADIUS-based MAC Authentication (802.1X) allows you to use your database of MAC Addresses to authenticate wired and wireless clients connecting to your network.

Note: If you don't already have a RADIUS server configured with MAC addresses, or you have a small quantity of devices, consider using the MAC Access Control List option.

Types of 802.1x Authentication

Once 802.1x is enabled on a port, several different modes can be set to determine how authentication is handled for connected clients.

Credentials: Requires the client to run an 802.1X supplicant and pass RADIUS authentication. The port will accept all clients to access once it's authenticated by one client(EAP only).
Multiple Credentials: Requires the client to run an 802.1X supplicant and pass RADIUS authentication (EAP only). Only authenticated clients can access the port.
MAC Address: The switch uses the client's MAC address as the username/password against the RADIUS database; this also supports EAP authentication.
Always Unauthorized: Rejects all client traffic; the port acts as if it is logically shut down.

Configure a RADIUS Profile

1. Navigate to Settings > Networks > RADIUS Servers.
   1. If using a UniFi Gateway, enable/resume the Default RADIUS profile.
   2. If using a third-party RADIUS server, select Create New.
2. Create a new RADIUS User (using Local Credentials for UniFi's native RADIUS server) with the following settings:
   1. Username & Password: MAC Address of the device
      1. Every User’s MAC Address must be formatted the same way: AABBCCDDEEFF (no separators)
   2. VLAN ID: Optionally add a VLAN ID to assign the client. If it is left blank, the client will be assigned to the VLAN associated with the switch port or WiFi it is connected to.
      1. If a VLAN is added:
         1. Tunnel Type: 13
         2. Tunnel Medium Type: 6
      2. If no VLAN is added:
         1. Tunnel Type: None
         2. Tunnel Medium Type: None
3. Navigate to Settings > Networks.
   1. Check the box beside 802.1X Control.
   2. Under RADIUS Profile, select the profile you configured in Step 1.
   3. Click Apply Changes.

Note: MAC-based authentication accounts can only be used for wireless and wired clients. L2TP remote access does not apply.

Apply the Profile

Wireless Devices

1. Navigate to Settings > WiFi and select your WiFi
2. In your WiFi Settings, enable RADIUS MAC Authentication.
   1. Select the MAC Address Format that matches the format you’ve used (see point 2.a.i, above)

Wired Devices

To apply this globally, go to Settings > Networks > Global Switch Settings. To individually configure a port, follow these steps:

1. Navigate to Settings > Profiles > Ethernet Ports
2. Create a New Profile with the following settings:
   1. Primary Network: Default or another specific network
   2. 802.1X Control: MAC-based
3. Navigate to a UniFi Switch’s Port Manager.
   1. UniFi Devices > Select a Switch > Port Manager
4. Select your port.
5. Select Ethernet Port Profile and choose the profile you’ve just built.
6. Apply Changes.