For enabling wired MAC bypass on Cisco switches there are two commands available.
- dot1x mac-auth-bypass — the Access-Request message is a Password Authentication Protocol (PAP) authentication request
- dot1x mac-auth-bypass eap — the Cisco switch perform MAB as EAP-MD5 authentication
Although PAP authentication has been configured by the switch as well as authentication method in Microsoft NPS Server, authentication does not work. The NPS logs showing rejects for the reason of a not configured protocol type; EAP with type MD5. Sniffing with Network Monitor confirmed Cisco requests EAP communication.
Some researches brought me to the following statement:
In this release, the RADIUS security system with Extensible Authentication Protocol (EAP) extensions is the only supported authentication server.
In current NPS implementation EAP-MD5 cannot be chosen for authentication.
MD5 Challenge is being deprecated and no longer supported since Windows Server 2008/Vista. It can be re-enabled by modifying the registry on the NPS Server, but without any support!
Windows Registry Editor Version 5.00
when values are set, restart the NPS Service
Log Name: Security
Event ID: 6278
Task Category: Network Policy Server
Keywords: Audit Success
Network Policy Server granted full access to a user because the host met the defined health policy.
Authentication Type: EAP
EAP Type: MD5-Challenge
Windows Server 2012R2