TLDR
- The MAC travels in Calling-Station-Id, ideally as 00-10-A4-23-19-C0 (RFC 3580).
- It fits operator-managed CPE, ONTs, and set-top boxes on a known line.
- Cloning fools a MAC-only check, and randomization breaks it.
- Line identity or a real credential adds the proof a MAC lacks.
RADIUS MAC authentication identifies a device by its MAC address instead of a username and password. The network access server (NAS) places the MAC in Calling-Station-Id (and often User-Name), and the AAA server checks it against an allowed list or subscriber record. It suits managed CPE and ONTs but is weak alone because MAC addresses can be spoofed.
For a fixed-line operator, these are customer premises equipment (CPE) such as home gateways, optical network terminals (ONTs), and Internet Protocol television (IPTV) set-top boxes (STBs). None can type a password, yet the authentication, authorization, and accounting (AAA) server must still decide what service each gets.
RADIUS (Remote Authentication Dial-In User Service, RFC 2865) is how the NAS asks the AAA server for an access decision. A media access control (MAC) address is the hardware address assigned to a network interface, normally by its manufacturer.
How RADIUS MAC authentication works
In RADIUS MAC authentication, the AAA server decides on Access-Accept or Access-Reject from the MAC in Calling-Station-Id alone. On broadband lines, the NAS is usually a broadband network gateway (BNG), which acts on the device’s first Dynamic Host Configuration Protocol (DHCP) DISCOVER.
- An Access-Request (RFC 2865, Section 4.1) carries the MAC in Calling-Station-Id (Section 5.31) and usually in User-Name (Section 5.1).
- The AAA server normalizes the MAC and looks it up in an allowed list (a RADIUS MAC whitelist) or subscriber record.
- It returns Access-Accept (Section 4.2) with a virtual local area network (VLAN), address pool, or service profile, or returns Access-Reject (Section 4.3).
Many NASes also send the MAC, or a fixed string, as User-Password (RFC 2865, Section 5.2). Neither adds security: a password derived from the MAC, or shared by every device, says nothing about the sender. For attribute encoding, see our RADIUS protocol overview.
Calling-Station-Id MAC format in RADIUS
RFC 2865 defined Calling-Station-Id for a dial-up caller’s phone number. For IEEE 802.1X authenticators, RFC 3580, Section 3.21 later recommended writing the MAC there in uppercase, with hyphens between octets (bytes). Not every NAS follows it.
| MAC address format | Example | Where it shows up |
| Uppercase, hyphens | 00-10-A4-23-19-C0 | RFC 3580 recommendation |
| Lowercase, colons | 00:10:a4:23:19:c0 | Common on access equipment |
| No separators | 0010a42319c0 | Often in User-Name |
| Dotted groups of four | 0010.a423.19c0 | Some switch and router platforms |
In deployments we often trace failed MAC authentications to a format mismatch, typically after a new NAS model joins the network. The durable fix is to normalize every MAC to one format on the AAA server before lookup, so each NAS keeps its own habits.
Where MAC authentication fits in operator networks
RADIUS MAC auth for CPE works because the operator ships the device, records its MAC, and knows its access line. For operator-owned hardware, MAC address authentication is a workable form of device-based authentication.
MAC authentication for broadband CPE and ONTs
IP over Ethernet (IPoE) broadband has no Point-to-Point Protocol over Ethernet (PPPoE) login, so the BNG triggers RADIUS on the first DHCP request. The MAC of the home gateway, or of a routing ONT, becomes the session identity. The AAA server returns the subscriber’s speed profile and address pool.
On fiber-to-the-home (FTTH) networks, the optical line terminal (OLT) registers the ONT itself, usually by serial number. MAC authentication comes later, at the BNG. For fiber AAA, see AAA for FTTH.
Device swaps are where this goes wrong. A replacement gateway’s MAC must reach the subscriber record before first boot, or that boot ends in Access-Reject.
MAC authentication for set-top boxes
The operator records each set-top box’s MAC when it ships. When the home gateway bridges the STB onto an IPTV VLAN, the BNG sees that MAC, and the AAA server admits only provisioned boxes.
Access-Accept then returns the IPTV profile, such as the address pool and multicast policy. On an access switch with dynamic VLAN assignment, Tunnel-Type=VLAN (13), Tunnel-Medium-Type=802, and Tunnel-Private-Group-ID set the port’s VLAN (RFC 3580, Section 3.31).
Many set-top boxes lack an 802.1X supplicant, the client software that runs the authentication exchange, so MAC authentication is often the practical option.
Limits of MAC authentication: spoofing and randomization
RADIUS MAC authentication identifies a device without authenticating it: any device presenting an allowed MAC passes a MAC-only check.
MAC spoofing risk
Anyone who reads a gateway’s label or sniffs home network traffic can clone its MAC in software. On Wi-Fi, MAC addresses stay unencrypted even when the traffic is encrypted (RFC 9797, Section 2.1).
On wired access, a cloned MAC usually lands on the wrong line, which the AAA server catches only if it checks the line too. One MAC active on two lines usually means cloning.
MAC randomization impact
Most phone and laptop operating systems now randomize Wi-Fi MAC addresses, often by default (RFC 9797, Appendix A.3). A device may use a different address per network name, or service set identifier (SSID). Operator-managed CPE, ONTs, and set-top boxes keep factory addresses and are unaffected.
Carrier Wi-Fi feels it most. Hotspots often pair MAC authentication with a captive portal, the sign-in page shown before access; the cached MAC lets returning users skip it. A new address forces a new login.
Randomized addresses set the locally administered bit (IEEE Std 802-2014, Clause 8.4), so their second hex digit is 2, 6, A, or E. Not every such address is random, but the AAA server can treat them as likely randomized and route them to the portal or 802.1X.
Layering MAC authentication with Option 82 and stronger identity
Pairing the MAC with DHCP Option 82 circuit identity (RFC 3046, Section 3.1) lets the AAA server check the device and its line. The access node, as DHCP relay agent, inserts Agent Circuit ID and Agent Remote ID (Sections 3.1 and 3.2). The BNG passes them to RADIUS as Agent-Circuit-Id and Agent-Remote-Id (RFC 4679, Sections 3.3.1 and 3.3.2).
Where a device runs a supplicant, 802.1X with the Extensible Authentication Protocol (EAP) adds a real credential. A device certificate goes further: its private key can’t be read off a label. Certificates usually run over EAP Transport Layer Security (EAP-TLS).
| Method | What the AAA server checks | Spoofing resistance | Device needs | Best fit |
| MAC only | MAC in an allowed list | Low | Nothing | Low-risk services on dedicated ports |
| MAC + DHCP Option 82 | MAC and access line | Medium | Nothing; the access node adds Option 82 | IPoE over fiber or digital subscriber line (DSL) |
| 802.1X, password-based EAP | User or device credential | Medium to high | 802.1X supplicant | Managed CPE, business devices |
| 802.1X with certificates (EAP-TLS) | Private key behind a device certificate | High | Supplicant, certificate lifecycle | Business CPE, carrier Wi-Fi |
Devices without a supplicant often fall back to MAC Authentication Bypass (MAB), which uses the same RADIUS exchange. Keep MAB devices in a restricted VLAN.
Consider a fiber internet service provider (ISP) on IPoE. The OLT relays DHCP and inserts Option 82, its circuit ID naming the subscriber’s ONT port. At boot, the BNG sends one Access-Request with the gateway MAC in Calling-Station-Id and the line in Agent-Circuit-Id.
Access is granted only when both values match one subscriber record. A cloned MAC on a neighbor’s line fails the circuit check and gets Access-Reject.
A genuine swap on the right line fails only the MAC check. The AAA server can accept it into a walled garden, a restricted profile that reaches only self-service re-registration.
After a power cut, thousands of gateways can need these lookups at once. The Alepo AAA Server datasheet rates our carrier-grade AAA server at 36,000+ transactions per second.
FAQs
Q1. What is RADIUS MAC authentication?
It admits a device by its MAC address, which the AAA server checks against an allowed list or subscriber record.
Q2. How is the MAC address sent in RADIUS?
The NAS sends it in Calling-Station-Id and usually User-Name. RFC 3580, Section 3.21 recommends uppercase, hyphen-separated octets; formats vary, so normalize before lookup.
Q3. Is RADIUS MAC authentication secure?
Not on its own. A MAC is easy to observe and change, so it identifies a device without proving it. Add line identity, 802.1X, or certificates where cloning matters.
Q4. What is the difference between MAC authentication and 802.1X?
MAC authentication checks an address the NAS observes; the device takes no part. With 802.1X (IEEE 802.1X-2020), a supplicant presents a credential over EAP. MAC Authentication Bypass is the usual fallback.
Q5. Does MAC randomization break MAC authentication?
It often does for phones and laptops on Wi-Fi, whose addresses can change per network or over time. Operator-managed CPE, ONTs, and set-top boxes are unaffected.
Q6. When should operators use MAC authentication?
Use it for operator-provisioned devices on identifiable lines, such as IPoE gateways, ONTs, and set-top boxes. Avoid it as the only check on public Wi-Fi.
Q7. How do you stop MAC spoofing?
Bind each MAC to its line with DHCP Option 82 and flag any MAC active on two lines. End suspect sessions with a Disconnect-Request (RFC 5176, Section 2.1), and move higher-risk devices to 802.1X with certificates.
When MAC authentication is enough
RADIUS MAC authentication earns its place where the operator owns the device and can see its line. There, bind the MAC to Option 82, normalize formats on the AAA server, and update the MAC at every box swap. Elsewhere, treat the MAC as a hint and use 802.1X or certificates.
Planning device authentication for your CPE, ONT, and set-top box fleet? Book a demo to walk through your design with Alepo’s AAA specialists.
