Onboard IoT devices by creating MAC-based accounts automatically

In this topic, you will learn how to configure Portnox™ Cloud to create MAC-based accounts automatically for any new devices connecting to the network.

Important:
To be able to onboard IoT devices using their MAC addresses, your NAS must support MAB authentication.
Warning:
Keeping MAC-address-based onboarding enabled means any device can connect to your network – functionally equivalent to running an open network with no authentication at all. This feature is designed as a temporary, bulk onboarding tool for discovering and enrolling new IoT and MAB-authenticating devices, not as a permanently enabled onboarding method. Enable it only during a migration, site rollout, or initial onboarding period, and disable it the moment all intended devices have been enrolled: the shorter the period this feature stays enabled, the smaller the window of exposure. For guidance on using this feature effectively, see: How to onboard IoT devices using MAC-address-based onboarding.
Important:
Activate automatic device registration after onboarding all company devices. Otherwise, any new device (not just IoT) will be automatically added to the network as described below. In particular, if company devices such as laptops or phones are not onboarded first, they may end up authenticating using their MAC address instead of 802.1X, which is far less secure.
Note:
Once a MAC address has been onboarded and associated with an account – including a device-type account it was later moved to – re-enabling this feature will not re-onboard or move that device back. It will authenticate normally under its existing account, or fail with a MAC Onboarding failed because device already exists in organization alert if authentication itself fails for another reason. This feature only onboards MAC addresses it has never seen before.

You can use this method to connect IoT devices to wired or Wi-Fi networks. The procedure is the same for both network types.

Activate automatic device registration

Before you activate automatic device registration, make sure that the Default group allows MAC-based authentication for all relevant networks (wired and specific Wi-Fi). For more information about creating and editing the networks in the group, see the following topic: Create a group.

  1. In the Cloud portal top menu, click on the Settings option.

  2. In the Cloud portal left-hand side menu, click on the Services > GENERAL SETTINGS > MAC-address-based onboarding option.

  3. In the right-hand side pane, under the MAC-address-based onboarding heading, click on the Edit link below.

  4. Click on the Grant access to any device... checkbox to activate it and in the Assign to the group field, select the group that Portnox Cloud will use for newly onboarded devices’ accounts.

    If this setting is turned on, for each new device that connects to the network, Portnox Cloud will do the following:

    • Create a MAC-based account. The name of the account will be the name of the network adapter vendor, which is automatically identified using the MAC address.

    • Assign the account to the group selected in the Assign to the group field.

    • Add the device to this MAC-based account.

      • If agentless IoT device fingerprinting is on (Services > GENERAL SETTINGS > Agentless IoT Device Fingerprinting), the name of the device will be automatically identified using the MAC address of its adapter.

      • If agentless IoT device fingerprinting is off, the name of the device will be the MAC address of its adapter.

    As a result, the device will immediately have access to the network with privileges of the selected group. This will be confirmed by an 802.1X authentication success alert specifying the device connected via auto-onboarding.

    Note:
    If a connecting device matches an existing account based on the vendor, Portnox Cloud places the device into that pre-existing account and preserves its current group mapping, which may be different from the Assign to the group setting. In this case, the Assign to the group setting is ignored. However, the Grant access to any device... checkbox must remain active for the device to be added to the account. The only time that this checkbox does not have to be active for a device to be added to a MAC-based account is if the account has a whitelisted vendor.
    Note:
    If a device is already enrolled and authenticating using 802.1X, Portnox Cloud automatically recognizes the existing enrollment during MAC-based onboarding and does not create a duplicate device record.
  5. Optional: Click on the Automatically assign devices a VLAN, rather than the Portnox default group checkbox to activate it and enter the VLAN number in the adjacent field.

    If this setting is turned on, new devices that connect to the network will be quarantined in the selected VLAN and the automatically created accounts will be treated as quarantine accounts.

    To remove the device from quarantine and let it access the network, you have to manually add the device’s MAC address to another MAC-based account and delete the quarantine account.

  6. Click on the Save button to save your changes or click on the Cancel button to abandon all changes.

    After you click on one of the buttons, Portnox Cloud will exit the edit mode.

Note:
By default, if a device doesn’t connect to the network for 90 days, its MAC address is removed from the MAB account. You can change this period or disable this option here: Settings > Services > GENERAL SETTINGS > Inactive MAC-addresses purge interval > Edit. This does not mean that the device will be removed from the Portnox Cloud account. It means that if the device has been inactive for the configured period, and it tries to authenticate again after that period using its MAC address, it will no longer be recognized. The process for the Inactive MAC-addresses purge function is as follows:
  • You add a MAC address to a MAB account – the day when you do this counts as day 1.
  • The day counter increases every day at midnight tenant-time,
  • Any time the device with the MAC address authenticates, the counter resets to 1.
  • The moment that the counter reaches the configured limit, the MAC address is removed from the MAB account.
  • The device with the MAC address is no longer in the MAB account so it cannot authenticate.

Connect the IoT device to the network managed by Portnox Cloud

  1. Configure the IoT device to connect to the network.

    Use the web interface or the access console of the IoT device to configure network access.

  2. Connect the IoT device to the network.

    If the IoT device asks for credentials to access the network, enter any credentials. First, your NAS will try to authenticate your IoT device using credentials, and if that fails, the NAS will check if it can authenticate the IoT device using its MAC address.

  3. Check the Devices page to make sure the connection is successful.
    1. In the Cloud portal top menu, click on the Devices option.
    2. In the displayed list of devices, find an entry representing the IoT device.

      You can optionally use the LAST CONNECTED filter to see devices that connected today or the NETWORK tab to see devices that are now connected.

    Result: The IoT device is connected to the network.

    • If agentless IoT device fingerprinting is on:

    • If agentless IoT device fingerprinting is off: