Randomized and Altering MAC (RCM)

What’s Randomized & Altering MAC (RCM)

Traditionally wi-fi shoppers affiliate to the wi-fi community utilizing the producer assigned mac handle that’s related to the wi-fi community interface card (NIC). This manufacturer-assigned mac handle, which is globally distinctive, is also referred to as burn-in handle (BIA). Use of this burn-in handle in every single place raises the query of end-user privateness because the end-user might be tracked with WIFI’s mac handle. On this doc, this shall be known as regular mac (handle), in distinction to the random mac (handle).

To enhance end-user privateness, numerous working system distributors (Apple iOS 14, Android 10 and Home windows 10) are enabling the usage of the domestically administered mac handle (LAA), additionally known as the random mac handle for WIFI operation. When wi-fi endpoint is related to random mac handle, the MAC handle of the endpoint adjustments over time.

The random mac handle was restricted to probe for identified wi-fi networks. That is now expanded to affiliation to the wi-fi networks. Whereas this works nicely for the privateness of the end-user, it brings distinctive challenges to the Enterprise IT admin, who has been relying to date on the distinctive endpoint id as the premise for driving insurance policies. This may also have an effect on totally different WIFI deployment fashions e.g., Visitor, BYOD (Carry Your Personal Gadget) and placement analytics, and so on. which depend on the distinctiveness of the mac handle.

To deal with and alleviate the problems because of the utilization of random MAC addresses within the present wi-fi deployments, Cisco supplies an RCM answer.

Random Mac Identification and Shopper entry

Cisco answer Identifies the random mac utilization and supplies visibility for straightforward detection of points and troubleshooting on WLC and Cisco DNA Middle.

Cisco Catalyst 9800 can classify the machine on the community utilizing its Universally administered handle (BIA) or Regionally administered handle (RCM) which helps directors to tell apart between each mac addresses. Random MAC handle is recognized by a bit which will get set within the OUI portion of a MAC handle to suggest a domestically administered handle. The beneath image depicts establish the domestically administered mac handle.

As well as, Cisco 9800 wi-fi controller additionally supplies the power to manage the shopper becoming a member of WIFI Community utilizing RCM handle. That is enabled via a configuration choice to permit/deny RCM shoppers. When this configuration is enabled, then any shopper utilizing the randomized altering MAC RCM (Regionally administered MAC handle) will be unable to hitch that wi-fi community.

MDM (Cell Gadget Supervisor)/ISE BYOD Integrations:

MDM answer supplies a novel machine id when the mac handle of the machine is randomized and altering. When the endpoint connects to the community utilizing randomized MAC handle, MDM compliance examine and different safety controls fail due to unrecognized random MAC addresses as machine identifiers. This answer supplies a novel id to the machine based mostly on EAP-TLS which is named DUID (Gadget Distinctive ID) answer.

• This answer depends on the MDM (Cell machine supervisor additionally known as Gadget managers, Unified Endpoint Managers (for instance Ms Intune, Cell Iron) which handle gadgets in an enterprise infrastructure.
• ISE supplies the provisioning of the machine with the machine’s distinctive ID-based (DUID) certificates.
• The machine presents this certificates throughout TLS based mostly authentication ISE authorizes the gadgets and in addition reads the distinctive ID from the certificates.
• The machine distinctive ID (DUID) is used for compliance examine with MDM servers and in addition a novel identifier of the machine within the endpoint desk.
• The randomized MAC won’t matter as now the machine has a DUID utilizing the ID within the cert.
• Since ISE has the mapping of the DUID and the random MAC and it could possibly share this info in two methods
  • By way of pxGrid as a part of session info the place Cisco DNA Middle is the pxGrid subscriber.
  • WLC will get the shopper data from ISE as a part of VSA access-accept, this data is shipped to the Cisco DNA Middle.

The identical use case might be carried out via ISE as a part of BYOD workflow as ISE can generate DUID in the course of the BYOD course of.

DNA Middle visibility, Troubleshooting, Utilization monitoring for RCM

Utilizing Cisco DNA Middle, we can monitor, troubleshoot and see the place the random macs are getting used within the community. For the gadgets utilizing random mac addresses, Cisco DNA Middle has launched a brand new icon in entrance of the machine MAC handle to represent RCM. Cisco DNA Middle customers can filter the gadgets with mac handle as an RCM handle for the IT admin to trace what number of shoppers are RCM shoppers within the community.

Beneath Cisco DNA Middle display exhibits the filtered RCM Shoppers for visibility, monitoring, and troubleshooting.

Customers can see the visibility of the shopper DUID and random MAC and in addition which one other mac handle is said on Cisco DNA Middle as proven within the beneath in Cisco DNA Middle Shopper 360 web page.

Cisco DNA Middle additionally exhibits if shoppers should not associating to the community as a result of Random MAC is configured to not be a part of the community. Beneath shopper display exhibits that.

Way forward for Random MAC Answer

Cisco will pursue with IETF to have a proper working group for MAC handle machine identification for Community and Utility Companies.

Be taught extra by visiting the 

Randomized and Altering MAC Deployment Information

In collaboration with: Sarath Gorthi Subrahmanya, Engineering Product Supervisor.

Share: