Can Passbeam authenticate devices by MAC address (MAB)?

Yes, for devices you register. Some equipment, like TVs, AV receivers and older printers, can't do 802.1X. Add them under MAC devices on the client, one at a time or from a CSV file. Passbeam accepts a registered MAC address and puts the device on its class's VLAN. A private, randomised MAC address can't be registered.

A MAC address is easy to copy, so anyone can pretend to be a registered device. That's why a MAC device is only ever put on an isolated VLAN. Each class, such as TVs or IoT, has its own VLAN at each site, and if there isn't one the device is refused. It's never put on the staff network.

If the device supports 802.1X, use a certificate instead. More equipment can than people expect, so look for 802.1X in its web page. See “How do I set up printers, CCTV, BMS and IoT devices that support 802.1X?”.

A MAC address that isn't registered is refused. That's what sends an un-enrolled laptop on a meeting room port to the switch's Fallback VLAN, so it gets guest access instead of nothing. See “How do I make a switch port default to Guest, but put authenticated devices on the staff VLAN?”.

We've tested MAC devices on UniFi switch ports. A MAC device costs the same as a guest login. See “What does it cost?”.