It is suggested to use an IP handle Every time possible. MAC session employs network broadcasts and isn't 100% trustworthy.Besides The reality that the firewall shields your router from unauthorized access from outer networks, it can be done to restrict username accessibility for the specific IP tackle/user aaa established use-radius=no *Observe