topic Re: Block smartphones from corporate wireless access in Wireless

Block smartphones from corporate wireless access

Sami Abunasser — Sun, 04 Jul 2021 03:58:19 GMT

Hi,

Currently we are running Cisco wireless AP's in an LWAPP setting with Cisco WISM. Wireless authentication for network access is linked to our Active Directory.

What we are noticing is that a large number of users are connecting to the wireless using thier smartphones (iphones, driods and blackberry's). Does anyone know of a way to block these devices from connecting to the wireless without changing how laptop users connect?

Thank you,

Sami

Block smartphones from corporate wireless access

Stephen Rodriguez — Fri, 21 Oct 2011 13:36:40 GMT

Sami,

I would say, take a look at Cisco ISE. The ISE is able to 'fingerprint' a device to identify what it is, then allow or disallow access according to the rules that you configure.

HTH,

Steve

----------------------------------------------------------------------------------------------------------

Please remember to rate helpful posts or to mark the question as answered so that it can be found later.

Block smartphones from corporate wireless access

Leo Laohoo — Sat, 22 Oct 2011 00:53:41 GMT

What we are noticing is that a large number of users are connecting to the wireless using thier smartphones (iphones, driods and blackberry's). Does anyone know of a way to block these devices from connecting to the wireless without changing how laptop users connect?

The answer to this question is found in the second sentence of your post: Wireless authentication for network access is linked to our Active Directory.

Block smartphones from corporate wireless access

Johan Lindstrand — Wed, 26 Oct 2011 14:20:32 GMT

Hi.

If you are using a DHCP server in the wireless environment. Then you can block “smart phones” MAC-address from getting ipadress ,or you can block on “Vendor Name”

This solution is not the most “beautiful” one but it works.

Re: Block smartphones from corporate wireless access

Stephen Rodriguez — Wed, 26 Oct 2011 14:24:31 GMT

but that would also block Apple laptops as well wouldn't it?

Sent from Cisco Technical Support iPhone App

Re: Block smartphones from corporate wireless access

Johan Lindstrand — Wed, 26 Oct 2011 14:46:19 GMT

Yes on Vendor ID it block Apple laptops, but you can block an specific Apple "MAC-adress" series. yost for Iphones

shared-network VLAN915 {

class "phones" {

match substring(hardware,1,3);

}

subclass "phones" 34:15:9e;

subclass "phones" 30:78:22;

subnet 10.10.1.0 netmask 255.255.255.0 {

pool {

deny members of "phones" ;

shared-network VLAN915 {
class "phones" {
        match substring(hardware,1,3);
}
        subclass "phones" 34:15:9e;
        subclass "phones" 30:78:22;

...

subnet 10.10.1.0 netmask 255.255.255.0 {
pool {
deny members of "phones" ;

Re: Block smartphones from corporate wireless access

Sami Abunasser — Wed, 26 Oct 2011 15:16:09 GMT

Guys,

Thank you for your input. I seem to have poorly explained the problem here. The last solution, blocking in DHCP based on Vendor MAC, seems to be what I'm looking for.

The main problem we are experiencing this with, is the Guest access. Users with thier wifi turned on on thier phones, will automatically tunnel through to DHCP over the Guest SSID, and pick up an IP, but then not do anything (proceed to the authentication page) because they aren't trying to connect it's just the phones doing it.

We currently are using infoblox for serving DHCP IP's, and the wireless network has it's own DHCP range that's served to all wireless users (guest and other ssid's).

I looked at the configurations in infoblox and didn't really see where I can do that, but I'm sure there's a way, so I'm going to reach out to infoblox and see if their support can assist.

Thank you all for your responses,

Sam