topic Re: Block Client on specific wlan in Wireless

Block Client on specific wlan

andrey.trushchelev — Mon, 05 Jul 2021 15:16:40 GMT

Good day. I have vWLC on 38-50 IOS XE, 2 APs 27xx, 2 wlans ( Work and Guest)

I need some clients can associate with one of this wlan (Work ) and deny on the other (Guest) .

Authentication with PSK, Sure I can 'forget Guest network' on all of this device, but I need to make it centralized from controller. One more time "if you have an access to Work - you can't connect to Guest, even if you know password"

Exclusion list one for all WLAN. So how can I do it ?

Re: Block Client on specific wlan

Flavio Miranda — Tue, 20 Feb 2018 16:10:16 GMT

Mac filter could help but on the Corp SSID. For guest is complicated because you may not have control over devices.

A very good solution is BYOD tool like ISE, but it comes with a price.

-If I helped you somehow, please, rate it as useful.-

Re: Block Client on specific wlan

Leo Laohoo — Wed, 21 Feb 2018 03:50:31 GMT

@andrey.trushchelev wrote:

I need some clients can associate with one of this wlan (Work ) and deny on the other (Guest) .

I agree with Flavio. ISE is suited for this (but extremely expensive).

The cheapest method is MS Group Policy. With our SOE wireless clients, corp SSID takes precedence. If the corp SSID is visible, then the laptop is denied the ability to join the guest SSID.

Re: Block Client on specific wlan

andrey.trushchelev — Wed, 21 Feb 2018 09:03:41 GMT

Hi
Yes that's the point. Mac filter do not help me. It would be great if I can filter specific MAC on specific WLAN.
I know about ISE and I will implement it in this year, I hope. But I thought there is another decision to my problem.
Anyway thanks.

Re: Block Client on specific wlan

andrey.trushchelev — Wed, 21 Feb 2018 09:05:51 GMT

Do you mean Microsoft Group Policy ? We use windows/MacOS/Ubuntu

What is SOE ?

Re: Block Client on specific wlan

andrey.trushchelev — Tue, 06 Mar 2018 08:56:40 GMT

I've found the answer.

All is the simple

mac address-table static x:x:x:x:x:x vlan Y drop

So SW will drop any packet from this host in specific wlan. Host could not even connect to WLAN in this vlan.

Re: Block Client on specific wlan

Flavio Miranda — Tue, 06 Mar 2018 10:27:37 GMT

That's smart. Thanks for sharing!