topic Cisco WLAN Question in Wireless

Cisco WLAN Question

zyang — Sun, 04 Jul 2021 05:04:15 GMT

We have a Cisco 4400 series WLAN controller.

When I go to the clients and view who is connected; I can also filter it.

However it only lets me filter by mac address, ap, wlan profile, etc.

It does not have IP filtering. Is there a way to filter using IP? Basically I want to find a particular client with a certain IP that's connected to our WLAN.

Also how do we block the client? If we deemed that person should not get access.

Thank you.

Cisco WLAN Question

grabonlee — Fri, 27 Apr 2012 17:11:43 GMT

It is not feasible to police IP address as the IPs will be assigned dynamically and keeping changing depending on lease time. You could create a separate SSID and tie it down by mac filter for important devices. A second SSID could be created and you apply an ACL to the WLAN restricting the assigned IP range to wherever destination you choose.

Cisco WLAN Question

George Stefanick — Fri, 27 Apr 2012 19:08:38 GMT

Zhi,

If you want adavnce flierting of your WLC you need WCS or NCS. This will allow you to shape your seaching efforts quick and easliy.

As for blocking a client. Pretty easy to do... You can do this in the CLI or GUI. I documeted this on my blog

http://www.my80211.com/cisco-wlc-cli-commands/2010/1/2/wlc-disable-wireless-client-client-exclusion.html

Cisco WLAN Question

grabonlee — Fri, 27 Apr 2012 19:59:14 GMT

George,

You are right but Zhi asked about blocking based on IP and there is no way to block a particular IP address because the client can always re-authenticate and get a new IP address. Your suggestion is based on Mac address after the client has authenticated. NCS helps as it includes a broader criteria to block a client for example using posture validation however that doesn't solve the IP issue. Unless his devices have static IPs, then he could block dhcp assignment.

Cisco WLAN Question

George Stefanick — Fri, 27 Apr 2012 20:14:57 GMT

Osita,

He wasnt clear if he wanted to block by IP. He asked how could he block a user. This can be handled if the user is tied to a device, then you can disable his mac on the WLC regardless of IP address.

Also there is no mention to what type of security is being used. This would play a role as to other options as well.

You could remove the user from the AD wireless group , if he is using EAP for example.

His question, leaves other open questions.

Re: Cisco WLAN Question

Stephen Rodriguez — Fri, 27 Apr 2012 20:15:03 GMT

What I would do is check the ARP table on the switch, take the Mac address from there and deny them access.

Steve

Sent from Cisco Technical Support iPhone App

Re: Cisco WLAN Question

zyang — Mon, 30 Apr 2012 14:35:04 GMT

Hi sorry for the late reply. There was probably a misunderstanding. I wanted to know when you go to monitor > Clients. It shows you all the clients connected. I wanted to know if it's possible to filter by ip. As it gives me only Mac filtering. Sorry if I was not being clear.

Thank you.

Sent from Cisco Technical Support iPhone App