topic Devices can connect to two different SSIDs using the same MAC address in Wireless

Devices can connect to two different SSIDs using the same MAC address

RexRostro — Mon, 24 Apr 2023 07:35:24 GMT

Hi all,

I have a problem: I configured two Wi-Fi SSIDs on a pair of 9800-L controllers, with MAC filtering, one also with password and the other without, but whenever I add a MAC address for a specific SSID, that device can also connect to the other SSID.

In the AAA Method List > Authorization section I created two lists, one for each WLAN, which I then associated respectively with the two SSIDs

In the AAA Advanced > Attribute List Name section I have created two lists, one for each SSID, which I promptly associate with the MAC addresses I add

Also every time I add a MAC address I also associate the WLAN profile I created, but it doesn't seem to work properly, because that MAC address can still connect to both SSIDs.

I would like whenever I add a MAC address for a specific SSID that it only connects to the designated one and not the other as well.

This is the simplified configuration:
SSID A: Password + MAC filtering + SSID A Authorization List
SSID B: MAC filtering + SSID B Authorization List

I hope someone can help me.

Thank you

Re: Devices can connect to two different SSIDs using the same MAC addr

Mark Elsen — Mon, 24 Apr 2023 08:53:21 GMT

- For starters have a checkup-review of your 9800 controllers current configuration with the CLI command : show tech wireless , have the output analyzed with : https://cway.cisco.com/wireless-config-analyzer
Checkout all advisories!

Re: Devices can connect to two different SSIDs using the same MAC addr

Rich R — Mon, 24 Apr 2023 22:29:48 GMT

What version of software are you running?
Refer to TAC recommended versions below.

Nevertheless I remembered we had an almost identical question before and I think this was it:
https://community.cisco.com/t5/wireless/c9800-mac-filtering/td-p/4494040
Did you configure aaa-override as per the guide?
There are also some other tips there.