topic Re: C9800 MAC Filtering on Particular APs in Wireless

C9800 MAC Filtering on Particular APs

Sanju_13 — Tue, 17 Mar 2026 15:03:43 GMT

Hi Everyone,

We have 5 access points deployed on each of Floor A and Floor B. The requirement is to block a specific client MAC address on Floor A, while allowing the same client to connect normally on Floor B.

The WLAN is centrally switched using a Cisco 9800 WLC. I would like to understand whether this use case is feasible using the internal AAA server on the controller. (Don't have any External Radius Server)

If anyone has implemented a similar setup or can share insights on the best approach.

Thanks in advance.

Re: C9800 MAC Filtering on Particular APs

Flavio Miranda — Tue, 17 Mar 2026 17:05:44 GMT

@Sanju_13

There is one attribute you could test which is vlan

mab request format attribute {1 groupsize size separator separator [lowercase | uppercase] | 2 {0 | 7 | LINE} LINE password | 32 vlan access-vlan}

However, if your intention is control client roaming between floor, which is an odd problem we often see in multifloor offices, this is not going to work.

Re: C9800 MAC Filtering on Particular APs

Sasquatch_13 — Tue, 17 Mar 2026 17:15:20 GMT

@Flavio Miranda
Thanks for your reply.
Our Goal is to block user on 'Floor A' APs only, is it feasible with central switching ?

Re: C9800 MAC Filtering on Particular APs

Flavio Miranda — Wed, 18 Mar 2026 18:44:16 GMT

I dont believe this is possible, honestly. If you are using only one SSID, you can not prevent the client to connect to the SSID. That´s why the VLAN parameter called my attention. Possibly that could be a shot.

But, client will try to raom from floor A to B anyway

Re: C9800 MAC Filtering on Particular APs

Scott Fella — Wed, 18 Mar 2026 14:49:21 GMT

I have to agree with @Flavio Miranda. Even if you were to get this working (you can with ISE as an example), you would break roaming and cause client experience issues. Why not just have separate SSID's, and that way you can control seperation better and maybe without having to use any mac filters. Always keep in mind the client experience before trying to implement solutions in which users will end up complaining and then you will have to figure out a new solution.

Re: C9800 MAC Filtering on Particular APs

Leo Laohoo — Wed, 18 Mar 2026 20:43:22 GMT

@Sanju_13 wrote:
We have 5 access points deployed on each of Floor A and Floor B. The requirement is to block a specific client MAC address on Floor A, while allowing the same client to connect normally on Floor B.

This runs counter to what WiFi "roaming" is.

Blocking MAC address is "old technology". And what happens if the owner of this clients gets "smart" and enables "random MAC address"?

If this is Windows, Apple OS (maybe Linux too), it can be scripted for a wireless client to join a specific MBSSID (provided the AP does not get replaced).

Re: C9800 MAC Filtering on Particular APs

Sasquatch_13 — Thu, 19 Mar 2026 14:33:14 GMT

Thanks everyone
We have plan to test this weekend with Duplicate SSID and Different Policy Tag on Floor A APs, I think this will work according to the requirement.

Re: C9800 MAC Filtering on Particular APs

Karsten Iwen — Thu, 19 Mar 2026 15:08:30 GMT

Speaking about requirements. What do you want to achieve eventually? What is the reasoning behind that? Perhaps the solution is something other/better than "blocking a client on floor A".

Re: C9800 MAC Filtering on Particular APs

Sasquatch_13 — Thu, 19 Mar 2026 15:23:36 GMT

Hi @Karsten Iwen ,

We have a slightly unusual requirement for a VIP user.

The user primarily sits on Floor A and uses a dedicated Wi-Fi network on his Corp Device for Trading. He also occasionally uses the Board Room on Floor B.

The requirement is:

When the user is on Floor A, his device should not automatically connect to the corporate Wi-Fi.
However, when he moves to the Board Room on Floor B, he should be able to connect to the same corporate Wi-Fi without any issue.

Looking for suggestions on how this behavior can be achieved, or if there are any recommended design approaches or workarounds.

Re: C9800 MAC Filtering on Particular APs

Karsten Iwen — Thu, 19 Mar 2026 16:46:45 GMT

Not quite a VIP if you treat him that way. 🤣 Use the right directional antennas so that there is no reception on floor A. Otherwise, this needs some more thinking ...

Re: C9800 MAC Filtering on Particular APs

Leo Laohoo — Thu, 19 Mar 2026 20:30:41 GMT

@Sasquatch_13 wrote:

When the user is on Floor A, his device should not automatically connect to the corporate Wi-Fi.

However, when he moves to the Board Room on Floor B, he should be able to connect to the same corporate Wi-Fi without any issue.

This is a "roaming" issue with the user's wireless client. If this wireless client is a Windows laptop, post the complete output to the command "netsh wlan show drivers".

I am going to suspect the wireless NIC driver has never been updated.

Re: C9800 MAC Filtering on Particular APs

pieterh — Sat, 21 Mar 2026 11:13:52 GMT

The requirement is:

When the user is on Floor A, his device should not automatically connect to the corporate Wi-Fi.
However, when he moves to the Board Room on Floor B, he should be able to connect to the same corporate Wi-Fi without any issue.

this is just setting "do not connect automatically" for the corporate WLAN setting in the client configuration, not the wireless network

Re: C9800 MAC Filtering on Particular APs

Rich R — Sun, 22 Mar 2026 15:15:42 GMT

> We have plan to test this weekend with Duplicate SSID and Different Policy Tag on Floor A APs,
Duplicate SSID will not solve the problem. The client will still try to roam.
2 different SSIDs with auto-join on for one but not the other (on the client) might do it though.

Re: C9800 MAC Filtering on Particular APs

pieterh — Sun, 22 Mar 2026 19:38:15 GMT

that is exacly my point
The user primarily sits on Floor A and uses a dedicated Wi-Fi network on his Corp Device for Trading.
-> create an SSID TRADING

He also occasionally uses the Board Room on Floor B usin the corporate Wi-Fi.
-> create an SSID CORP and configure the WLAN on the client to only connect when manually selected

In the Settings app on your Windows device,
select Network & internet > Properties , then, next to Wi-Fi network password, select Show.
disable "connect automatically when in range"