topic Re: Restrict access by mac address in SSID (all clients blocked by default until explicitly allowed) in Wireless

Restrict access by mac address in SSID (all clients blocked by default until explicitly allowed)

jperez netics — Wed, 29 May 2024 20:46:17 GMT

as far as i know, if an endpoint connect to the wireless network, i can then restrict the access using device policy and choosing normal, block or allow

what the customer wants is exactly that function but backwards, i mean, if we can set device policy on block by default for any new users and manually put them in allow or normal, is this possible?

i tried to do that but i think that i'm missing something or it can't be done the way they want

Re: Restrict access by mac address in SSID (all clients blocked by default until explicitly allowed)

aleabrahao — Wed, 29 May 2024 20:53:28 GMT

Not directly on the SSID, you would need a Radius server to restrict it this way.

https://documentation.meraki.com/MR/Encryption_and_Authentication/Enabling_MAC-based_access_control_on_an_SSID

https://documentation.meraki.com/MR/Encryption_and_Authentication/MAC-Based_Access_Control_Using_Microsoft_NPS_-_MR_Access_Points

Re: Restrict access by mac address in SSID (all clients blocked by default until explicitly allowed)

Brash — Thu, 30 May 2024 00:43:29 GMT

An option that might work...
- Create a VLAN and assign a group policy to it that denies all traffic. Set this VLAN on the SSID.

- Once the device has connected, manually change the group policy of that device to one which allows network traffic.

Re: Restrict access by mac address in SSID (all clients blocked by default until explicitly allowed)

IvanJukic — Thu, 30 May 2024 00:45:03 GMT

Hi @jperez netics,

What about Layer 2/3 LAN isolation? Client that connect to a "blocked SSID", can be denied (except, DNS and DHCP, which you can controll anyway) to local netwoks.

'Deny Local LAN' settings in Cisco Meraki MR firewall

https://documentation.meraki.com/MR/Firewall_and_Traffic_Shaping/'Deny_Local_LAN'_settings_in_Cisco_Meraki_MR_firewall

Re: Restrict access by mac address in SSID (all clients blocked by default until explicitly allowed)

christy2951hernandez — Fri, 31 May 2024 06:38:00 GMT

You're right, most traditional Wi-Fi access points (APs) don't offer the functionality of blocking by default and allowing by exception for MAC addresses within an SSID (Service Set Identifier). However, there are alternative approaches to achieve a similar outcome. ny state of health
MAC Filtering with Open Network (Least Secure) This method involves creating an open Wi-Fi network (no password) and restricting access only to authorized MAC addresses through the router/access point's settings.
This approach is not recommended for secure environments as anyone can connect and potentially see network traffic if they have the authorized device's MAC address.