topic Re: SSID for only one device in Wireless

SSID for only one device

aleksa — Thu, 12 Dec 2019 01:40:46 GMT

Hi team,

I got a request, user on a site needs a Smart TV (android) connected to the Internet.

There was some problem, TV couldn't see intended SSID and I had to create a SSID just for that one.

Due to device capabilities, I've chosen the WPA2 authentication.

However, I'd like to lock this SSID to only this device.

With older solutions, I restricted access to SSID using MAC filters (or MAC access lists).

I'm not sure if that (or something better) is available?

Thanks!

Alex

Re: SSID for only one device

AjitKumar — Thu, 12 Dec 2019 02:27:20 GMT

Hi @aleksa

Fews ideas here.

1. Let us have a complex WPA2 Password and we do not share this

Or / Plus

2. Hidden SSID
Wireless > Configure > SSID availability
Visibility - Hide this SSID

Or / Plus

3. Deny Access to Network Services [Even if other devices gets through the above 2 will not have access to network]

Wireless > Firewall & traffic shaping
Layer 3 firewall rules
Deny Any Any

Network-wide > Clients
Select Android TV - Policy - Whitelisted

Re: SSID for only one device

Nolan Herring — Thu, 12 Dec 2019 02:39:23 GMT

TV sounds stationary so I would only broadcast that SSID on the closest access point, hide it if you want, but as long as only you know what the WPA2 PSK is then you should be good to go

Re: SSID for only one device

aleksa — Thu, 12 Dec 2019 02:59:23 GMT

Hi Ajit,
thanks, I did points 1 and 3 and it works well...

Re: SSID for only one device

aleksa — Thu, 12 Dec 2019 05:59:22 GMT

Hi Ajit,

actually, when I did point 3, it didn't work.

Whitilisting was fine, but the deny any any rule in SSID firewall, that killed all traffic.

Just so you know, it may not work as you expected...

Re: SSID for only one device

BrechtSchamp — Thu, 12 Dec 2019 07:15:29 GMT

Don't overthink it.

Hidden SSID with a nice PSK broadcasting on the APs near the tv. And then limit what that tv can do based on preference and desired security level. E.g. NAT mode ssid if you just want it to access the internet. In the regular vlan if you want casting features. In its own vlan if you want some more control and visibility. Suitable firewall rules to limit access to the rest of the network and the internet.

Some links to check out:

https://documentation.meraki.com/MR/Other_Topics/Using_Tags_to_Broadcast_SSIDs_from_Specific_APs

https://documentation.meraki.com/MR/Client_Addressing_and_Bridging/SSID_Modes_for_Client_IP_Assignment

https://documentation.meraki.com/MR/Firewall_and_Traffic_Shaping/Wireless_Client_Isolation

https://documentation.meraki.com/MR/Firewall_and_Traffic_Shaping/MR_Firewall_Rules