topic Block mac-address in SSID in Wireless

Block mac-address in SSID

enedinocastillo — Sat, 02 Mar 2019 17:46:57 GMT

Hello! I need to block one device on my Wireless Lan. I mean, I need this device not connect to my SSID. Can I do this? Can I to block the mac-address of this device? Thank you!

Re: Block mac-address in SSID

BrechtSchamp — Sat, 02 Mar 2019 17:57:13 GMT

Yes, go to the clients list (Network-Wide > Clients), find the device and click on it. The scroll down and change the policy. Set the access to your ssid to blocked.

Mind you that there's a limit to the number of clients which you can block this way (3000).

If the client has not yet connected to the network you can also do it on beforehand from the clients list.

Re: Block mac-address in SSID

enedinocastillo — Mon, 04 Mar 2019 15:49:51 GMT

Sorry! I forgot say Thank you! Just today I tried this configuration in the office and it worked perfectly. Thank you!

Re: Block mac-address in SSID

BrechtSchamp — Mon, 04 Mar 2019 16:06:03 GMT

Good to hear. Thanks for the thanks.

Re: Block mac-address in SSID

Nembrey3 — Thu, 02 May 2019 17:29:06 GMT

Works great until they start spoofing their MAC address

Re: Block mac-address in SSID

sametkirpat — Wed, 22 Jun 2022 11:38:32 GMT

Can we do this by using API?

Re: Block mac-address in SSID

jjpathan1 — Wed, 11 Jan 2023 17:37:41 GMT

I am actually looking for any possible solution to this. Currently running into this exact problem, the solution is useless once they start spoofing the mac address of the IPhone.

Re: Block mac-address in SSID

BRUCE NEWTON — Wed, 11 Jan 2023 20:14:33 GMT

Yep, with the randomised MAC addresses that are used by virtually every OS now, this is hard to implement. You have to flip it on its head and ensure you are only permitting the devices you want to access your network, and block everything else.

Re: Block mac-address in SSID

AnthonyP2 — Fri, 27 Jan 2023 10:59:21 GMT

Apple Devices use the following:

x2:xx:xx:xx:xx:xx
x6:xx:xx:xx:xx:xx
xA:xx:xx:xx:xx:xx
xE:xx:xx:xx:xx:xx

Anyway to block these specifically?

Re: Block mac-address in SSID

ErikaW — Thu, 28 Sep 2023 20:46:43 GMT

Is that block limit of 3000 per network, per organization, or something else?

Re: Block mac-address in SSID

DainBrammage — Thu, 28 Sep 2023 21:47:54 GMT

DUDE thats not specific to apple devices. Those second charcters A, E, 2 or 6 indicates an LAMAC, locally administered MAC..

ANYONE can use those Windows Apples, Androids Linux.. wired or wireless makes no difference

Re: Block mac-address in SSID

AnthonyP2 — Fri, 29 Sep 2023 06:22:02 GMT

Thanks for the 2 cents. That doesn’t actually provide a useful solution however

Re: Block mac-address in SSID

danjns — Fri, 29 Sep 2023 06:35:19 GMT

MAC filtering is not an effective solution. My question would be why do you want to block this device?

Re: Block mac-address in SSID

DainBrammage — Fri, 29 Sep 2023 16:53:08 GMT

Your solution is RADIUS EAP-TLS or RADIUS anything would be a good start You will need group policies via Intune to stop windows clients from using LMACS not sure if JAMF allows for this or not for your macs. Also you will want some sort of MDM solution for mobile devices anything else will be highly manual and inherently insecure. If your guest network lock it down with an appropriate solution

Whatever MAC filter you set can be bypassed by anyone with access to Google and a few keystrokes...

If your issue is you are running low on IP space because of LMACS increase DHCP pool size and decrease lease time. That is at least 2000 cents worth. by my count you now owe me $20.02.

Re: Block mac-address in SSID

jas1066uk — Sat, 07 Oct 2023 09:55:34 GMT

Hi Bruce/all,

Just seen this post.. this is exactly what I am trying but reverse of this post.

Please could I have some guidance.

Looking have a SSID that is open but blocked but default and I allow specific Macs addresses through. I see the client add them to policy group. But where do I add the default block?? Firewall settings?? Client add bypasses the firewall rules.. which means to can get onto my local network??

Any help appreciated

Jas

Re: Block mac-address in SSID

Charles Powell — Fri, 16 Feb 2024 18:43:00 GMT

I believe the proper way to do this would be to put a splash page login on the SSID, and give your allowed clients a policy that allows them to bypass the splash page.