topic Re: Limit devices on wifi in Wireless

Limit devices on wifi

Kn1ghtR1d3rOfD00m — Thu, 23 Apr 2020 21:25:58 GMT

hi Meraki warriors,

I would like to know if there is any way to limit an SSID to allow only 2 devices only, perhaps not manually, something similar to ISE

but in essence, lets say I have one user in our Corp SSID, but that use can use as many devices he can have and there is no limitation,

We have ISE but the current version is obsolete and it does not have that feature, we tried via certificates but when it came the Chromebook world to play, the previous guy in charge override in some way that, to bypass the certs and now any user with any PC not being in the domain can join the corp as long as they have the right credentials for sure,

So Im looking a solution that will enable me to limit the devices per user, now that we are not using ISE

any ideas?

Re: Limit devices on wifi

Philip D'Ath — Thu, 23 Apr 2020 22:51:28 GMT

Configure the SSID to use WPA2-Enterprise mode and Meraki Authentication. Create accounts for just the two users and authorise them for the SSID.

https://documentation.meraki.com/MR/Encryption_and_Authentication/Configuring__WPA2-Enterprise_with_Meraki_Authentication

Re: Limit devices on wifi

Kn1ghtR1d3rOfD00m — Fri, 24 Apr 2020 02:07:48 GMT

interesting, thanks so much, that does the temporal trick for now in a testing deployment environment,

I will investigate further since we want to deploy for more than 10K+ users but as I mentioned, our ISE is very old that does not do that anymore,

Re: Limit devices on wifi

Philip D'Ath — Fri, 24 Apr 2020 02:50:44 GMT

Check out FreeRadius.

https://freeradius.org/

Microsoft NPS (part of Windows Server) is very popular as well. Nowhere near as sophisticated as Cisco ISE, but the price is good.

Re: Limit devices on wifi

drazhargraig — Fri, 24 Apr 2020 08:57:39 GMT

If you are replacing or retiring ISE, then RADIUS of some sort is going to be your best bet.

Map out a few more requirements however, that might help you in choosing your RADIUS provider. Are you looking to offer any MFA on your services (VPN for example?). We have had some issues with VPN MFA and Microsoft NPS, the claim not going the entire way through. Solution ended up being Cisco Duo as the MFA.

Re: Limit devices on wifi

BrechtSchamp — Fri, 24 Apr 2020 12:13:11 GMT

Yeah with the built-in functionality you can't limit the number of simultaneous logins with an account. It's either "unlimited" or one.

For that you'd need an external RADIUS server.

Re: Limit devices on wifi

Kn1ghtR1d3rOfD00m — Fri, 24 Apr 2020 14:11:54 GMT

thank you,

well, yes, we wanted to see to get rid off ISE and explore a stylish Meraki solution but seems like @BrechSchamp mentioned, we have to use strictly a radius in some way,

The DUO looks like a solution but still I guess as long as you enter a valid credentials, it will let you in as many devices you have in hand

we wanted to see a similar way to restrict devices per user like ISE does ( thats my understanding of the ISE 2.2)

the problem is like if a user has a BYOD, it can bypass the certs or even a chromebook from the enterprise which is not added to the domain,

Im gonna check and keep investigating further cause having ISE is ... otherwise, we will have no choice and rather upgrade our ISE and explore that feature,

super thanks everyone

Re: Limit devices on wifi

SoCalRacer — Fri, 24 Apr 2020 14:45:12 GMT

You may look into JumpCloud also

Re: Limit devices on wifi

Philip D'Ath — Fri, 24 Apr 2020 17:31:32 GMT

Check out Meraki Trusted Access.

https://documentation.meraki.com/zGeneral_Administration/Cross-Platform_Content/Trusted_Access_for_Secure_Wireless_Connectivity