topic Re: MAC Randomization using IOS14 and Android 10 and above in Wireless

MAC Randomization using IOS14 and Android 10 and above

MacKake — Mon, 21 Sep 2020 16:14:34 GMT

I've been through some issues when these updates were massively deployed such as:

1. Group Policies not being applied as they should and all clients fall into Normal policy with new IP-MA address combination

2. Exhausted DHCP

3. Duplicated IP Address Alerts

I've done the following:

1. DCHP to last at most 1 day instead of 1 week,

2. Advise my users with this OS to turn off privacy settings for the corporate SSID

Apple IOS14: https://support.apple.com/en-us/HT211227

Android 10:

Wi-Fi settings

Open the Settings app.
Tap Network & Internet.
Tap Wi-Fi.
Tap the gear icon associated with the wireless connection to be configured.
Tap Advanced.
Tap Privacy.
Tap Use device MAC

But I wonder if I can use something in Systems Manager to prevent MAC Randomization or what is the best option for preventing this.

Re: MAC Randomization using IOS14 and Android 10 and above

kYutobi — Mon, 21 Sep 2020 18:06:17 GMT

Thanks @MacKake for publishing. Not many people have had a "forced" update to start using randomized MAC addresses but do you think that will soon start to affect things when all updates are pushed?

Re: MAC Randomization using IOS14 and Android 10 and above

Philip D'Ath — Mon, 21 Sep 2020 19:02:58 GMT

There isn't a good solution at the moment.

Larger customers can use group policy assignment via RADIUS, but there is no simple solution for static assignment of group policies.

Re: MAC Randomization using IOS14 and Android 10 and above

BlakeRichardson — Mon, 21 Sep 2020 23:01:51 GMT

This is just the next step in the privacy vs practicality debate..

Thanks for sharing @MacKake

Re: MAC Randomization using IOS14 and Android 10 and above

MacKake — Tue, 22 Sep 2020 03:14:31 GMT

Thanks @PhillipDAth Actually this happened to a huge Mall that can host 32000 daily guests with different networks to manage them all but with this randomization every time the devices are re-joined to the paid network, they lose the access, so the only way to make this work is to ask the user to turn off privacy settings...

BTW I've also found that Meraki Systems Manager can help with this but only for BYOD or Owned Devices: in a brand new Meraki Minute video: https://youtu.be/Bj9Gg7h50Gk