How do we set up an ACL on a cisco AIR-CAP3702I-B-K9?

[victoriabardy]

Hello,

We need to set up a mac filtering access list to keep certain devices from roaming to another location that shares a wall and is using the same SSID.  Does anyone here on the forum know what commands we would use to accomplish this?  Are there Capwap specific commands involved?  Please let me know if you do.

Thank you.

Vicky

[Flavio Miranda]

Hi

 Basic example config:

configure terminal
access-list 701 deny 0811.967e.c384 0000.0000.0000
dot11 association mac-list 701
end

Considering of course IOS AP.  But, for capwap AP, which means joined in a WLC, then the config must be done on the WLC side.

 If you are using  Mobility Express, most probably, then the command on the Mobility Express WLC would be:

config macfilter add MAC_address wlan_id [interface_name] [description] [IP address]

For Mobility Express AP only I did not find similar command.

-If I helped you somehow, please, rate it as useful.-

[fjrusso76]

Flavio,

I have this same issue. I have setup the ACL on the WLC. However, where do I apply this ACL to an AP.

Thank you,

Frank

[Flavio Miranda]

It depends what you're trying to accomplish.

 Mac filter in a environment with wlc is applied on the WLAN and not on the AP.

 The only situation I remember you apply ACL directly on the AP when you have wlc is flexconnect ACL for guest SSID.

-If I helped you somehow, please, rate it as useful.-

[fjrusso76]

What I'm trying to accomplish is the following.



I have 2 stores with separate networks. However, the stores share a wall. Meaning the broadcast SSID can be seen from the AP in store # 1 and Store 2. Each store is using the same SSID as well.



So what I'm trying to do is have all the clients in store # 1 only connect to the AP in store # 1 and not the AP in store # 2.



What I wanted to do, was create an Deny ACL. So I would gather the MAC address from store # 1 and Deny them at the Store # 2 AP. Then I would apply the same on the other end as well.



Thank you,

[Flavio Miranda]

I have to say this is a bad design. With a different SSID and assuming you know all the possible Mac address that need to connect to store 1 and those can connect to store 2, which I believe is really difficult, then you could use Mac filter just to make sure someone from store 1 does not connect to store 2.

 But with the same SSID will be a mess.

 Client will try to connect and by receiving deny they will complain saying the network is not working. After all, they don't know which AP they must connect and they will not have option.

-If I helped you somehow, please, rate it as useful.-