Block Client on specific wlan

[andrey.trushchelev]

Good day. I have vWLC on 38-50 IOS XE, 2 APs 27xx, 2 wlans ( Work and Guest)

I need some clients can associate with one of this wlan (Work ) and deny on the other (Guest) .

Authentication with PSK, Sure I can 'forget Guest network' on all of this device, but I need to make it centralized from controller. One more time "if you have an access to Work - you can't connect to Guest, even if you know password"

Exclusion list one for all WLAN. So how can I do it ?

[Flavio Miranda]

Hi 

 Mac filter could help but on the Corp SSID. For guest is complicated because you may not have control over devices.

 A very good solution is BYOD tool like ISE, but it comes with a price.

-If I helped you somehow, please, rate it as useful.-

[andrey.trushchelev]

Hi
Yes that's the point. Mac filter do not help me. It would be great if I can filter specific MAC on specific WLAN.
I know about ISE and I will implement it in this year, I hope. But I thought there is another decision to my problem.
Anyway thanks.

[Leo Laohoo]

---

@andrey.trushchelev wrote:
I need some clients can associate with one of this wlan (Work ) and deny on the other (Guest) . 

---

I agree with Flavio.  ISE is suited for this (but extremely expensive).  

The cheapest method is MS Group Policy.  With our SOE wireless clients, corp SSID takes precedence.  If the corp SSID is visible, then the laptop is denied the ability to join the guest SSID.

[andrey.trushchelev]

HI

Do you mean Microsoft Group Policy ? We use windows/MacOS/Ubuntu

What is SOE ?

[andrey.trushchelev · Accepted solution]

I've found the answer.

All is the simple

 mac address-table static x:x:x:x:x:x vlan Y drop

So SW will drop any packet from this host in specific wlan. Host could not even connect to WLAN in this vlan.

[Flavio Miranda]

That's smart. Thanks for sharing!