Block smartphones from corporate wireless access

[Sami Abunasser]

Hi,

Currently we are running Cisco wireless AP's in an LWAPP setting with Cisco WISM. Wireless authentication for network access is linked to our Active Directory.

What we are noticing is that a large number of users are connecting to the wireless using thier smartphones (iphones, driods and blackberry's). Does anyone know of a way to block these devices from connecting to the wireless without changing how laptop users connect?

Thank you,

Sami

[Stephen Rodriguez]

Sami,

     I would say, take a look at Cisco ISE.  The ISE is able to 'fingerprint' a device to identify what it is, then allow or disallow access according to the rules that you configure.

HTH,

Steve

----------------------------------------------------------------------------------------------------------

Please remember to rate helpful posts or to mark the question as answered so that it can be found later.

[Leo Laohoo]

What we are noticing is that a large number of users are connecting to the wireless using thier smartphones (iphones, driods and blackberry's). Does anyone know of a way to block these devices from connecting to the wireless without changing how laptop users connect?

The answer to this question is found in the second sentence of your post:  Wireless authentication for network access is linked to our Active Directory.

[Johan Lindstrand]

Hi.

If you are using a DHCP server in the wireless environment. Then you can block “smart phones” MAC-address from getting ipadress ,or you can block on “Vendor Name”

This solution is not the most “beautiful” one but it works.

[Stephen Rodriguez]

but that would also block Apple laptops as well wouldn't it?

Sent from Cisco Technical Support iPhone App

[Johan Lindstrand · Accepted solution]

Hi

Yes on Vendor ID it block Apple laptops, but you can block an specific Apple "MAC-adress" series. yost for Iphones

shared-network VLAN915 {

class "phones" {

        match substring(hardware,1,3);

}

        subclass "phones" 34:15:9e;

        subclass "phones" 30:78:22;

subnet 10.10.1.0 netmask 255.255.255.0 {

                pool {

                        deny members of "phones" ;

shared-network VLAN915 {
class "phones" {
        match substring(hardware,1,3);
}
        subclass "phones" 34:15:9e;
        subclass "phones" 30:78:22;

...

subnet 10.10.1.0 netmask 255.255.255.0 {
                pool {
                        deny members of "phones" ;

[Sami Abunasser]

Guys,

Thank you for your input. I seem to have poorly explained the problem here. The last solution, blocking in DHCP based on Vendor MAC, seems to be what I'm looking for.

The main problem we are experiencing this with, is the Guest access. Users with thier wifi turned on on thier phones, will automatically tunnel through to DHCP over the Guest SSID, and pick up an IP, but then not do anything (proceed to the authentication page) because they aren't trying to connect it's just the phones doing it.

We currently are using infoblox for serving DHCP IP's, and the wireless network has it's own DHCP range that's served to all wireless users (guest and other ssid's).

I looked at the configurations in infoblox and didn't really see where I can do that, but I'm sure there's a way, so I'm going to reach out to infoblox and see if their support can assist.

Thank you all for your responses,

Sam