Can i use Mac filtering option on Cisco WLC

[Noovi]

Hello Guys,

Currently in my network setup we have one SSID which is with [WPA2][Auth(802.1X)].

Can i enable MAC filtering on same SSID.

if yes, any impact on currently connected users? Any changes reqired on ISE end policy if MAC filterning enabled only at WLC end?

[Flavio Miranda]

Hello,

 Which WLC do you have?

Yes you can use Do1x with Mac filter and yes there will be impact if you do not register all the valid mac address on the network.

This guide is for WLC 9800 but the ISE part must be the same.

https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/213922-configure-mac-authentication-ssid-on-cis.html

[Noovi]

I am having 5520 WLC.

So are you saying , if i enable mac filtering on SSID with dot1X, so all connected users will impacted if their MAC address is not present on WLC?

My main question is, what is preference 

like, first it will prefer mac filtering, but all users mac should be present locally on WLC. Here user whose mac address is present on WLC will get permitted on network.

second, user whose MAC is not preset on WLC, will go for dot1x in ISE for authentication, it that true or MAC addresses of dot1X users also should be present on WLC?

[Flavio Miranda]

You are implying that the users on the WLC will be permitted by default because they are connected on the WLC ? They dont.

 You need to add them in "SECURITY" > "MAC Filtrering"> "New" 

 There is no IF /ELSE logic as far as I know.  My experience is that if you check the option "Mac Filter" on the WLAN, you better have all your clients properly registered on the Mac Filtering database.

 I used to manage an infra with Mac Filter checked and it was a pain in the ass. All the time new mac address coming and I need to add or users going and I had to remove from the databse.

[Noovi]

Thanks Flavio.

that means better we can do modifications in ISE to check certificate or MAC endpoint whitelisting.

so that it will not require to add all connected user mac address 

[Flavio Miranda]

that´s correct.

[marce1000]

 - FYI : https://www.cisco.com/c/en/us/support/docs/wireless-mobility/wlan-security/91901-mac-filters-wlcs-config.html

 M.