MAC Address Filter BUG in 11.23T?

[admin_2]

We use MAC address filtering ONLY to allow /disallow access to our 350 series access points which we have 6 of. A newly purchased unit running 11.23T allows access to all MAC addresses even though I have explicity specified all Unicast as "Disallowed", which refuses connections to all with the exception of those "allowed" in the MAC address filters table, of course.

No other filtering, encryption, or other methods to prevent access is being used as we need to leave everything wide open for approved connections (we provide hotspots for business travelers in Hawaii).

I'm wondering if I'm maybe missing something that's in the new software version. The other units are running 11.05. Thanks!

[tepatel]

Here is the url which has a step by step config for MAC address filtering.

http://www.cisco.com/univercd/cc/td/doc/product/wireless/airo_350/accsspts/ap350scg/ap350c3b.htm#xtocid5

Now if the clients are not filtered immediately, click WARM RESTART SYSTEM NOW on the Manage System Configuration page to restart the access point to take the filters effective.

[#3]

I appreciate the response, but doing a restart doesn't solve the problem. I upgraded the firmware to 12.00T just to make sure everything was up to date, but that still does not make the filters work properly.

FYI, the 12.00T version no longer contains the Unicast Address Filter setting on the AP Radio Advanced page as described THROUGHOUT the Cisco support pages. I don't have a clue at this point how I found it in the end, but as is mentioned in the link you provided above, on the AP Radio Advanced page, about 1/2 way down, there's a link to: Advanced Primary SSID. THIS link will take you to the Unicast Address Filter section.

[jimmy.gibson]

I have the same problem with my AP350. My MAC address filtrer has been set according to the procedure, but every MAC addresses passes the AP. I have the firmware 11.23T.

[tepatel]

Here is the catch..Pl. make sure that the "IS mac authentication alone is sufficient for a client to be fiullty associated" is set to "no" on MAC filter setup page..

If it set to "yes", mac address filtering will not work.

[#6]

If this works, it doesn't make any sense. Our setup allows no one in unless their MAC address is in the filter list. As far as I'm concerned, "mac authentication alone **IS** sufficient for a client to be fully associated" so the selection should be set to YES, not NO. It's the only thing the 350 is looking for. (You're in the list? Fine, do what you want. You're not in the list? Get lost!)

Daniel