MAC address in catalyst controller

[manvik]

I dont see any option 9800 catalyst controller for MAC address filtering in an SSID.  The method mentioned in this link not working, while select the auth list in SSID settings list does not shows up.

https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/213922-configure-mac-authentication-ssid-on-cis.html

[marce1000]

 - You may want to revert to configuring trough the CLI (only) , if applicable and possible
    + What software version is the 9800 controller  using ?

 M.

[manvik]

software version 17.3.4c

[marce1000]

   - The software version is old and EOL , consider 17.12.3

  M.

[manvik]

I have upgraded version to 17.12.4 what i don't understand is how "Authorization Method" (Security > AAA > AAA Method list > Authorization) and "Device Authentication" (Security > AAA > > AAA Advanced >> Device authentication) is related.
Also there's no menu Configuration > Wireless > WLANs > + Add  . It's Tag&Profiles > WLAN

[MHM Cisco World]

Edit wlan> secuirty > l2 secuirty 

There is mac filter options 

MHM

[manvik]

1. created WLAN and choose Mac filtering in Layer 2 security and choose Authorization list.

2. Only option available in Authorization list is below

3. Where to configure MAC address now?
4. Below is the only place i saw to add MAC address, there's an option to select the SSID. Now how does Authorization list and this MAC address relate or connected?

[marce1000]

  - Note that any GUI changes are implemented in the running configuration ; this is a bit elaborate but what sometimes helps or can give insights is to look or take a difference between subsequent version of the running configuration on an external repository (when making changes with the GUI) then use the intended or viewed running configuration command manually with the CLI and or use ? for correct command completion info's, because in the end it could be a bug in the GUI , 

    Appendix ; you can always evaluate the configuration of a 9800 controller with the CLI command
                     show tech wireless and feed the output from that into Wireless Config Analyzer
                     Note : use the full command as mentioned in green , WirelessAnalyzer does not work with the
                     output from a simple show tech 

 M.

[MHM Cisco World]

What is secuirty you use ?

Wpa + mac filtering?

MHM

[manvik]

Yes. check here - https://community.cisco.com/t5/wireless/mac-address-in-catalyst-controller/m-p/5156398/highlight/true#M274177

[MHM Cisco World · Accepted solution]

There is mac filter and mac filter with wpa

For your case check below 

https://0x2142.com/how-to-catalyst-9800-mac-filtering/

MHM

[Rich R]

It definitely works.
As Marce suggested I highly recommend using CLI not GUI - it's less confusing and follow the doc step by step.
Since you apparently want to use local MAC authentication note that the MAC addresses are configured as "username" but it is very important to enter the MAC address as all lower case with no punctuation (no dots, dashes or colons) otherwise it will not match.

Using MAC addresses for security really is not advisable though.  It's not secure (because it's very easy to spoof a MAC address) and with randomised MAC addresses will ultimately become almost impossible.  With the latest version of iOS iPhones do not use hardware MAC even for networks which have Rotating MAC (the new name for Private MAC) disabled.  The non-rotating MAC is still a Private MAC, different for every SSID.

[manvik]

I could not find a proper step-by-step documentation other than this. Anyone trying to setup MAC address filter SSID in catalyst controller can try these steps;

https://0x2142.com/how-to-catalyst-9800-mac-filtering/

[MHM Cisco World]

I already share this link days ago

Maybe you missing it

MHM