MAC Filtering Issue on EWC 17.12.4 – Devices Accessing Multiple SSIDs

[Bruno Lorenzetti]

Hi everyone,

I'm currently facing an issue with the Embedded Wireless Controller (EWC) running on Catalyst 9115AX Access Points.

We're using MAC filtering across all WLANs (SSIDs) to control access to the wireless network. Each device’s MAC address (laptop, smartphone, TV, etc.) is registered on the EWC and associated with a specific Attribute List created for each WLAN. MAC filtering is enabled on each WLAN and linked to an Authorization List.
In other words, each device should be restricted to accessing only one SSID.

MAC Filtering-1MAC Filtering-2Device_Associated_Attribute_ListWLAN_config_MAC_FilteringDevice_Connected_SSID_STAR_MOBILESame_device_Connected_Other_SSIDWLAN_STAR_PROD_config_MAC_Filtering

However, we’ve noticed that devices are able to connect to multiple SSIDs, even when they’re supposed to be authorized for just one.

This setup used to work as expected in previous software versions, but the issue started showing up after we upgraded the EWC to version 17.12.4.

Has anyone come across something similar? It seems to be tied to version 17.12.4, although I haven’t found any official BUG reports on this — even though it does behave like a BUG. 

EWC Version: 17.12.4

Thanks in advance!

[marce1000]

  - You could try to track the client(s) using : https://logadvisor.cisco.com/logadvisor/wireless/9800/9800APJoin
     The results from RadioActive Tracing can be processed with Wireless Debug Analyzer
                  (try to find out why the client can connect to a not-allowed-SSID)

     Always have an overall checkup of the EWC (or 9800) controller configuration using the CLI
     command show tech wireless and feed the output from that into Wireless Config Analyzer

    M.

[Saikat Nandy · Accepted solution]

Could you please verify if AAA override is enabled across all the policy profiles? Also what is the config of your different attribute lists? I see that you are using both Attribute list as well as WLAN Profile Name. 

Instead of using both, can you just test with attribute list config -- the config should include 'Attribute Type' as 'wlanprofilename' and 'Attribute Value' should include the name of the WLAN profile.

Try this in a test SSID and see how the behaviour is. But please ensure that AAA override is enabled across all Policy Profiles.

[Rich R]

It's not an exact match for what you're seeing but have you looked at https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwb20613 ?

There is a very old bug CSCvo72157 which matches what you're seeing but that was opened on the old, long since abandoned, Converged Access IOS-XE.  What's interesting is that that bug has been updated recently suggesting that TAC have recently added a new case to it...

If the CSCwb20613 notes don't help then you'll probably need a TAC case.

[Bruno Lorenzetti]

Hi everyone,

I’d like to thank all of you who contributed and helped me with this issue.

After reviewing the Policy Profiles, I noticed that the "AAA Override" option was disabled. Once we enabled it and ran some tests, the user was correctly restricted to connecting to only one SSID.

Many thanks to @Saikat Nandy  for the comment and the helpful tip.

Appreciate everyone’s support!