MAC filtering on Guest

[Wes Schochet]

Hi All-

We are exploring ways of keeping our internal devices off our our guest network.  Guest is open with no authentication or sign in required.  I was thinking of trying to  use MAC filtering to accomplish this.  I think this will require a pretty large endpoint  identity group in ISE.  We'd use the API to maintain the group on a regular basis.  I have a three PSNs that I am sue can handle this from a volume standpoint, just curious if anyone else has tried this with a group that is this large?

Or, is there a better way to keep my internal devices off the guest network?  I'd be curious to hear what everyone else is doing?

Thanks,

Wes

[balaji.bandi]

if this BYOD with single SSID, you need to make a decision based on authentication for Internal Access, if not authenticated should send to Guest work flow : 

https://ciscocustomer.lookbookhq.com/iseguidedjourney/byod-configuration

Are you looking MAC authenticaiton known devices - then you should have profile check against that MAC database.

My view MAC authentication not more secured.

[Rich R]

For starters you would need to be able to enforce hardware MAC addresses on the devices via MDM otherwise they'll be changing all the time and impossible to track.  But if you have MDM then:

Can't you use device policies to enforce that (assuming you have MDM)? Otherwise it seems like a near impossible task to me.