SSID to allow BYOD's and not allow Company PC's accee

[jimmyfoddrell]

I have a WLC 2504 with (2) 3702 AP's. I have successfully set up a SSID (Internal Laptops)  for the internal users to connect to the local LAN. I am now trying to create a SSID (Public)  for the employees and guest to use their BYOD's. The issue I am having is attempting to block the company laptops from the Public SSID. I have attempted using my W2K3 server IAS and setting up the radius info in the WLAN I created for this SSID. I just cant seem to get anything to work. I have searched everywhere for answers but not had any luck. Has anyone ever done this? Thanks in Advance.

[ericgarnel · Accepted solution]

What you need is a mechanism to deal with "client missassocation"

A WiPS engine can identify clients by MAC address and de-auth them based on the SSID policy.

If the client joins "Guest"  they are knocked off.  They are not knocked if they join "corp"  

Motorola AirDefense and AirTight  WiPS both provide such functionality.  One of my customers used it very effectively in conjunction with a CUWN infrastructure.

Eric

Please rate if this was helpful

[jimmyfoddrell]

Thanks Eric for your reply. I was able to get it working via IAS. It is a little more administration involved, but it does what I needed. Thanks/

[ericgarnel]

Jim,

Excellent!  And thank you for the rating!

By Chance, would you be able to share your steps?  I have a few customers who could use the same functionality with their IAS

Eric

[jimmyfoddrell]

I thought it was working, but it was very inconsistent. I ended up using the DHCP DENY rules on the Windows 2008 DHCP server.

[Matthew Knott]

Hi Jimmy,  If you are running Windows based laptops in an Active Directory environment,  I added the Guest SSID to the Group policy as a "Disabled" SSID.   Then none of our corporate Windows laptops can access the Guest SSID.  Works a Treat!

Matthew