WLC5508: Block mac addresses from specific SSIDs, allow on others

[eshumaker65]

Hello!

I am looking for a way to block specific devices from all SSIDs except one. We are running WLC5508s, and do not have ISE or Prime installed, so it would probably need to be contained within the 5508.

Our use case is this:

We have custom applications that run on iPads in our production facility. These iPads are connected to a specific SSID, which Cisco umbrella and our ASA filters to allow 3 specific internet sites/ports. However, I can't use guided access on the iPad (there's 2 apps they use), so the users can switch to our Guest network and bypass filtering to goof off on the internet. So, I need to block a list of MAC addresses all the other SSIDs, while allowing those same MAC addresses to connect to SSID#1.

Thanks for reading!

[Scott Fella]

Wouldn’t it be easier to have a mdm solution or use the Apple Configurator to manage your devices? I would think you can define which SSID the device can and can’t connect to.

[eshumaker65]

We use InTune as our MDM, and it has loaded the SSID on the device, but it doesn't appear that you can block the user from then going to settings and selecting a different SSID. 

[Leo Laohoo]

Static IP address is your quickest solution.