Cisco WLC-5508 block access by MAC

i have WLC-5508 with multiple SSID (VLAN).  I like to limit specific MAC to only allow to use specific vlan only. is there a way?

SSID1- internal
SSID2 - public
device1 - MAC AA:BB
device2 - MAC  DD:EE

I want to allow device1 to connect to SSID1 only.  if device1 disconnect from SSID1 and try to connect to SSID2, I want it NOT to connect even they know the password to SSID2.

is it possible?

thank
LVL 6
ajeabAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Craig BeckCommented:
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
ajeabAuthor Commented:
I already implement MAC filter on SSID1 but it use for allow list.  I don't see where to set for denied.  I have list of MAC allow for SSID1 but I want to disallow device1 to able to auth to SSID2.

here is what already happened,

device1 allow to connect to SSID1 (MAC define+pre share key)
device2 and anonymous devices NOT allow to connect to SSID1 (because MAC not define)

I like to add,

device1  NOT allow to connect to SSID2 (MAC define as deny to SSID2)
device2 and all anonymous devices can connect to SSID2 (via pre-share key)
0
Craig BeckCommented:
You cant do that the way you have it at the moment.  MAC filter will only allow based on what's in its list.  To do this you need an external RADIUS server to create deny policies.
0
ajeabAuthor Commented:
can you point me to the right direction?  

can i have both local and external RADIUS config for differnet SSID?
0
Craig BeckCommented:
Yes you can.

If you have a Windows domain you can do this quite easily with NPS and AD, but there's a bit of config to do.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Wireless Networking

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.