Solved

Cisco WLC-5508 block access by MAC

Posted on 2014-12-02
5
1,914 Views
Last Modified: 2014-12-08
i have WLC-5508 with multiple SSID (VLAN).  I like to limit specific MAC to only allow to use specific vlan only. is there a way?

SSID1- internal
SSID2 - public
device1 - MAC AA:BB
device2 - MAC  DD:EE

I want to allow device1 to connect to SSID1 only.  if device1 disconnect from SSID1 and try to connect to SSID2, I want it NOT to connect even they know the password to SSID2.

is it possible?

thank
0
Comment
Question by:ajeab
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 2
5 Comments
 
LVL 46

Accepted Solution

by:
Craig Beck earned 500 total points
ID: 40477503
0
 
LVL 6

Author Comment

by:ajeab
ID: 40477558
I already implement MAC filter on SSID1 but it use for allow list.  I don't see where to set for denied.  I have list of MAC allow for SSID1 but I want to disallow device1 to able to auth to SSID2.

here is what already happened,

device1 allow to connect to SSID1 (MAC define+pre share key)
device2 and anonymous devices NOT allow to connect to SSID1 (because MAC not define)

I like to add,

device1  NOT allow to connect to SSID2 (MAC define as deny to SSID2)
device2 and all anonymous devices can connect to SSID2 (via pre-share key)
0
 
LVL 46

Expert Comment

by:Craig Beck
ID: 40477656
You cant do that the way you have it at the moment.  MAC filter will only allow based on what's in its list.  To do this you need an external RADIUS server to create deny policies.
0
 
LVL 6

Author Comment

by:ajeab
ID: 40477664
can you point me to the right direction?  

can i have both local and external RADIUS config for differnet SSID?
0
 
LVL 46

Expert Comment

by:Craig Beck
ID: 40477722
Yes you can.

If you have a Windows domain you can do this quite easily with NPS and AD, but there's a bit of config to do.
0

Featured Post

Simple, centralized multimedia control

Watch and learn to see how ATEN provided an easy and effective way for three jointly-owned pubs to control the 60 televisions located across their three venues utilizing the ATEN Control System, Modular Matrix Switch and HDBaseT extenders.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

It’s 2016. Password authentication should be dead — or at least close to dying. But, unfortunately, it has not traversed Quagga stage yet. Using password authentication is like laundering hotel guest linens with a washboard — it’s Passé.
Keystroke loggers have been around for a very long time. While the threat is old, some of the remedies are new!
Viewers will learn how to connect to a wireless network using the network security key. They will also learn how to access the IP address and DNS server for connections that must be done manually. After setting up a router, find the network security…
If you're a developer or IT admin, you’re probably tasked with managing multiple websites, servers, applications, and levels of security on a daily basis. While this can be extremely time consuming, it can also be frustrating when systems aren't wor…

705 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question