1131 AP question

also, how is it possible when a ssid is not getting a ip address from the vlan but some 192.168.1.1 address ? Hows that even possible? I know some were saying someone is having some device that's transmitting wifi singal but how would they even be able to get that from an ssid thats configured with vlan IP range? There are only 2 people on site and they're not using anything that's giving out signal. Can anyone suggest or help?

IP address issue first...

If another wireless (or wired) client (on the VLAN that the SSID is attached to) has a DHCP server running, clients attaching to the WLAN will be able to obtain an IP address from that DHCP server.

MAC filter issue...

Your config is only half-way there.  Try this...

access-list 700 deny   0071.cc8e.x.x.x.x   0000.0000.0000
access-list 700 permit 0000.0000.0000   ffff.ffff.ffff
!
interface Dot11Radio0
 l2-filter bridge-group-acl
!
interface Dot11Radio0
 bridge-group 1 input-address-list 700
 bridge-group 1 output-address-list 700

Select allOpen in new window

That assumes you have no VLANs on your AP and that you want to apply the filter to the 2.4GHz radio only.

Look into lowering their priority. If you block evildoers they get bored and change MAC and land you with blocking trillions of MACs.

@ craigbeck

How can I detect this device that might be giving out addresses? What are some ways of detecting this thing? It's been an issue at this site for a while and I need more of a permanent solution. thanks