Assistance with MAC Randomization Issue on Apple Devices in the Hospitality Industry using Meraki

[CPeiris]

As an employee in the hospitality industry, I have encountered an issue with MAC randomization on certain devices, particularly iPhones. Due to this issue, I frequently find myself having to either bypass the MAC address or assign it to a group policy. Unfortunately, the Meraki Mobile App does not provide this feature, so I am forced to use the desktop web version to perform these actions. This often requires me to physically visit guests to obtain their MAC addresses and seek assistance from others to bypass them. Therefore, I am seeking assistance from the Meraki community to address this problem.

[alemabrahao · Accepted solution]

Have you checked the documentation?

https://documentation.meraki.com/General_Administration/Cross-Platform_Content/Meraki_and_MAC_Addres...

[rhbirkelund]

Unfortunately, there's not much you can do towards MAC randomisation. This is a security feature introduced on more or less all wireless devices, and can only be disabled on the the device itself.

If you have Systems Manager (or any other MDM solution) you can enroll the deivce and push a profile with your SSID and have MAC randomisation disabled.

Alternatviely you have to get in touch with every single user, and ask them to disable MAC randomisation.

Other than that, there's not much else for you to do, apart from perhaps redesiging how you onboard Wireless clients onto your network.

[CPeiris]

Hi rhbirkelund,
I don't think the Meraki System Manager is practical for hotels and resorts because guests typically stay for short periods of 1 to 14 days and may not want to install another app during their stay. Additionally, guests may have many questions about the app. However, as an IT administrator, the System Manager can be very helpful, even though it may not be practical for guest turnover in hotels and resorts.

[rhbirkelund]

@CPeirisin terms of hospitality, you are completely correct. It's not feasible to require app installation and mdm enrollment for visitors staying at a hotel for 1-14 days.

The point I was trying to convey is that from an IT administrator point of view, you can't do anythong towards MAC randomisation as this is a client side feature, which can only be untoggled by client intervention.

It's the same in terms of roaming between APs. In the end, it's the client who decides when to roam. You might be able to tweak the netework to make wireless roaming work more smoothly, but it's the client who decides.

If you are experience frequent reauthentication flows in your hotel guest network due to MAC randomisation, you might have to a look into your current wireless design instead, rather having to look for solutions to disable MAC randomisation on client devices. Besides - MAC randomsisation is for the benefit of the user. As an IT administrator for a Hotel, you should embrace it, rather than work around it.

[PhilipDAth]

What problem are you trying to solve by assigning group policies to MAC addresses?  Perhaps there is a different way to solve the problem.

[CPeiris]

Hi Philip,
Hotels and resorts commonly use third-party applications to onboard wireless clients, which are often integrated with their Property Management Systems (PMS). Unfortunately, clients often experience difficulties with the splash page authentication process. As a workaround, we usually disable the private address feature, but this does not always resolve the issue. In cases where the splash page bypass is unsuccessful, we must add the client to a predesign group policy. However, there are rare instances where even this workaround fails. In such situations, we have to obtain the client's MAC address and manually add it to the group policy.