AP Ruckus MAC ACL to AP Meraki

[WARLAIN]

I have a scenario where we're migrating from a Ruckus AP to a Meraki AP. The issue is that the Ruckus AP has an ACL set up to allow specific devices based on their MAC addresses from a local list—not via RADIUS. I'm trying to replicate this on Meraki but can't find the option. I went to Client > Add Devices > Allow List, but it didn't work, and several devices that shouldn't have connected have already joined that network.

Does Meraki not have that option? Is it only possible via a MAC-based ACL?

[alemabrahao]

Meraki does have that limitation. Unfortunately, to restrict access via MAC address, you need a Radiu server.

https://documentation.meraki.com/Wireless/Design_and_Configure/Deployment_Guides/MAC-Based_Access_Co...

[alemabrahao]

The block and allow list is for a different purpose and I believe it won't meet your needs.

https://documentation.meraki.com/Platform_Management/Dashboard_Administration/Operate_and_Maintain/H...

[PhilipDAth]

Meraki group policies are applied based on MAC address.

https://documentation.meraki.com/Platform_Management/Dashboard_Administration/Operate_and_Maintain/H...

It sounds like what you want to do is create a WiFi firewall rule to "deny all", and then apply a group policy to each client to override that firewall policy.  The "Allow List" is an example of a built-in group policy that overrides firewall rules for that client, allowing it access.

More info about WiFi firewall rules.

https://documentation.meraki.com/Wireless/Operate_and_Maintain/How_Tos/Firewall_and_Traffic_Shaping/...

[alemabrahao]

It's not the same thing. This way is a possibility, but I think that it's more painful.

[alemabrahao]

Just to clarify, the method you're suggesting doesn't prevent the client from associating with the SSID, it only blocks browsing.

This still presents a security risk because the client will still be receiving an IP address, allowing it to scan the network.

I don't know if you've done this before, but what he actually wants is to implement MAC address filtering, so only clients on the list will be allowed to associate with the SSID.