Client monitoring and control with Hotspot enabled

framosCTLink
Here to help

Client monitoring and control with Hotspot enabled

Hi,

 

I did a research about hotspot within Meraki Community but could find one.

I was able to discover clients/BYOD or any device capable of providing Hotspot sharing access for the internet.

 

will MX be able to identify clients behind a laptop or mobile sharing access? lets say be visible on the dashboard? I did choose track by IP address but still couldn't see clients.

Franco Ramos
3 REPLIES 3
jdsilva
Kind of a big deal

Hey @framosCTLink ,

 

Generally speaking, no you won't be able to track this. Most hotspots that I've seen run their own DHCP server and NAT the clients that are connected to the hotspot. Because of this the MX will think all traffic comes from the hotspot device itself. 

 

What is your concern here? Perhaps there's another way to address the problem you have?

@jdsilva thank you so much! 

 

main concern for this is that even though rules are being applied for that hotspot capable device. connected users use VPN to bypass meraki rules/blocking... maybe perhaps manually checking the client traffic, right? 

Franco Ramos
BrechtSchamp
Kind of a big deal

So you're talking about a client that's wired to the network and sharing it's connection with another device over an ad-hoc wireless network of the other way around?

 

I think there are multiple ways that sharing can take place.

 

If it's based on Internet Connection Sharing the host performs NAT, so it's hard or sometimes impossible to detect because all guest traffic appears to be coming from the host. Blocking that functionality on the endpoint would be the way to proceed.

 

If it's using connection bridging, then the guests would appear as separate clients with their own MAC addresses and get their own IP addresses. That can be detected and mitigated by implementing 802.1X or sticky MAC whitelists.

Get notified when there are additional replies to this discussion.
Welcome to the Meraki Community!
To start contributing, simply sign in with your Cisco account. If you don't yet have a Cisco account, you can sign up.
Labels