I recently took over management of a Meraki org with 600+ retail/warehouse combo locations. In each of these there is an MX, at least one switch (MS225 series for the most part) and one or more MR- WAPs. Network config consists of two VLANs, one for corp devices with VPN access to a hub, and one isolated for credit card/payment devices. I'm trying to figure out a way to identify non-approved/non-corp client devices on every network, and push them onto a separate (not yet created) VLAN for guest-related purposes. I'm looking for options on how to accomplish this.
In the past, I have seen this solved (with the help of an SE team) by creating a python script that listens to a syslog for DHCP-related events and then taking action for each client on each network accordingly via APIs. This, of course, assumes that I have the OUI of the MAC address for each approved client device/type (which I do). But I don't have those python resources at this new job, and it's beyond my scripting abilities to create it from scratch.
Is there any off the shelf/other method of accomplishing this? I've heard Cisco ISE could do it, and I'm going to be looking into that. But curious for any other solves. Thanks!