Meraki blocking WiFi connection

[Hubble]

Hello,

Have a user who's connecting to our WiFi and was working fine until this morning,  he's getting a Meraki splash screen saying "the network administrator has blocked his access" I looked around Meraki portal but haven't found any information that'd be helpful.

I have the MAC address of the device. Please let me know if you have any idea. Thanks. 

Hubble

[Nash]

Look up that device under Network->Clients and click into it. What do you see under Policy? Is it set to Blocked, or placed in a Group Policy that would block it?

[kYutobi]

---

@Nash wrote:

Look up that device under Network->Clients and click into it. What do you see under Policy? Is it set to Blocked, or placed in a Group Policy that would block it?

---

As @Nash said you can just try to use the MAC address and set the policy anyways just to see if it was by chance blocked.

[Hubble]

Thanks @Nash 

I couldn't find the device (mac address) from Network-Wide > Clients 

[vassallon]

@Hubble I have found that sometimes you need to look for the client with these settings.

[AjitKumar]

Hi @Hubble,

The steps suggested by @Nash shall certainly resolve the issue.

You may also  check the following

1. Organization > Change Log [To Verify any Block Events]
2. Wireless > Access Control - Assign group policies by device type [To verify Block policy by device type]

[Hubble]

Thanks @AjitKumar 

I can't find the device's mac address from Network-Wide > Clients or from anywhere in the portal

[Nash]

Where's your source of DHCP for your wifi? If it's not Meraki DHCP, you might be able to check the DHCP server for that mac address and get a searchable IP.

Or it's possible that the device just isn't showing up as a client at all, for some reason. In that case, you'll need to have them connect at a time when you're available to troubleshoot.

[Hubble]

thanks @Nash its a meraki DHCP 

[Nash]

Okay, if you're using Meraki DHCP (i.e. the AP hands out something in the 10.0.0.0/8 space and NATs to itself) and you're not seeing the client on any APs... I'd really go for having this user have their device around, while you're watching to see what happens when they try to connect.

[PhilipDAth]

Is the user layer 2 adjacent to the MX (aka the MX is their default gateway) or is something else their default gateway (like a layer 3 switch).

If something else is their default gateway then you might need to check what policy in the MX is applied to that device, as all of their traffic will appear to come from it.

[vassallon · Accepted solution]

@Hubble Do you have a screenshot of the error message the device is receiving? Based on your original comment it sounded to me like the device is being blocked at the wireless level not anything else.

This is the splash screen that I am seeing when a device is blocked from the network.

Blocked from WiFi

If so, I would suggest looking at your wireless clients for clients with a policy and see if you see it being blocked there. I tested this earlier and I could not find the blocked client until I looked for clients with a policy.

[Hubble]

Thanks @vassallon 

Unfortunately, I'm working with the remote client with local IT support guiding him. I requested for screenshot, but that sounds like the error message he's getting. I created another SSID for testing, it is an OPEN one and I asked them to try it...

[Hubble]

Thanks @vassallon . You are right, it is being blocked from wireless clients with a policy. So I wonder why it got blocked, user been using the wifi OK for a few days. You have any idea on why all of the sudden devices got blocked?   

[vassallon]

@Hubble Usually a block like this is enforced by an admin. I would suggest looking at the change log for the organization for the keyword blocked. Here is the logs from when I tested it to generate the screenshots for the iPad.

[Hubble]

Thanks @vassallon . I looked into change log and i can see one changed only for the device, that is when blocked is removed. 

[vassallon]

Hmmm, the only other thing I could think of is perhaps a group policy was applied to the device under wireless > access control.

I can't think of any other way that a policy to explicitly block a device from WiFi may have gotten applied. 

[Hubble]

Policy is disabled like you posted below. I called Meraki and they couldn't find anything and just asked me to let them know if it happens again....BTW, user is okay now. Thanks for your help. 

[vassallon]

@Hubble Glad to have helped, I know it can be tricky to find those blocked devices until you know the trick of looking for devices with a policy.

[Hubble]

Thanks @Nash 

Unfortunately, I'm working with the remote client with local IT support guiding him. I created another SSID for testing, it is an OPEN one and I asked them to try it...

[Nash]

Oh, I feel your pain. Long live the testing SSID. My problem child clients have one permanently configured but turned off. Good luck.

[AjitKumar]

Hi @Hubble 

What all Meraki Gear do you have in your network?

MX, MR , MS?

Please share the Model No. too?