802.1X(AD) + MAC Filtering via ISE

[Rayw]

I currently am only doing 802.1X(AD) on the SSID.  My users have figured out they can get their personal iPhone on the SSID by entering their AD credentials.  I would like to do 802.1X(AD) + MAC Filtering via ISE.  This way the device would have to be in the MAC allowed group plus their AD credentials.  Does anyone how I can accomplish this?

[KarstenI]

This is nothing more than an additional condition in the corresponding rule in the authorization policy. But it is also an administrative nightmare.

The better solution would be to use TEAP with EAP-Chaining.

[KarstenI]

Another better solution is to give them internet access on a dedicated SSID (for example, the Guest SSID) for their personal devices.

[alemabrahao · Accepted solution]

There is all the information that you need.

https://documentation.meraki.com/MR/Encryption_and_Authentication/MAC-Based_Access_Control_Using_Cis...

[jbright]

If you have deployed Meraki Systems Manager on your corporate wireless assets, but not the employees personal devices, you can also filter on whether the Systems Manager agent is on the wireless device too.