[ASK] mac filter with PSK

[luthfigibrani]

Hi..

I want to know, is it possible to filter specified mac-address can join ssid with PSK Authentication?

In the dash board only MAC-based access control (no encryption) with radius.

Thanks and Regards,

Gibs

[luthfigibrani]

I mean, we assign mac-address list manually on the dashboard not using radius

[alemabrahao]

Unfortunately, the only way is using a Radius server.

[KarstenI]

The best way is to do it with a radius-server. There you can define which MAC-addresses are allowed and also pass the correct passphrase for encryption to the AP. This is done with "iPSK with RADIUS".

[luthfigibrani]

What about white-listing mac-address on client menu per ssid? As image attached:

 is there any trick to make it happen?

[alemabrahao]

I think it is not what you want. When you put the client in an allow list it will apply the following settings to a client:

• Is exempt from all firewall rules, both Layer 3 and Layer 7 (Applies to both the MX Security Appliance and the MR Access Points)
• Bypasses AMP

• Bypasses a Click-through Splash page 
• Bypasses a Billing (paid access) Splash page and access the network on an SSID without paying or authenticating
• Bypasses a Sign-on Splash page without authenticating (Applies to both the MX Security Appliance and the MR Access Points)
• Is exempt from Per-client bandwidth limit (Applies to both the MX Security Appliance and the MR Access Points)
• Is exempt from Traffic shaping rules (Applies to both the MX Security Appliance and the MR Access Points)
• Bypasses Content filtering on MX Security Appliance 

https://documentation.meraki.com/General_Administration/Cross-Platform_Content/Block_Listing_and_All...

[KarstenI]

It is not a trick, it just won't do what you were asking for as the PC could still join the SSID.

If the workflow is ok for you it can be implemented this way:

• Default policy is to block everything (or perhaps allow DHCP)
• the client connects to the SSID
• the client gets whitelisted on the dashboard by applying the right policy

[luthfigibrani]

So every client still can associate with the ssid, since the firewall rule is deny all. Only the white-listed client could use the ssid for communication. Is that right? 

In other words, white-listing is a way to bypass any firewall/policy rule, isnt it?

[alemabrahao]

yep

[PhilipDAth]

Have you considered using IPSK instead?

https://documentation.meraki.com/MR/Encryption_and_Authentication/IPSK_Authentication_without_RADIUS