Lockdown Clients on an SSID by Mac Address

[merakitales]

We have several meraki access points and we're looking to limit access to the corporate SSID to only corporate laptops and keep out personal devices. We have changed the password a couple of times and we're still finding personal devices on the corporate network. How do we go about limiting access to an SSID by mac address without using a radius server?

[BrechtSchamp]

This describes what you need:

https://documentation.meraki.com/MR/MR_Splash_Page/Using_a_Sign-on_Splash_Page_to_Restrict_Wireless_...

Basically you're setting up a splash page and whitelisting certain devices to make the access points allow them to the network without the splash page.

[merakitales]

Thanks Brecht! Had an extra kudos question: we are thinking to use jumpcloud's radius-as-a-service with the association requirements of WPA2-Enterprise in the meraki dashboard to authenticate to the SSID via ldap user credentials in jumpcloud.

The preferable requirement is to configure the wap to jumpcloud's radius and whitelist known company devices via mac address so they connect without authentication.

Will this cause connection attempts from unknown devices to be automatically blocked at the splash page even if you selected "sign-on with meraki authentication" in the meraki dashbaord, or will they get a prompt to authenticate and when they do, bypass the mac address restriction?

[PhilipDAth]

If you use WPA2-Enterprise mode their is no splash page (normally), and you can't use group policy to bypass WPA2 authentication.

I did a quick Google and it Jump Cloud does not appear to support MAC address authentication (althought it has several references to Apple Macs).

Using just WPA2-Enterprise mode and Jump Cloud it does not look like you could prevent users from connecting personal devices.

What about providing a seperate SSID for staff personal devices and asking them to use that instead?

[BlakeRichardson]

Sorry to hijack but if anyone wants to test using Jumpcloud you can use their service for up to 10 users for free. 

[merakitales]

Let me make a suggestion. Using the association requirement of WPA2-Enterprise with my Radius Server option, under the Splash page you would select Sign on with meraki authentication, assign block all access until sign on is complete, then add known machines to the whitelist via mac address. When an end-user device on the known machines list attempts to connect to the SSID, they get a prompt to enter their jumpcloud credentials then it bypasses the splash page requirement since their machine mac address is whitelisted. On the other hand, if an unknown machine successfully authenticates using a user's jumpcloud credentials, then they are taking to a splash page requesting the meraki authentication. The meraki authentication would be a single email-address and password set at Network-Wide > Users that only the administrators would know. Did I make it complicated or is this a possibility?

I'm basing my response of the following knowledge base articles:

https://support.jumpcloud.com/customer/portal/articles/2406833-configuring-a-cisco-meraki-wap-to-jum...

https://documentation.meraki.com/MR/Encryption_and_Authentication/Cloud_Hosted_Meraki_Authentication

https://documentation.meraki.com/MR/MR_Splash_Page/Using_a_Sign-on_Splash_Page_to_Restrict_Wireless_...