Restrict access by mac address in SSID (all clients blocked by default until explicitly allowed)

[jperez_netics]

as far as i know, if an endpoint connect to the wireless network, i can then restrict the access using device policy and choosing normal, block or allow

what the customer wants is exactly that function but backwards, i mean, if we can set device policy on block by default for any new users and manually put them in allow or normal, is this possible?

i tried to do that but i think that i'm missing something or it can't be done the way they want

[alemabrahao]

Not directly on the SSID, you would need a Radius server to restrict it this way.

https://documentation.meraki.com/MR/Encryption_and_Authentication/Enabling_MAC-based_access_control_...

https://documentation.meraki.com/MR/Encryption_and_Authentication/MAC-Based_Access_Control_Using_Mic...

[Brash]

An option that might work...
 - Create a VLAN and assign a group policy to it that denies all traffic. Set this VLAN on the SSID.

 - Once the device has connected, manually change the group policy of that device to one which allows network traffic.

[IvanJukic]

Hi @jperez_netics, 

What about Layer 2/3 LAN isolation? Client that connect to a "blocked SSID", can be denied (except, DNS and DHCP, which you can controll anyway) to local netwoks. 

'Deny Local LAN' settings in Cisco Meraki MR firewall

https://documentation.meraki.com/MR/Firewall_and_Traffic_Shaping/'Deny_Local_LAN'_settings_in_Cisco_...

[christy2951hern]

You're right, most traditional Wi-Fi access points (APs) don't offer the functionality of blocking by default and allowing by exception for MAC addresses within an SSID (Service Set Identifier). However, there are alternative approaches to achieve a similar outcome. ny state of health
MAC Filtering with Open Network (Least Secure) This method involves creating an open Wi-Fi network (no password) and restricting access only to authorized MAC addresses through the router/access point's settings.
This approach is not recommended for secure environments as anyone can connect and potentially see network traffic if they have the authorized device's MAC address.