Setting up an MR44 to allow only a few clients using MAC address filtering

[SCampisi]

I am needing to setup secure access to a wireless network and i have three tablets that i want to access the network, but no other devices of any type.  I thought i would be able to just allow a few MAC addresses and that would be done, but i dont find that functionality in the admin on the dashboard.  I saw a post telling me to setup a layer 3 rule blocking all access, and then whitelist the tablets individualy but that seems odd to me and seems a backwards way to do this.  is thre a simpler way?  i am having trouble setting up a rule that blocks all devices given that there is  a default rule that i can't delete that allows all traffic.

Can anyone help?

[ww]

What you described should be working.

The other option is using a radius server.

If its just 1 or a few AP you could filter mac on a switch port, if your switch support it.

[Russ_B · Accepted solution]

@SCampisi- You don't need to delete or change the default rule.  The rules are processed top down, so when you add a new rule for the SSID and set it to Deny Any Protocol to Any Destination that will be the top rule.

At this point, your clients would be able to connect, but not access anything.

Then you could go to Network Wide/Clients, click the check box for the clients you want to allow, then drop down the Policy box and add them to the Allow list.

I just tested this in the lab here and it seemed to work as expected.

[BlakeRichardson]

Bear in mind MAC filtering isn't totally secure as MAC addresses can be spoofed. 

[Aaron_Wilson]

What Blake said. For wireless you really want to avoid any MAC based filtering/access. You can see the MAC for any wireless device, as because of this anyone could spoof and gain immediate access to the network.

[SCampisi]

thanks for all the information. 

i agree that mac filtering is a potentially, unsecure option, but unfortunately, i am setting up a network for a franchise and i am forced to setup the wiri based on their mandates.

MAC filtering

ambiguous hidden SSID

Strong wifi password on rotation.

i had considered using the meraki authentication and then wwhitelisting the macs, but that option seems to bypass the wifi auth and so it doesn't meet my requirements.  is anyone using the meraki auth?

[Aaron_Wilson]

If they are using WPA2/3 passwords, that great. Hiding SSID and MAC filtering is mostly to keep away the non-tech people who likely do not pose a threat to begin with.

Good to hear passwords are being used.