Wireless Access control policy not blocking OS

[TEAM-ind]

I have configured an SSID with an access control policy to block iPhone and Android operating systems.  This used to work quite well to keep mobile devices off this SSID.  However, it does not seem to work at all for iPhones anymore, and is not very effective for Android devices either.  

Does anyone else use this feature, and if so, do you have any success?

This is what it looks like:

[ConnorL]

Hey @TEAM-ind ,

As per the KB "Applying Policies by Device Type"

Note: Some clients may misidentify themselves when specifying the User-Agent string field of an HTTP GET request. Device type policy enforcement is done on a best-effort basis, dependent upon the information that the client provides. When needing to enforce security-focused policies based on device type, please leverage solutions such as Meraki Systems Manager, or Cisco ISE. 

You'd be better off limiting the PSK or credentials to prevent mobile users from connecting to the required SSID in the first place, as group policy by device type is not 100% bullet proof.

[TEAM-ind]

Sure.  I'm just thinking this feature should "kinda" work.

I'd be encouraged by 50%, really.  But with the iphone devices, it seems to be approaching 0%.

[ConnorL]

I'd recommend opening a support ticket in that case, as they should be able to identify the USER-AGENT the device presents to ensure it's what we'd expect for an iOS / Android device.

[TEAM-ind]

OK.  Just to be clear: the Meraki is correctly identifying the client as an Apple iphone, it's even getting the OS version, correct.  But the policy applied to the SSID is not blocking the device.  

[ConnorL]

Hey @TEAM-ind, in that case a Support ticket would be your best bet. Feel free to drop me a DM with a link to the specific client you're testing with and I'll take a peek.