Wondering if anyone has done this before and can offer some tips on how to implement a solution...Here's our situation..   We're mainly a Mac shop with maybe 10-15 Windows users We have our MX32 units set up to use RADIUS and user authentication Mac machines are not domain-bound  What we need to do: Prevent all non-company devices from connecting to our corporate/internal wifi What we've looked at: Attempted to block MAC addresses on the RADIUS policy side but Apple does not have a set range of MAC addresses for each of their products Attempted to use Meraki's "apply group policies by device type" setting but failed miserably -- when we tested by blocking all iPhones and Androids from our corporate network, Meraki started flagging all phones and some macbook pros as iPhones and blocked the company laptops from connecting Swap to machine authentication instead of user auth -- cannot do this because the Macs are not domain-bound and can't simply use certs from our CA Swap to machine auth by using Meraki's System Manager -- cannot do because cost and management doesn't want to do anything that cost money.... Only options I see but have not tried: re-bind all Mac clients to the domain and configure machine auth with our CA Set up a SCEP server to hand out certs to perform machine auth since Macs are not domain-bound If any one has done something similar, could use some pointers.  ... View more