I believe I understand what you are trying to describe. Ultimately, your edge firewall will make the decision to allow or block that traffic, regardless of what the endpoint is configured to point to for DNS. I would recommend reviewing the DNS policy options that are available for your specific ASA platform, but here's an example: Cisco ASA with FirePOWER Services Local Management Configuration Guide, Version 7.0 - DNS Policies [Cisco Secure Firewall ASDM] - Cisco Once you have a network object created with the FQDN of site you are trying to block, you can then define an ACL rule where the subnet for that specific SSID is not allowed to hit the external resource. This assumes you have a separate subnet for each SSID / network.
... View more
