topic Re: MAC ACL on Extreme Cloud IQ in ExtremeCloud IQ

MAC ACL on Extreme Cloud IQ

Matheus_Santana — Wed, 22 Mar 2023 12:22:31 GMT

Is there any way to create an ACL policy similar to WiNG in Extreme Cloud IQ?

In WiNG I can associate an ACL policy to the SSIDs, blocking or releasing access to devices via MAC, for example, I would like to create the same policy for my SSIDs on devices connected to Extreme Cloud IQ, but I can't find a way.

Re: MAC ACL on Extreme Cloud IQ

Ash_Finch — Wed, 22 Mar 2023 12:41:28 GMT

I'm unsure what it looks like on the WiNG side so may not be a direct comparison but there are two ways to block devices connecting via MAC:

1. In the SSID > SSID usage you have a MAC Authentication tab
2. At the bottom of the SSID > additional settings > optional settings > enable MAC-Based filters (in the DoS Prevention Box) > Default action Deny > add MAC-Based filters > add devices to allow onto an SSID.
Only limitation of that is that you'd have to add in the MAC's one by one for each SSID.

Re: MAC ACL on Extreme Cloud IQ

Matheus_Santana — Wed, 22 Mar 2023 12:52:28 GMT

This is exactly what i'm looking for.

Thanks!

Re: MAC ACL on Extreme Cloud IQ

Christopher_Fra — Fri, 24 Mar 2023 20:40:17 GMT

The following is a Knowledgebase article explaining the steps provided by Ash_Finch:

https://extremeportal.force.com/ExtrArticleDetail?an=000057316&q=XIQ%20MAC%20ACL

Re: MAC ACL on Extreme Cloud IQ

DeVoID — Thu, 30 Mar 2023 12:53:59 GMT

But what a PITA that is... having to push it to every AP, and not just that but as a full config push which reboots the AP's... There has to be a better way of doing MAC filtering. Our old Ruckus had an interface where you could either manually enter the MAC address, or browse/search devices, select the device, and click on block. Done. The changes rolled out to all the AP's, no reboots required! How about something like that?

Re: MAC ACL on Extreme Cloud IQ

Ash_Finch — Fri, 31 Mar 2023 12:13:59 GMT

I haven't done it in a while, but if I recall correctly I only pushed a delta to the APs and it worked. Just tried now and it's part of the running config, so suggests a delta would be ok. I'm not in the office to check whether it blocks me from connecting though to be completely sure!

Otherwise agreed, it's not the simplest of methods to block a device from connecting