XIQ-C Policy

[Christopher_Tay]

I am trying to block Apple Watches on my wireless network but having difficulty getting it working.

I have followed the steps in the guide.

I have created a group based on the hostname "Watch"

This puts the device in to the group

I have created a rule with an accept policy of "Deny Access"

I have configured my "Deny Access" role to Deny for default action.  I have also tried a L2 rule that denies traffic to any MAC.  The role is associated with the device group that includes the AP I am testing on.

I have also tried testing with the system Blacklist group and rule and that doesn't block traffic to my test device either.

What is it that I'm missing?

Thanks for your help

[iDavidHere]

Hey, your setup looks close but the main issue is usually that Apple Watches don’t consistently match hostname-based rules like “Watch,” so the group may not catch them every time. On top of that, they often use randomized MAC addresses which can bypass simple L2 or MAC-based blocking attempts. You might get better results using device fingerprinting or OUI-based matching instead of relying on hostname. Also make sure the deny role is being applied after auth, otherwise the device can still slip through with default access.