cancel
Showing results for 
Search instead for 
Did you mean: 

How reject Android/iOS devices

How reject Android/iOS devices

Mauro_M_
New Contributor

Hi all.
I would like to submit a question, my access points are configured with two radio networks: one corporate and one dedicated to mobile devices.
These two radio networks are on different vlan.
Many users uses the corporate network for their own mobiles, so my question is: is it possible to create a rule how reject all Android/iOS devices (by MAC OUI/other) if a device tries to connect to that network? 
If yes, how can I do?

I hope I was clear, if not, don't hesitate to ask.

Thanks for your time
Mauro


My setup is:
- VX9000 controller version 5.9.1.3-007R
- Access points: AP-8432, AP-7632, AP-7522

9 REPLIES 9

Mauro_M_
New Contributor

Sorry, I told it was the last question but I’ve another one.

Due to the large amount of MAC OUI to deny (every ACL max limit is 1000 elements), is it possible to create a group of ACL in order to associate more lists to a single group? GUI doesn’t premit to add more than one ACL but I’ve more than 2000 MAC.

Mauro_M_
New Contributor

First of all, thanks everybody for your help.

With some bash scripts and a lot of patience I start to develop my own “blacklist” (and, thanks to you all, it works!).

 

Last question: if I have a specific MAC address to allow, it should be inserted on the top or in the bottom of the list (before the allow all)?

Daren_Ellis
Extreme Employee

HI Mauro,

 

In addition to what Alexandr suggested in regards to DHCP finger printing.
You need to use roles this should also be in the system ref guide.
This will allow better containment than a association ACL based soley on Mac address.

Please see link to find document regard role based firewall.
https://gtacknowledge.extremenetworks.com/articles/Q_A/Where-can-I-find-documentation-for-WiNG-Role-...

Christoph_S
Extreme Employee

The only way I see is to block the whole OUI range but I believe that these manufacturers have many OUIs in there repertoire. 

 

To block whole OUI range you can use the following rule in GUI:

Example of 00-10-FA Apple OUI:

64a3815494b04939a489d0d44fcaab87_5653ec5e-6844-424a-85d0-60f937997554.png

 

There is no option to create a MAC ACL by manufacturers brand name. 

 

Chris

Christoph S.
GTM-P2G8KFN