Hi Team,
we use several Max BR1 Pro 5G, where only Organisation Notebooks should be allowed to connect to WiFi.
Long time ago someone hast postet the WiFi-Password, so many user try to connect printers, their private mobile devices, and so on to the router.
Change Password isn’t possible due to produktive environment and changing staff who are not tech-savvy.
My blacklist ist about 136 devices and rising rapidly today by a Z-Flip6, evey minute connecting with another MAC.
All MAC are from same Device
Z-Flip6 - 62:75:08:A3:D3:20
Z-Flip6 - 92:E7:3C:08:11:D7
Z-Flip6 - 82:25:AA:17:68:E4
Z-Flip6 - DE:C2:7F:A7:4F:AF
Z-Flip6 - 6A:94:0C:B2:81:C6
Z-Flip6 - 1E:ED:36:95:7B:D0
Z-Flip6 - A6:61:5F:8F:60:4C
Z-Flip6 - DA:F9:41:E8:48:6D
Z-Flip6 - D6:E7:43:AE:F9:2F
Z-Flip6 - CE:9D:FC:A8:D4:9A
and not ending yet.
Is it possible to implement a blacklist selection via Type, so I can block Smartphones, Printers, etc - or everything except Desktop (sometimes desktops are shown as unknown)
1 Like
Blacklist should definitely be a feature, but the right answer is to change the wifi password, even though it’s painful. WPA Enterprise would also solve this problem.
1 Like
Yes, that would be the best solution, but we’d have to create a new Wi-Fi profile on 137 laptops that are on the go all over Germany, connected to 21 routers. It’s a little tricky.
WPA Enterprise would also solve this problem.
If the router were connected to the company network, that would certainly be an option. However, the routers are only used to provide Internet access for the laptops, which each dial into the company VPN.
I’m going to use a different option: “Grouped MAC Addresses” in combination with firewall rules.
All MAC addresses on the list have full access for “Outbound” and “Internal Network Firewall.”
“Inbound” and “Local Service Firewall” allow only “Desktop” and “Unclassified” to have unrestricted access.
“Unclassified” is used because the laptops are sometimes (< 0.5 %) classified as ‘Unknown’ rather than “Desktop,” even though the computer name, MAC address, and manufacturer are correctly recognized.
And adding another MAC to the grouplist blocks the Access imideately. Well tested.
With this configuration, unwanted devices can still connect to the Wi-Fi network, but they will neither have access to the Internet nor be able to communicate internally in any way.
This means the mobile data allowance isn’t used. Mission accomplished.
1 Like