Is there a way to MAC filter at the AP level

[bpierson]

I have a customer that wants have Non 802.1x aware devices to log a SSID with PSK but have the devices filtered by MAC. The remote site is on FlexConnect. They would like to lock down the SSID because a PSK gets shared around too quickly and the WAN link bandwidth is exhausted. They want to make sure they can get any needed device back online while the link is down. They have 9800 WLCs and C9130s. Thanks for any pointers to documentation or process.

[balaji.bandi]

You can have MAC ACL on cat 9800  (check below guide can help and understand is this works for you?)

https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/213922-configure-mac-authentication-ssid-on-cis.html

They want to make sure they can get any needed device back online while the link is down.

not sure we understand this correctly can you explain more on this context.

[bpierson]

The customer does not want to go to the controller for the mac filtering. They want to know if there is a way to have the AP do all of the security if the controller connection is down, PSK with MAC filtering. They realize the MACs would be need on the individual APs.

[balaji.bandi · Accepted solution]

The solution you looking may not be possible if the AP join WLC - WLC do the all task.

May be you should have local WLC or AP act as WLC for the remote sites to manage locally.

[bpierson]

Thanks for that, they are afraid of too much delay to their Azure based controller or down links.

[balaji.bandi]

You can have bandwidth limit per client or per service based on the perimeter of Site.