The whitelist based on ssid configuration on AC

Scenario

Frame filtering involves the configuration of white list, static blacklist and dynamic blacklist. When AP receives a data frame, it will check the MAC address of this data frame. The process of frame filtering is shown below:

                                             

Figure flow of frame filtering

I. Requirements

Configure white list in WIDS configuration mode. When an entry exists in the white list, the corresponding client will pass frame filtering.

   

II. Configuration Tips

Configure whitelist based on SSID (When an entry exists in the white list, the corresponding client will access to ssid)

Configure blacklist based on SSID (When an entry exists in the black list, the corresponding client will be denied to access to ssid)

IV. Configuration Steps

Configure whitelist based on ssid：

WS5302(config)#wids

WS5302(config-wids)#ssid-filter whitelist mac-address 6809.27b0.169f in ruijie       ----->6809.27b0.169f is allowed to access to SSID：ruijie

WS5302(config-wids)#ssid-filter whitelist max 256----->adjust whitelist capacity (range from 1-256,  optional config)

Configure blacklist based on ssid：

WS5302(config)#wids

WS5302(config-wids)#static-blacklist ssid-mac  6809.27b0.169f in ruijie ----->6809.27b0.169f is denied to access to SSID：ruijie

WS5302(config-wids)#ssid-filter blacklist max 256 ----->adjust blacklist capacity (range from 1-256,  optional config)

V. Verification

SSID：ruijie

1.      When an entry exists in the white list,  the corresponding client will access to ssid,STA MAC：(6809.27b0.169f、 8ca9.829a.b1ea)

WS5302#show wids ssid-filter  whitelist in-ssid wireless ---check whitelist

------------------ filter white-mac List Information ------------------

num      mac              SSID

1        6809.27b0.169f   wireless

WS5302#show ac-config client by-ap-name

========= show sta status =========

AP   : ap name/radio id

Status: Speed/Power Save/Work Mode, E = enable power save, D = disable power save

Total Sta Num: 1

STA MAC        IPV4 Address    AP                                   Wlan   Vlan Status         Asso Auth Net Auth  Up time     

-------------- --------------- --------------------------- -----   ----- ---- ---- -------------- --------- --------- -------------

6809.27b0.169f 192.168.20.1    1414.4b13.c248/1            1      20   58.5M/E/bn     WPA2_PSK              0:01:42:11

2. When an entry exists in the black list, the corresponding client will be denied to access to ssid,STA MAC：(6809.27b0.169f, 8ca9.829a.b1ea)

WS5302#show wids ssid-filter blacklist in-ssid wireless     ---check blacklist  

------------------ filter black-mac List Information ------------------

num      mac              SSID

1        6809.27b0.169f   wireless

WS5302#show ac-config client by-ap-name

========= show sta status =========

AP   : ap name/radio id

Status: Speed/Power Save/Work Mode, E = enable power save, D = disable power save

Total Sta Num: 1

STA MAC        IPV4 Address    AP                                       Wlan Vlan Status         Asso Auth Net Auth  Up time     

-------------- --------------- ---------------------------------------- ---- ---- -------------- --------- --------- -------------

8ca9.829a.b1ea 192.168.20.2     1414.4b13.c248/1                        1    20   58.5M/D/bn      WPA2_PSK             0:00:10:24